?????????:???????????????????????

??

??1?17?????????????? ?17??,?????????

????

2024?????12?18?,??????????CNCERT?????????(

????????????????

(?)???????

2024?8?19???????????,?,?/???????2024?8?21????,?????????/?????

(???????????????)????

2024??????8????????????????????????21??????????12?????????,?????????????????????????,????,?????????????????????????????????,??????????/xxx/xxxx?flag=syn_user_policy?????,????????????????/xxx/xxxStats?

(???????????)?

2024??11???????6??????2024?11?8????2024?????11??????????16?,???????????????????????276?????????????

??????????

(?)?????????????????

?IP????????????,???,??,??????????,??

(??????????)??

2024???????11????????????????6???????????11???16?????????,??????3?????IP?,???,?,?????????????????????????????,?????????????????????????????????,????????????????????????4.98GB?

?????????????????????

(??)???????

?,?22????8?,???????????????10?20?,??????????,???

(?)????

?5???????????????IP?????,???,??????????????

(?????)????????

??,?????????????????????,???????????????

?????????????,??????,???????????????????????????????

(?????????)????

???????????????????????,?,?????,??????????276????,????????????,???????????

???????????????????????????IP????????

?????????????????

2024???????????12?????????????18?,?????????CNCERT?(

?????????????

(?)???????????

????????????????????Exchange???????????????????????????2?Exchange?,??,?,????

(?)????????????

?,??????2???????,????????????????????????,?????????????????,??????????????/owa/auth/xxx/xx.aspx??/owa/auth/xxx/yy.aspx,?????????????????????????,????????????,??

(????)??????30????

??????????????,??????????????,?,??SSH?SMB????30??????????;??????????,????????????????????????????????????????????????????????????????????,????websocket+SSH?????????,??????????????????????????,??????????WeChatxxxxxxxx.exe?????????????2?PIPE??????,??

??????????????????????

(???????)???????????????

?,???????????????????????????????????????????????,??,??????????????,???????????????,??????

(?)?????????????????????

????????????????????????????3???????,???,2023???5????????????????????????????2?????????,???????(95.179.XX.XX)?????,???,???????????,??????????????????,??????“??”?“?”?“????????????????????????”?“????????(?+??????????????)”?“?????????????IP????????????”?“????????????????”???????????

(?????)???????????

?????????????????????????????????????????????,?????????????????????????,2023?7?????????????????????26?,???????????????(65.21.XX.XX)???????????????????,????????????,??????????????,????,???????1.03GB????????,?????????????“???????????????????”??????????????“tip4XXXXXXXX.php”?

(??)????????

????,?,?????,?????????????????????????????????????SSH??????????,?????????,?????

?????????????

(?)??

??????????????????????????????????,?????????22??????????????????8???????????????,??10?20??????????????????????,?????????????,??

(????)??????????????

2023???????????????5?2023???????????10???????????????,???????????????????????????30?????,?IP?,???

(???????????????????????)????????????

??????2????????????????PIPE?????“c:\windows\system32\”??????????????????????,?.net???????????????????,??????,?????????????????KB,?????????????????TLS????????????????????????????????,??????https????,?websocket+SSH??,??

?????????????IP???????????????????

????????????:???????????????????????

?????????

??????????????:????????????????????????????

????????