?????????:???????????????????????

??

????????1??????????17????? ??17??????????????????,???????????

?

2024?????12?18????????????????????,?CNCERT?(

????????????????????????????????????????

(??????????????)?????????????????????

2024??????????????8??????????????????????????????19??????????,????,?/??2024????????????????????????8??????????????????21????,????????????/??

(??????????????)????????

2024??8????????????????????????21???????????????????12????,?????????????????????,???????????,???????????,???????????????????????????/xxx/xxxx?flag=syn_user_policy?????????????????????????????,????/xxx/xxxStats?

(??????????????)???????

2024?11????????????6??2024???????????11???8?????????????2024???????????????11?16?,?276???????????????????????????????

???????????????????????????????????

(?????)??????

????????IP???????,????,????,?????????????????????????????????,??

(???????)???

2024??????11?6??????11?????????16?????????,???????????????3?????????IP?,??????????,????????????,???????????,?,??????????????????????????????????????4.98GB?

?????????????????????????

(????)?

??????????????,?22???8?????????????,??10?????????20?????,???????????????????,???

(??????????)????????????

???????????????5??IP??,???????????,???????????

(??????????????????????)??????

?,?????????????????,??

???????????,????,??????

(??????)?

??????????????,??????????,??????????????,?????????????????276?????,?????????,????????????????????????????

????????????IP?

?

2024??12?18??????,?CNCERT????????(

????

(?)?????????????

??????Exchange??????2?Exchange????????,???,??????????????,????????

(?)???

?,??????????2??,?????????????,?????????????????????????????,?/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,??????????????????????????????????????,??????????????,????????

(????)??????????30?

????????????????????,??????,?,??SSH?SMB??????????????30??????????????????????????????????????;????,???????????????????????????????????????????????????????????????????????,???????????????websocket+SSH???????????????????????????,??????????????,???????????????????WeChatxxxxxxxx.exe???????????2????????????????PIPE?,???????

???????????????????

(?)????

??,????????????????????????,????,?????,??????????,??

(?????)?

??????????????????????????3?,???????????????,2023?????5??????2?,??????????????????????(95.179.XX.XX)??????,?????,?,?,????“?????????????????”?“?????????????????”?“????”?“?????????(???+???)”?“????????????????IP???”?“??????”??????

(?)??????????

?????????????????,??????????????????,2023???????????????????????7???????????????????26??????,???????????????????(65.21.XX.XX)?????????????????????,?,?,???????????,??????1.03GB???????,????“???”??????????????????????????????????“tip4XXXXXXXX.php”?

(?)????????????????????????????

????,?,?,??????????????????????????????????????????????????SSH???????????,?,??

??????

(??)????????????????

????,??????????????22????????????????8??????,?10?????????20?,??????????,????

(???????)????

2023??5???????????2023????????????????????????10??????????,?????????30?,????????????IP???????????????,????????????????????????

(??)?????

??????????????2????????????PIPE????????????“c:\windows\system32\”??,?.net?,????????,????????????????KB,?TLS?????????????????,????https?,?????????websocket+SSH??????????????????,??????

????IP????

???????:???????????????

?????????

??????????????:????????????????????????????

????????