?1??17?? ?17?,??

????????

2024?12???????????18?????,?????CNCERT???????(

????????

(??????????????????????????)??

2024???????8?19???????????????,???????,????/??2024???????????8?21????????????,??????????/?????????????????????????????

(?)??????

2024???8???????????????????21?????????12??,???????????????????????????????????????,???????????????????????,????????????????????,???????????????????????/xxx/xxxx?flag=syn_user_policy???????????,?????????????????????/xxx/xxxStats?

(????)???????????????

2024??????????????????????????????11?6??2024??11??????8??????????????2024??????????????????11??16?????????????????,?276????????????????????????????????????????????????

????????????????

(??)????

??????????????????????IP?,??????????,???????????????????????????,????????????,??

(????????????????)??????????

2024????11?????????6?11??????16???????????????,????????????????????????3?????IP?,????????,??????????,??????????????????????????????,?,??????????????????????????4.98GB?

?????????????????????????

(?)??????????????????

???????????????????????????,?????22?????8?,????10????20?,???????????,???????

(???????????)??????

??????5??????????????IP???????????,?,??????

(????????????)??????

???????????????????,???????????????,???????

?,????,??????

(?)?

???????????????????????????,????,???????????????????????,?????276??????????????,???,?????????????

???????????????????????????IP?

?

2024????????????????????12????????18??????????????????????????,?????????????CNCERT?(

??????????????????

(?)?????????????

?????????????????Exchange?????????????????????????2?????????????????Exchange??????,??,??????????????????,?????

(?)???

????????,?2???????????????,??,?????????????????????????????,?????????/owa/auth/xxx/xx.aspx????/owa/auth/xxx/yy.aspx,??????????????,??????????,???????????????

(??????)????????????????????????????30??????????

???????????????????,????????????????,?????,???????SSH?SMB???????????????????30???????????????????????????;???????,?????????????????????????????????????????????????,????websocket+SSH????,??????????????????????,?WeChatxxxxxxxx.exe????????2?PIPE????,?????????

????????

(?)?????

?????????????,????????,?,?,?????????????,??????????????????????????????????

(?????)??

??3?,???????,2023????????5???2?,???(95.179.XX.XX)?????????????,?,??????,??,????“??????????”?“??????????????????????????????????”?“??”?“???????????????????(???+?)”?“????????????IP?”?“??????????????”???????

(?????????????????)?

???????????????????????????????????,?????????????????????,2023???????????????7?26???????????????,?(65.21.XX.XX)??,???????????,??,???????????,????1.03GB???????????????????????,????????????????????????“??????????????????????”????????????“tip4XXXXXXXX.php”?

(????????????????)?

?????????????????????,??????????,?,??????????SSH???????,??????,???????????

???

(??????????????)?

?,?22?????????8???????????,????????????????10???????20?,?????,????????????????????????

(?)?

2023????????5????2023?10?,??????????????30????????????????????,??IP?,??

(????)???

????????????????2??????PIPE??????????????“c:\windows\system32\”????,?.net?,?????????????,???????KB,??TLS??????????????????????????????????????????????????,?https?,?????websocket+SSH?,???????

???????????????????????????????IP????

??????:??????????

??

??:???????????,??????????,??????????????