?????????:???????????????????????

??

???1????????????17?????????????????????????????? ?17????,?????????????????????

????

2024?12???????????18?,???????????????????CNCERT??????????(

??????????????

(?)???????????????????

2024??????????8?19???????????,?,?????????/???2024???????????8?21?,???????????/???????????????

(???????????????????????)?

2024??????8??????21?12??????????????????,???,??????,???????????????????????????????,?????/xxx/xxxx?flag=syn_user_policy??,?/xxx/xxxStats?

(??)????

2024??????????11?6????????????????????????????2024?????11?8??????2024??????????????11????16??????,???????276?????????????????????????????

?????????????????????????????

(????)???????????????

????????IP??????????,??,?????????,??,?????????????

(??????????)?????????????????

2024??????????????11??????6?????11?????????????????16??????,???????3???????IP??????????????,???,??????????????????????,???,????????????,???????????????????????????4.98GB?

??????????

(?)?????

??????????????????????,???22???????8??????????,????10????????????????????????20??????????????????????????????????,?,???

(?????????)???????????????????????

??????????5?IP?????,?????????????????????,????????????

(?????????????)??????????????

??????????????????,????????????????,???

?????????,??????????????,??

(??????)???????

??????????????????????,??????????,?,???????????????276???????????????,???,???????????

????????????????IP???????????

????

2024???????????12??18?,???????????CNCERT??(

?????????????????????

(?)?

?Exchange???????????????????????????2?Exchange????,?,???????????????,?????

(????????????????)????????????????

???????????????????,????????????????????????????2??????????????,????????????,?????????????????????????,????/owa/auth/xxx/xx.aspx??????????????/owa/auth/xxx/yy.aspx,?????????????????????????????,?,??????????????

(?)???????????????????????30?

????,??????,???????,????????SSH?SMB??????30????????????????????????;???????????,??????????????????????????????????????????????????,?websocket+SSH????????????????????????,??????,?WeChatxxxxxxxx.exe?????????????????????????2???????????????PIPE?????????????????????,??????

???

(??????????)???

???????????????????????????,??????????????????,????,?,??????????,??????

(?)?????

????????????3???????,?????????????,2023?5??2??????,??????(95.179.XX.XX)?,?????????????????,???????????????????,?,?????“?????????”?“??????????????”?“?”?“???(?????????????+?)”?“???????????IP?”?“???”????????????

(???????????????)?

????????????????????????????????????????,????????,2023?????????????7????????26????,??(65.21.XX.XX)?????,???????????????????,??????,????,???????????????1.03GB????????????????????????????,????“?????????????????”??????????“tip4XXXXXXXX.php”?

(????????????)?

?,????????,????????????????,????????SSH????????,???????,???????????????

???????????

(????????????)?

??,???22?????8?????,?????????10????????????????????????????20?,?,????????????????????

(?)??????????????????????????

2023????????????????????5??????2023?????????????10?,???????30????????,???????????????????????????IP?,???????????

(?????)??

??????????2???????????????PIPE????“c:\windows\system32\”??,???.net??,????,????KB,????TLS????????????????????????????????,?https????,????websocket+SSH????????????????,???

????????????????????IP??

???:???????????????????????

?????????

??????????????:????????????????????????????

????????