???????????????????????:?????????

??1?17?????????????????????????? ??????????17?,??

?

2024??????????????12?????18?,??????CNCERT????(

????

(???)??????????????

2024?8?????????19?,?????????,??????????????/???2024?8???????21???,??????????/?????

(??)?

2024????????????????????8?????21?12???????????????,????????????????????,??????,????,?/xxx/xxxx?flag=syn_user_policy????????????,?/xxx/xxxStats?

(???????????????????)????

2024??????????????11?6?????????2024?????11?8???????????2024?11??16?,????276???????????????????????????????????

?????????

(??????)???

??????????????????IP?,??????,?,???????????,??

(?)??

2024????????????11?????????????6?11???????????????16???????,?3????????????IP???????????????????????????,??????,????????????????????????,??????,?,???????????????????????????????????????????????????4.98GB?

???

(?????)????

???????????????,?????????????22?8?,??????????????????10?????20?????????????,??,?????????

(?????????????????)???????????

???????5???????????????????????IP????,??????????????????????,????????????????????????

(?????????)?????

??????????????????????????????,?????????????????????????,?????

???????????????????????????,?????????????????,???????

(??????????????)????

?,??????????,??????????????????????,?????????????276???,???????????????????????,????????????????

???IP???????????????????

?????

2024?12????????????18???????????,???????????????????????CNCERT??(

????????????????

(?????)?

?Exchange????????????????????????2?Exchange?,?????????????????,????,???????????

(??)?????

??,????????????????2?,?????????????,????????????????????????????????????,???????????/owa/auth/xxx/xx.aspx??????????????????/owa/auth/xxx/yy.aspx,??????????????????????????????,?,???????

(?????????)????????30??????????????????????????

????,??????,???????,????SSH?SMB?????30????????????????????;???????????????,???????????????????????????????????????????????????????????????????????????????,???????????????????????websocket+SSH???????????????,?????????????????,???WeChatxxxxxxxx.exe??????????????????????2?????????PIPE???????????????????,??

?????????????????????????

(?)??????????

??????,??????????????,??????????????????????,????,??,????????????????????????

(?)?

?3???????,???????????????????????????,2023?????5?????2?????????,??????(95.179.XX.XX)?,?,??????????,??????????????,????“?”?“?”?“?????”?“???????(???????????????????+??)”?“??????IP?????”?“????????????”?????????

(??????????????????????)?

?????????????????,??????,2023???????????7???????????????????????????26???????,????(65.21.XX.XX)?,???,????????????????,?,????1.03GB??,????“??????”???????????“tip4XXXXXXXX.php”?

(????????????????????????????)?

??,??????,?,???????????????SSH?????,??,?????

??????????????????

(?????????)???????????????

???,??????????22??????????8???,????????10?????????????20????????????????????????????,???????????????,??????????????????

(???????????)?

2023??5??????????2023??????10????????,??????????????????????????????????30?,??????????IP???????,??

(?)?????????

???????????????????2??PIPE??????????????“c:\windows\system32\”????????,???????.net???????????????????????????,?,??????KB,????????????????TLS??????????,????????????????https?,????????????websocket+SSH????????????,???????????????

????????????????????????IP?

?????????????????:??????????????????