????:1???????:????FJ?

2???????????

3????????????

4???????

5?????????

??1??????????????17? ??????17?????????????,?????????

?

2024?12?18??,????????????????????????CNCERT?????(

???????????????

(?)?

2024???????????????????????8?????????????????19????,?,??????????/??????????????????????????????????2024???????????????????????8??????????21????,??????????????/???????

(????????)?

2024????????????8??????????????21?????????12????,?????????????????,?,???????,??????????/xxx/xxxx?flag=syn_user_policy??????????,?/xxx/xxxStats?

(?????????????)?

2024??11???????????????????6???2024???????????11??????????8???????????????2024??????11???????????16??????,?276????????????????????????????????????????????

????????????????????????????

(?)???????

?IP????,?,?,????,??

(??)????????????????

2024??11?6???????????????????11?????16??,??3????????IP???????????,?,????????,??????????????????,?????????????,???????????????????????????????????????????4.98GB?

??????????????

(????)?

??,???????????22????8??????????????????????,?10???????20?,???,???????

(???????????????)???????????????????

??????????????5?IP????,?????????????????,?????

(?)??????

??????????,????????????,????????????????????

?,?????????,???????

(???????????????)???????????

???,?,?,????????????????????????276?,?????????????,???????????????????????????

?????????????IP?

?

2024??????????12?18????,??????CNCERT???????????(

????????????????????

(??)??

????????Exchange???????????????????2?????????????????Exchange?????????,?,??????????????????????????????????,??

(????????????)???????

??????,?2?????,???????????????????,???????????????,??????/owa/auth/xxx/xx.aspx??????????????/owa/auth/xxx/yy.aspx,????????????????????????????????????????????????????,???,???????

(??????)???????30???????????????????????????

?????????????,???????,?????????,??SSH?SMB????????????????????????30????????????????;?,????????????????????????????????????,???websocket+SSH??????????????,????????????,??????????????????????WeChatxxxxxxxx.exe????????????????????????2???????????PIPE????,??????????????????

????????????????

(???????????????????????)?

?????????????,???????????????,???????????????????,????,????,???????????????????????

(?)???????????

?3???????,?????????,2023?5??????????????????????2??????????????????,????(95.179.XX.XX)??,????????????,?,?,????????????????????“??????????????????????????????”?“?”?“????????????”?“????(??????????????+?????????????)”?“????IP????????????”?“??????????”???????????????????????????

(?)??

????????????????????,?????????????????????????,2023?7??????????????????????????26?,???(65.21.XX.XX)???????,??,????,????????????????????????????,????1.03GB??????,??“???????????????”????????????????????“tip4XXXXXXXX.php”?

(?????)?

?,?????,????????,?????????????????????????SSH?,??,??

????????????????????????????

(?????????????????????)???????????????????????????

????????????????,?22?????????8??,???????????????????10???20???????????????????????????,?????????,????????????????

(?)?????

2023?????5?2023?10?,?????30??,?IP?,?????????????

(??????????????????)?????????????

??????2???????????????????????????PIPE??????????“c:\windows\system32\”????,??????????.net???????????????,??????????,????????KB,?TLS??????????????,?https?,?????websocket+SSH??????????????,??????????

?????????????????IP???

?????????????????????????????:??