?1???????17?????????????? ??????17?????????????????,??

????????????

2024??????????12???????????????18????,?CNCERT?(

??????????????????

(??)?????????????

2024???8????????????????????19???????????????????????????,???????,???/?????2024????8??????21??????????,?/???????

(??????????????)?????????

2024??????????8?21????????????????12????,???????????????????????,???????????????????????????,??????,????????????/xxx/xxxx?flag=syn_user_policy???????????????????????????,??/xxx/xxxStats?

(????)????????????????

2024????11?????6?????????????2024???????11??8?2024?11???????????16????,?276????????????????????????????????????????????????????

???????????????????

(?????????)???

????IP??????,????????,???,???????????,??

(??????)??

2024????????????11?6????????11?????????16??????????????,?????3?IP??????,???,?????,???????,?????????,????????????????????????????4.98GB?

?????????

(?)????????

???????????????????,????????22?8?,?10???????20???????????????,?,???

(?????)?????????

?5??????????IP?,??,???????

(???????????)?????????????????

????????????,????????????????????????????,??

???????,??????????????,????????????????????

(?)??

???????????????,???????????,??????????????,?????????????????????????????????276????????,?????????????????,????????

???IP??

?

2024?12????????????????18?????????,????????????CNCERT????(

????????????????????????????????????????

(?????????)????????????????????????????

??????Exchange??????????2?Exchange????,?????,?,??????

(???)??????????????????

???????????????,??????????????2?????????????????????,?,??????????,??????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,?????????????????????????,?,????????????????????????

(????)??????30??????

?,??????????,?,????SSH?SMB??????30?????????????????????????????????????????????????????;???????????????????,??????????????????????????????????????????????????????????????????????????????????????????????????,??websocket+SSH?????,?????????????,???????????WeChatxxxxxxxx.exe???????????????????????2???????PIPE?,???

??????????????????????????

(???????)?

?????????????,????????????????????????????,?????????,????????????????,?,??

(???????????????)??????????????????????????

???????????????????????????3?,????????????????????????????,2023?????5?2?????????????????,???????????????????(95.179.XX.XX)??????????????????,?,??????????,????????????????????????,?“???????????????????”?“??????????????”?“??????????”?“????(????+????????????????????????????)”?“????IP?”?“?????????????????????”??

(?)?????????????

???????????????,?????????,2023?7??????????????????26?????????,?(65.21.XX.XX)???????????????,????,?????,??????????,?1.03GB????????????????,?“????????????”??????“tip4XXXXXXXX.php”?

(?)?

?,?????????,??,????????????????????????SSH??????,?,???????????????

????????????????

(????????)?

?????????????,??????????22?8??????,????10?????20??????????????,??????????,?????????????????????????

(????????)??

2023??5????2023???10????????????,??????????30???????????,??????IP????????????????????????,????????????

(??????????????????????)?

?2?PIPE?????“c:\windows\system32\”?,?.net?????????????????,?,??????????????KB,?TLS???????????????????????????????????????????,???https?,?websocket+SSH?????????????,??????

?????????????????????????IP??????????

????????????:???

??

??:???????????,??????????,??????????????