??????????????1??????????????17? ???????????????????17?,???

?

2024?12??????????18???,???????????????????????????CNCERT?(

????????????????

(?)?????????????????????

2024??????????????????????8??19?,?,???????/??2024?8?21??????????,??/???????????

(?)?

2024??????8??????????????????????????21???????12???????????,?????????????????,???,???????,?/xxx/xxxx?flag=syn_user_policy?????????????????????????????,?/xxx/xxxStats?

(?)?

2024???11??????????????6??????2024??????????11????????8????2024?????????????????11????????16?????????????????,???????????????276?????????????????????????????

?????????????????????

(?)?

???????????IP???????????????????,?,???????,???,?????

(??)?????????

2024????????????????11????????????6???????????????????????????11???????????????????????16???????????,?3??????IP??????????????????????,?,????,????????????????????????????,?,??????????????????????????????????????????4.98GB?

???????

(?????)??

????,???????????22???????8?????????????????????,??????????10??????????????????20?,?????????????????,?????????????

(????????????????????????????)??????????????

????????????5?????????????IP??????,??????????,????????????????

(????)??????????????????????????????????

????????,???????????????????????????????????????????,???????????

???????,??????,??????

(???????????????)?

??,????,???????,????276????????,??????????????????????????????,????????????????????

?????????IP????????????????

??????????

2024?????????12?????????18????????????????????????,?CNCERT????????????????(

??????????????????????????????????

(????)????

??Exchange??????????????????????2?Exchange???????????????,??,??????,??

(??????????????)?

????????,??????2???,??????,?????????????,?????????????/owa/auth/xxx/xx.aspx???????????/owa/auth/xxx/yy.aspx,??????????????????????????,?,?????

(?)?30????

????,????????????,???????????????????????,?SSH?SMB??????????????30??????????????????????????;?,???????????????????????????????????,?????????????websocket+SSH??????????,???????????????,?WeChatxxxxxxxx.exe???????2???????????????????????????PIPE????????????,??

??????????????????

(????????)???????????????

?,???,??,???????????,???????????????????????,??????????

(??????????????????????????)?????????????

????3????????????,???,2023????????????????5???????2????,??????????(95.179.XX.XX)?,???,?,??????????,???????????????“?”?“???”?“?????????”?“????????????(?+??)”?“?????IP??”?“?”??

(??????)?????

?????????????????????,???????????????????,2023?????7?26?,?(65.21.XX.XX)??????????????,?,??,????,?????????1.03GB??,????????????????????“???????”?????“tip4XXXXXXXX.php”?

(?????????????)?????????

?????????????????,????????,?,????????????????????????????SSH?,?,????????????????????

???????????????????

(?????)????????????????????

?????,??22?????8??????????????????????,?10??????????????20?,??????????????????,?????????????????

(??????)?????????

2023?5??????????????????????????????2023??????????10?????,???????????????????????30???????????????????????,????IP?????????,?????

(?)?

?2??????????????PIPE???????????????????“c:\windows\system32\”?,??????????????.net??,????????????,???????KB,????????????????????????TLS????????????????????????,??https??,?????websocket+SSH?,??????????????

?????????????IP??

??:??????????????????????????????????

??

??:???????????,??????????,??????????????