?????????:???????????????????????

??

??????1??????????????17???? ?????17????????????????????,???????????????????????

???????

2024??????????12?18?,??????CNCERT???????????????????(

?????

(???????????)??????

2024????????8????19????,????,???????????????????????/???????????2024???????????????8?????????21??,??????????/???

(???????????????????)??????????????

2024?8??????21????????????12??,???,?,?????????????????????????????,?/xxx/xxxx?flag=syn_user_policy??,??????????/xxx/xxxStats?

(??????????????????????)??????????????????????????????

2024???????11????????????6??2024???????????????????????????11??8??????2024???????????11??16?????????????,?????????????????276?????????????????????????????

????????????????

(???)?????

?????IP??,??????????,???,?????????????????,??????

(?????????????)?

2024???????????????????????????11???6??????????????????????????????????11????????16?,?3???IP????????????,?,?????????????,?????????????????,????????????????,??????????????4.98GB?

??????????

(??????)?

?,????????????22?????8????,????????10?20?,???????????,?????

(??????????????????)?????????????????

?5?????????IP????,???????????????????????????,????

(?)?

??????????????,???????????????,????????????

??????????????????????,???????????????????,???

(???????)????????????

??????????,???????????,????,?276????????,???,??????????????

?????????IP????????

???????????

2024?12????18???????????????,?????????????CNCERT???????????????????????(

???????????????????

(??????????????)?

?Exchange?????2?Exchange????????????????????,?????????????????,???????,??

(??????????????????????????)?

??,?2?,???????????,??????,???????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,????????????????????????????,????,???????????????

(????)?30?

????,?????????????????????,???????????,???????????????SSH?SMB???????????30???????????????????????????????????????????;?????????????????????????????????,???????????????????????????????????????????,?websocket+SSH?,????????????,?WeChatxxxxxxxx.exe??2?PIPE??,??????????

?????????

(??????????)???

?????,????,???????????????????,???,?,???????????????????

(?)?

????????3??????,???,2023????????????5????????2???????????????????,?(95.179.XX.XX)?,???????,????????????????????????,????,??????????????????“????????????????????????”?“?????????????”?“?????????????”?“?(?????????+?????????????????????)”?“?IP?????????”?“??????????????”??????

(??)????

????????,???????????????????,2023????7??26????????????????,?(65.21.XX.XX)??????????????,????????,???????????????,???????,?????????????1.03GB??,????????????????“????”?“tip4XXXXXXXX.php”?

(?????)?

?,????,?????????,???????????????????????????????????????????????????????SSH??????,????????????,??????????

??????????????????????????

(??????????????)????????????????

??,?22???????????????????8?,??????10???????????????20?????,????????,??

(???????????????????????)????

2023???????????????????????5???????????????2023??????????????10??????????,????????????????30?????,??????IP??????????????????????,??

(?)??????

?????????2???????????PIPE?????????“c:\windows\system32\”???????????????????????????,???????????????????.net??,?,??KB,?TLS????????????????????????????????????????????????,?????https?????,??????????websocket+SSH?,??????

????????????????IP??

?????????????????????????????:?????????????????????????

?????????

??????????????:????????????????????????????

????????