????????????1??17? ?????????????????????17?,??

?

2024?????????12?18?????,?CNCERT?(

???????????????

(?)???????????

2024?????????????8?19??,??????????????,???????????????????/???????????????????????????????2024????????????????????????8???????????????21??????,??????/???????????????

(????????????)?

2024??8????21???????12????????????????,??????????????????,??????????????,??????,??????????????/xxx/xxxx?flag=syn_user_policy??????????,?/xxx/xxxStats?

(??)?

2024?11????6???????2024??11???8???????????????2024????11?????16??????,???276???????????????????????????????????????????????????????

??????????????????????????

(???)??????

??????IP????,??????????????,??????????????????????????????????,???????????????????????????,?????????????

(???????????????????????)??????????????

2024??11?6?11?????????16?,??????????3??????????IP??????????????????????,???????????????,?,?????????????????????????????,??,???????????4.98GB?

??????????????????????????????

(?)???????

?,?22?????????????????????8?,???????????????????10?20???????????????,?,??

(?)?

??????????5?IP??????????,?,?????

(????????)????????

???????????????,???????,??????

????????????????????????????,???,?????????????????

(?)?

?????,?????,??????????,????276????????????????????????,???????,???????????????????????????????????????

?????????????????????IP??

??????

2024????12?????18???????????????????????????,?????????CNCERT?(

???

(????????????)????????????

?????????????Exchange?????????2?Exchange????,?????????????????????????????????,??????????????,???????????

(????)?

??,???????????2?????????????????,?????????????,????????????????????????,???????????????????????/owa/auth/xxx/xx.aspx?????????????/owa/auth/xxx/yy.aspx,???????????????????????????????????????,????,??

(?)???????????????30???????????????????????????

???????????????????,?????????????,????????,??????SSH?SMB?30??????????????????;????????,?????????????????????????????????????????????????????????????????????????,????????websocket+SSH??,???????,??????????????WeChatxxxxxxxx.exe????????????????2??????????????????????PIPE????,??

?????????????

(?)???

????????,?????????????,??,???????????,???????????,???????????????????

(??????????????????)??????

?????3????,??????????????????,2023?5?2??????????????????????????,??(95.179.XX.XX)????????,??????????????,??????,???,???????????????????“???????????????”?“???????????”?“?”?“???????????(???????????????????????+??????????)”?“??????????????IP????????”?“???????????”??????????

(?)?????????

???????,????,2023????????????7?26??????,?(65.21.XX.XX)???????????,?????,?????????,??????,?1.03GB??,?????“??????????????”????????????????“tip4XXXXXXXX.php”?

(?????)?

?????????????,??????,???????,????????????????SSH???????????????,?,???????????????????????????

?????????????????????

(?)?

??,????????????22???????????????????8??????????,??????10???????20???????,??????????????????????,??

(?)???????

2023??????????????5????????????????????????2023???????????10?????????????????,???30??,????????????????IP???,??????

(????????)????????????????????????????

????2????PIPE???????“c:\windows\system32\”?????????????????,?????.net?,?????,????????????????????KB,?????????????TLS?????????????????,?https??,?????????websocket+SSH?,??

??????IP???????????????

?????:??

??

??:???????????,??????????,??????????????