?????????:???????????????????????

?1?17???? ??????????????????????17?,???????????????

??????????

2024?????12?????????18??????,????CNCERT?(

???????

(?????????????????????)??

2024?????????8??????????????19???????,?????????????,?????????????????????/???2024????????8??21??????????????????,????/????????????

(?????)????????????

2024?????????????????8???????????????21???????????12???????????????????????,??????,??????,?????????????????????????,????/xxx/xxxx?flag=syn_user_policy??,?????/xxx/xxxStats?

(??????????????????????)???????????????????

2024?11??????????????6???????????2024?????????????????11????8???????????2024????11??16?????,???????????276???????????????????????????????????????????

?????

(?)????????????????

???????????IP????????????????,?,??????????,?,???????????

(??)?????????

2024???????11???????????6??????11????????????16????,????????3????????????IP??????????????????,?,??,???????????????????????????????????????????,?,???????????????4.98GB?

?????????????

(???????)???????????

???????????????????,?22?????????????8????,????????????10?20?,???????????????,?????

(??????)?

???????5?IP???????????????????????????,?,???????????????

(?????)?????????

?,????????,??

?,???????????????,????????????????????

(??????????????)??????????????????

???????????????????????,??,??,?276?,??????,???????????????????????????????????

?????????????????IP????

????

2024?12???18?????????????,????????????????????CNCERT?????????????(

?????????????????????????????

(?????)?

?Exchange??????2????????Exchange??,????????????,?,??

(??????????????)?

??????????????,?2?,????????????,?????????????????,???????????????/owa/auth/xxx/xx.aspx??????/owa/auth/xxx/yy.aspx,????????????????????,?????,??

(????)??????30??????

???,?????,???????????,??????????????????????????????????SSH?SMB??????30?????????????????????????????????;?,????????????????????????????????????????????????????????????????????,????websocket+SSH?,???????????????????????,??????????????WeChatxxxxxxxx.exe??2?PIPE??????????,??

?????????????????????????????

(?)?????????

??????????,?????,??????????,?????,??????????????????????,??

(??????????????)????????????????????????????

??3?,?????????????????????????????,2023????????5?2?,?(95.179.XX.XX)?,??????????????,??????????,????,??????“?”?“??”?“?????????????”?“??(???????????????+???????)”?“???????????IP???”?“???????????????????????”??????????????

(??????????????????????)???????

?????????????????????,?????????????????????????,2023??????7????????????26??,??????????????????????????????(65.21.XX.XX)?,???????????????,?????,?,?????????????????1.03GB??,?????“???????????”???????????????“tip4XXXXXXXX.php”?

(?)??????

??????????,???,?????,???????????????????????SSH?????????????????,????????,??

???????????????????????????????

(????????)?

?,???????????22???????????????????????????8?,??????10?????????20??????????????,???,??????

(?????????????)??????????????

2023???????5????????2023????10??????????,??????30??,?IP?????????????,??

(?)????

??2???PIPE?“c:\windows\system32\”?,???????????????.net????????????,??????,?KB,??????????????TLS??????????????????????????????????????????????,?https???????????????,?websocket+SSH???????????????????????,????????

????????????????????????????????????????IP??????????