?????1?17?????????????? ??????????17??,???????????

??????????????

2024???????????????12???????????????18?????????????,?????????????CNCERT??(

????????????????????

(???????????????????????????)????????

2024?8???????????19???????,???????????,??/??2024???????????8?????21????,??/????

(???????????????????????????)???????????????????

2024?8?21?12????????????????????,?????????????????????????????????,????,??????????????????,????????????????????????????/xxx/xxxx?flag=syn_user_policy?????????????,????/xxx/xxxStats?

(??????????????????????)??????????????

2024?11??6??????2024?????11?????8??????????2024?????????????????????????????????11?16?????????,?276???????????????????????????????????????????????

?????????????

(???????)????????????

??????????????IP?,???????????????????????,??,?,?????

(?????????)??

2024????11????????6?11??????????16????????????,?3?????????????????IP??????????,????,??????,???????,?,?????????????????????????4.98GB?

????

(?)??

???,???????????22??????8?,???????????????10???????????????????????????20?????????????????????,?,??

(???????)??????????

???????????????5?IP?,?????,??

(??????????????)??????????????

????,???,???????

????????,?????,???????????

(??????????)?????

??????????????????????,???????,????????????,??276?,???,???????????

?????????IP????????????

?

2024????????????????????12???????????????18???,??????????????CNCERT???????(

??????????????????????????????????????????

(?)?

??????????????????????????Exchange?????????????????????????????2?????Exchange??????????,???????????????????,??????????????????????,????????????????

(???????)????

????????????????????????????,???2?,???????????????????,?????????????????????,?/owa/auth/xxx/xx.aspx??/owa/auth/xxx/yy.aspx,?????????????????????????????????,????????,????????????????????

(?????)??????????????????30????????????

?,??????,????,????SSH?SMB?30??????????????????;?,?????????????????????????????????????????????,???????????????????websocket+SSH??,??????????????????????,???WeChatxxxxxxxx.exe??2?PIPE?????????????????,?????

??????????????????????

(?)?

?,?????????????????,??????????????,????,???,?????????????????????????

(?)?

?3?,??????????????????????????,2023?????????????5??????????????2????,???(95.179.XX.XX)??????????????????????????,?,?,???????????????????????????,????“????????????”?“?”?“?”?“?(????+???)”?“??????IP?????????”?“??????????????”??

(??)??????

??????????????????????????????????????,??????????????????????????,2023????????7?26????????????????,??????????(65.21.XX.XX)?,??????????,?????,??????,?????????????1.03GB??????????,?“??????”?“tip4XXXXXXXX.php”?

(?)??????????

?????????????,???????????????,?????????????????????,???????????????????????????SSH???????????,????,???

?????????????????

(???????????)???????????

?????????????,??????22??????8??,???????????10????????????????20???????????????????,?,???????????????

(?????????)????????

2023?????????5??????????????????????????????2023??????????????????????10?,??30?????,?????IP????????,????????????

(???????????)??

?2??????PIPE?????????“c:\windows\system32\”?,????.net?????????,??????,??????????????KB,??????????????TLS???????????,??????????https??,?websocket+SSH?,????????????????????????

?????????????????????????????IP?

????????????????????:????????

??

??:???????????,??????????,??????????????