?????????:???????????????????????

?1????????????17???? ??????????????????????????????17???????????,???????????????

??

2024?????????12???????????????18????,??CNCERT?(

??????????????????????????????????

(?)????????????????????????

2024???????????????????????8??????19??????????????????????????????????,?,?/???????????????2024?8????21???,????/???

(?)???????????

2024??????????????8????????21????????????????????????12???????,???????????,??,???????????????????,????/xxx/xxxx?flag=syn_user_policy???????,????????????/xxx/xxxStats?

(??????????????)??????????????

2024???????????11?6???2024?11?????8?2024???????????????11???????????????????????16?,?276???????????????????????????????????????????????????

???

(?????)?

????????????????IP?,?,?,????,??

(?????)??????????

2024?11?????????????6???????????????11?16????????,????????????????????????????3??????????IP?????,??????????,????????????,??????,??,??????????????????????4.98GB?

?????????????

(?????????????????????)??????????????????????????

??????,????????????22?8???????????????,???????????????10???????????????????????????20?,?????,???????

(?????????????????????)????

?????????????????????????????????5??????????IP?????????????,??,?????????

(???????????????)???????????????????

?????,??????,???????????

??????????????,???????,????????

(????????)?????????

?????????????,???????????,?,??276?,??????????????????????????,???????????????????????????????????????????

???????????IP???????

????????????????????????

2024?12??????????18?,??????????????????CNCERT???(

??????

(??????????)??????????????

?????????????????Exchange????????????????2????????????????Exchange???,??????????,?,????????

(???)????

?????????,??????????????????2?,???????,?????????????????????????????,?/owa/auth/xxx/xx.aspx??????/owa/auth/xxx/yy.aspx,?????????????????????,?,????

(?)?30?????????

????,????????????????????,?????????????????,?SSH?SMB???????????????????????????30???????????????;????,???????????????????????????????????????????????????????,???????????????????websocket+SSH??????????,????????,???????????WeChatxxxxxxxx.exe??2???????????PIPE??????,?????????????????

??????????????????????

(????)???????????????????????????

????????,????????????????????????,?,??????????????,????????,?????????

(????)???????

?????????????????3????????????,???,2023????5???????????????2??????????,????????????(95.179.XX.XX)??,?????,?,??????????????,?“??????????????”?“?”?“??”?“????(?+?)”?“?IP???????????????”?“??????????????”????

(??????????????????????)?

??????????????????????????????,??????????????,2023???????7???????26??????????????????????????,?????????????(65.21.XX.XX)???????????????????,??????????,???,??????????????????????,?1.03GB???????,??????????????“???????????????”?“tip4XXXXXXXX.php”?

(??????????????)??????

????,???????????,?????,????????????????SSH??,?????????????,??

???????????????????????

(?????????????????)??????

?????,?22????????????????8?,???????10???????????20?,?????????????????,????????????????????

(?)????

2023???????????5?2023??????10????????????,????30??????????????,?IP??,??

(??????)?????

????????2??????????????????PIPE????“c:\windows\system32\”????????????????????,?.net????,?????,???????????????KB,??TLS?????????????????????????????,???https??????,?websocket+SSH?,??

????IP?????????

??????:??