??>>??

???????????????!?????????????????

2025-01-17 21:00:51 | ??:????
???

??

??????????????

2024???12?????????????18?,??????CNCERT?(

??????????????????????????????????

(??????????????????????)??????????????

???????????Exchange??????????????????2?Exchange???????????????,???????????????????????????,?,?????????

(?)????

???????????,???????????????????2???????????????,???????????????????,????????,??????????/owa/auth/xxx/xx.aspx??????/owa/auth/xxx/yy.aspx,?????????????????????????????,????,????????????????????????

(?????????????)??30????

??,??????????????????,????????,?SSH?SMB???30??????????;????????????????,??????????????????????????????????????????????????,?websocket+SSH????,???????????????????????????,?WeChatxxxxxxxx.exe???????????????????????????????????2??????????????PIPE??????????????,??????????????????

?????????

(???)?????????????????????????????????

??????,????????????????????????,????????????,????,????,??

(?)?

??????3????,?????????????????????????????????????,2023?5????2??????????????,???????????(95.179.XX.XX)?,????,????????????,???????????,?�????�?�????????????�?�?�?�?(?+?????????)�?�????????????????????????IP??�?�??????????�??

(???????????)??

????,????????????????????????????????,2023????????????????????7??????????????????????26????????????,???????(65.21.XX.XX)??,????????????????????????????,???????,?????,????????1.03GB??,?????�?�????�tip4XXXXXXXX.php�?

(??)??????????

????,??????????,???????????????,???????????????SSH???,?,??

??????????????????????????????????????????

(?)????????????

??????????????????????????,?????22?????????8?,??????10?20???????????????????,?????????,??????

(??????)???????

2023??????5??????????2023?????10?,?30????????,?IP?????????????,????????????????????????

(??)?

????????????????????????2???????????PIPE??????????�c:\windows\system32\�?,???.net?????????????????,??????????????????????,????????????????KB,??TLS????????????????????????????????????????????,????????????https???????,???????????????????????????websocket+SSH??,??

???IP??????

????????????????????????????

2024?12?18????,?CNCERT????????????????(

???????????????

(??????????????)?

2024?????????8?19??????????????,?????????,????????/??2024??????????????????????????8???????????????????21?????,??/???

(???????????????????????????)???????????????

2024???????8???????????????21??????????12??????,?????????????,??????????????,?????????????????,?????/xxx/xxxx?flag=syn_user_policy???????????,?????????????/xxx/xxxStats?

(??????)??????????????

2024?????????11????6????????????????2024????11?????????????????????8????2024??????????11??16?????????????????,???????276?????????????????????????????

????

(?????????????)?

??????????IP????????????????,???????,?,???????????,???????????????

(?????)?????????????????

2024?11???????????????6?11????16????,?3??????????????IP??????????????????????,???????,????????????????,????????????????????????,?????,??????????????????????4.98GB?

???????????????????????

(??)????????????

?,????????????????????22?8???????????????????????????,?10?20?,?,???

(?)????????

?5?IP??,??,??

(??????????)?????????

????,??????,???????

????,???????????????????????,????????????

(???)??????

?,???????????,????????,?276?,????????????????,?????????????????

???????????????IP???????????

????????:????

?????????

????????????????????!??????????????????????
(??:admin)

????????