?????????:???????????????????????

???????????1?17?????? ?????????17??,??

?????????

2024??12?18???????????????????,????CNCERT?????????(

???

(??????)?????????

2024????8????19?????????,???????,???/??2024?????????????????8?21???????????,??????????????/?????????????????

(??????????)??

2024???????????????????8????????21???????????????????????12????????,???????,???????????????,????????????????,???????????????/xxx/xxxx?flag=syn_user_policy??????????????,???/xxx/xxxStats?

(????)?

2024?????11???????6???2024?11?8?2024??11?16???????,??????????276?????????????????????

?????????????????????????????????????????????

(??????????????????????)?????????

??????????IP???????????????,????????????,????????????????,?????????????????????????????????,??

(?)???????????????????????????

2024??11??6??11?????16?????????????,????3?IP????????????????,??????,???,??????????????????,?,????????????????????????????????4.98GB?

???????????????????????

(?)???????????

?,?????22?????????????8????????,????????????????10?20?????,?,????????????????

(????????????????????????????)???????????

????5??????????IP??????,?,?????

(?)?

??????????????????????,?????????,????????????????????????

?,???????????????,???????

(?)?

??????,????,?????????????????,???276???????????????,???????????????,???????????????????????????????????????????????

????????????????IP?

?

2024?????12?18???????,?????????CNCERT????????????(

??????????

(?????????)????

??????????????????Exchange???????????????????????????????????????????????????????????2??????????Exchange???????,??????,?,??

(?????)??

?,????????????????????????2?,?????,?????????????????????????????,??????????????????????????/owa/auth/xxx/xx.aspx????/owa/auth/xxx/yy.aspx,?????????,????,????

(?)?30?????????????????

???????????,?,?,??????????????????????SSH?SMB?30???????????????????????;??????,?????????????????????????????????????????????????????????????????????,??websocket+SSH????????????,????????????????,???????????WeChatxxxxxxxx.exe?????2?????PIPE?,??????????????

????????

(?????????????????)???????????????????????

????????????,????????????,??????,??????????????????????,??,?????

(???????????)??????

??????????????3??????????,?????????????????????,2023?????????5??2?,???????????(95.179.XX.XX)??????????????,??????????,??????,?,??“??????????????”?“???????????”?“?”?“?????????(?????+???????????????????????)”?“??????IP????????????????????????????”?“????”???????????????

(??????????????)?

?????????????????,????????????,2023???7????????????????????26???????????????????????????,?(65.21.XX.XX)???????????????????,??,??????????????,??????,?????????????1.03GB????????????????????????????,??????????????????“????????”????“tip4XXXXXXXX.php”?

(????????)???????????????

???????,????,?,????????????????????????????????????SSH?????,????????????,??

??????

(?)????

????????????,??????????22?????8?????,????????10?20?,???????????????,??

(???????????)????

2023?????????????????????5??????2023?10?,??30??????,???????IP???????????????????????????,??

(?)??????????????

??2???PIPE?“c:\windows\system32\”?????????????,??????????.net????????????????????????,?????????????????,????KB,??TLS??????????????????????????????????????????,?https??,??websocket+SSH?????????????????????,???

??????IP???????????????????????

????????????:?????????????