?????????:???????????????????????

??

??????????1???????17?????????????????? ?????????????????????17??????,???

?????????????????

2024???????????????????12?18????,????CNCERT??????????????(

??????

(??????????????)????????????????

2024?8?????19????????????????????,???????????,?/????????????????????????2024??8?21?????,?????????????????/??????????

(?????)????

2024????8?????21?12???,??????????????????,?????????????,????????????????,??/xxx/xxxx?flag=syn_user_policy??,??????????????/xxx/xxxStats?

(???????????????)??

2024?11?6?????2024????????11??8??????????2024??????11?16???????????????,??????????????????????????????276????????????????????

???????????????

(?)???????

??????????IP????,????????????,??,??,???????????????????????

(??)?

2024???11????????????6?11?16???????????????????????????,????????????3?????????IP???????,???????????????????,??????????????,????????????,???????????????,?????????????????????????4.98GB?

??????????????

(?)???????????????????????????

?,?????????22??????8?,???????????10?????????????????20?,????,???

(?)????

??????????????5???????????IP?,??????????,???????????????????

(?)???

?,???,?????

??????????,?????,??

(???????????)?

?????????????????????????????????,????,?,???????????????????????????276???,?????????????????????,????????????????????????

????????????????????????????IP?

?

2024???????????????????12??????????18???????????????,??????????CNCERT?(

????

(????????????????????????)????????????????????????????

???????????????????????Exchange???????????2???????????????????????Exchange?,?,?,??????

(??)?

????????????,?2?????,??????????????,???????,??????????????????/owa/auth/xxx/xx.aspx??????????????/owa/auth/xxx/yy.aspx,???????????????????????????,??????,?????????????????

(????????????)?30?

???????????????,????,???????????,???????????SSH?SMB?????30???????????????????????????;??????,???????????????????????????????????????,??????websocket+SSH??????????,???????????????????????????,?WeChatxxxxxxxx.exe????????????????????2????????PIPE?,????????????????

???????

(?)??

??,?????????????????????????????????,???,????,??????,????

(????????)???????????????

?3??????,??????,2023??????????????5?2??????????????????????,????(95.179.XX.XX)???????????,????,??????????,?,????“?”?“?”?“????”?“??????????????????????????????????(?????????????+???????????)”?“?IP?”?“????????????”??????

(????????????????????????????)????????

???????????????????????????????,????????????????,2023???????????7?26????,?????(65.21.XX.XX)??????????????,?????????????????????,?,?????????,?1.03GB??????,?“??”??????“tip4XXXXXXXX.php”?

(??????)???????????????

????,???????????????,???????,????????????????????????????????????SSH???,??????????????,???

??????????????????????????

(??????????????)?

?,?22?????????????8??,????????????????????????10?????????????20?????????????,???,?????????

(?)??????????

2023???????5?2023???????????????????????????10?????????,??30??????,??????????IP???????,???????

(????????????????????????)???????????????????????

????????2??????????????????????????PIPE?“c:\windows\system32\”?,?????????.net??????????????????????????,?????,?????KB,?????????????????TLS?????????????????????????????????????????,???????????https?,?websocket+SSH??????,?????????????????

??????????????????????????IP?????????????

??:????????????

?????????

??????????????:????????????????????????????

????????