?????????:???????????????????????

????:2023?????:????98???

????????????1????17????? ??????????????17??????????????,??????????

???

2024???????????????????12?????18????????????????,?????????????????CNCERT?(

???

(???????)???

2024?8????19??????????,??????????,????/??2024?8?????????????????21?,??????????/????????????????

(??????????)????

2024???????????????8?????????21???????????????12?,??????????????????,????????????,??????????????,??????/xxx/xxxx?flag=syn_user_policy?????????,???????????/xxx/xxxStats?

(???????????)??????

2024?11?????????????6????????????2024????11???????????8????????????2024??11??16?,?276????????????????????????????????????????

??????????

(?)?

??IP????,????????????,????,???,??

(?)?

2024??????11?????????????6??????????11??16?,?????????????3?IP?????,?,????????????????,?????????,?,??????????????????????4.98GB?

?????????????????????????

(???????????)?

???,?22?????????????????????8?,???????????10?????20?,??????????,??

(?)?

??5?IP?,?,???

(?)?

???????????????????????????,?????????????????????????,???

???????,?,??

(???????????????????)????

???????,????????,??,????????????????276?????????????,???,???????????????????????????

?????????????????????????????IP???????????????????????????

???????????????

2024?12????18??????,??????CNCERT???????????????(

????????????????

(???????)????????????????????????

????Exchange??????????????????????????2?????????Exchange?????,????????????????????????????,?????????,????

(??????)?

????????????????,???????????????????????2?????,?,??????????????????????,?/owa/auth/xxx/xx.aspx????????/owa/auth/xxx/yy.aspx,????????????????,?????????????,???????????????

(????)?30?????????????????????????????????

?,???????????????,?,???SSH?SMB????30?????????????????;???????????????????????????,??????????????????????????????????????????????????????????????????????,?????websocket+SSH???????????,???????????,????????????????????WeChatxxxxxxxx.exe??2????????????PIPE??????????????,??????????????????

????????

(?????)??????????

??????????????,????,?????????,??????????????,?,???????????

(?)????

???????3?????,?????????????????????????,2023????5???????????2?????,????????????????(95.179.XX.XX)???????????????????,??????????????,???????????,???????????,??“??????????????????????????????????”?“??????????????”?“???????????????????”?“?(??????????????????????+??????????????)”?“??????????????????????????IP?????????”?“?????????????”??????????

(??????????)?

?????????????????,???????????,2023??????????7??????????????????????????????26??,???????????????(65.21.XX.XX)?,????,??????????????????????????,????,???????????????????1.03GB???,???????????????????“???”??????“tip4XXXXXXXX.php”?

(???????)???????????????

??????????????,???????????????,??????,???????????????SSH??????????????,???????????????????????,??

??????????????????????????????

(??)??

?????,?????????22???????8????????????????????,?10??20?,????????????????????????,??

(???????)??

2023??????????5????2023?10??????????????,???????????????????????30???????????,??????????IP?,???????????????????

(?)??????????????????????

??2?????????PIPE????“c:\windows\system32\”????????????????????????????,?????????????????????.net?,?????,???????????????????????KB,?TLS?????????????,?????????https????????????,??????websocket+SSH?,?????

????????IP????

???????:??????????????????