?????????:???????????????????????

??

????1?????17???????? ??????????????17??????????????????????????????????,????????????????

?????

2024???12?18?,??????????????CNCERT???(

??????????????????????????????????????????

(????????????)???????????????????

2024?????????????8??????19???????,???,????????????????/??2024????????????8?????21?,????????????????/????????????

(????????????????????)?????????????

2024?8??21????12????????????,????????,??????,????????????????????????,???????????????????????/xxx/xxxx?flag=syn_user_policy???????????,?/xxx/xxxStats?

(???)??

2024??????11???????6??????2024???????????????11???8??????2024??11?16??????????,??????276???????????????????????????????

?????????????

(????????????????)?

????????????IP????????,??????????????????????,?,???????????????????,??????????

(??????????????????????)??????????????????

2024?11?6?11????16???????????,?????3?IP????,????????,?????????,????????????????????,??????,???????????????????????4.98GB?

??????

(???????????)???????????

??,??????????????????????????????22???????????????8????????,???????????????????10????????????????????20??,???????????????,????????????????

(?)????????

?????????????5???????????????????????IP?,??????????????,??

(??????????????)?

?,?????????????????,??????????????????

???????????????????????????,???????,????????????????????????????

(????????????)?????

?????????????????,?????,?,?????276?,????????????,????

??????????????????????????IP?

?

2024??????????12????????????????18???????????????,?CNCERT???????(

????????????

(????????????)????

??Exchange?????????????????????2??????????Exchange?,??????????????????????????,?,???????????

(??????????????)?????????

?????,???2??????????????????????,???????????????????????,????????????,??/owa/auth/xxx/xx.aspx????/owa/auth/xxx/yy.aspx,?????????????????????????,???????????????????,?????

(?)????????30??????????

??,????,??????????????,????????????????????????SSH?SMB?30???????????????????;?,???????????????????????????????????????????????,????????????????websocket+SSH??,?????????,?WeChatxxxxxxxx.exe??2????????????????????????PIPE?????????????,?????

?????????????????????

(??????)?????????

?,??????????????,??????,?,?,??

(???????????????????)??

?3????,???????????,2023??5?2??????????,????????????(95.179.XX.XX)??????????????,????????????????????????????,??,????,?“??????????”?“??????”?“?”?“?(?????????????????+?)”?“?IP?”?“?”???

(??????????????)?????????

??????????????,???????????????,2023???7?26??????????????????,??????????(65.21.XX.XX)???????,????,?????,???????,??1.03GB?????????????????????????,???????????????????????????“???????????????????”?????????????“tip4XXXXXXXX.php”?

(?????????????????)?????

?????,?????????????????????,??,?????????????????????????????????????SSH??????,??????????????????????,??

????????????????

(?????)?

??????????????,?????????????????22??????????8??,?10???20??????????????,???????????????????????,??????????????

(?)???????

2023?5???????????????2023????10?,?????????30????,?IP?,??

(?????????????????????????????????)???

??????????????2??????PIPE??????“c:\windows\system32\”????,?.net?????,??????,?KB,???????????????TLS????????????????????????????????????????????????????????,???????????????https?,??????????websocket+SSH?,???????

?????????????????????????????IP?

??:???????

?????????

??????????????:????????????????????????????

????????