???????????????????????:?????????

??

??????1????????????????????17? ?????????????????17?????????,?????

?

2024???????????????12??????????????18???????????????????,?CNCERT?(

??????????????????

(?????????)?????

2024?????????????8??????????????????????19?,????,????????/??????2024???????????????????????????8??21?????????????????,?/??

(???)??????

2024????????????8??21??????????????12?,???????????????,?,???????,?????/xxx/xxxx?flag=syn_user_policy??,????/xxx/xxxStats?

(??)????????????????????????

2024????????????????11??????????6??2024????11???????????8??????????2024????????????11?16?,?????276?????????????????????????????????????????????????

????

(?????????????)?

?????????IP??,???????????????????,?,??????????????????????????????,?????

(???)???????????????????

2024?????11?6?11????16?,?3??????????IP??????????????,?????,??????????????,?????????????????????,???????????????????????,???????????????????????????????????????????????????4.98GB?

???????????????????

(???????)???????????????

???????????????????????,????22???????????????8??,????????????????10?20?????,?,??

(???????????)????????

?????5????????IP????,??????????????,??????????????

(?????????)????

?????????,???????????????????????????????,??????

?,??????????????,??????????????????????????????????

(?)??????????

???????????????,??????????,???????????,??276????????????,?????????????????????????,???????????????

?????????IP?

????

2024???????12?18??,???????????????????CNCERT??????????????????????????(

???????????????????????????????

(?????????)?

?Exchange????2??????Exchange?????????????,??????????,????,???

(??)?

????,???????????????????2??????,???????????????????????,??????,??????????????/owa/auth/xxx/xx.aspx????????/owa/auth/xxx/yy.aspx,?????????????????????????????,?????????,??

(?)??????30?

??????????????,??????????,????????????????????????????,?????????????SSH?SMB????????????????????30?????????????????????????????;???,????????????????????????????????????????????????????,?websocket+SSH???????????????,????????????????????????????,???????????????????????WeChatxxxxxxxx.exe??2???PIPE?,?????????????????

?????????????

(???????)?

????????????,?????,??????????????,?,?,????????????

(????)?????????????????

?3???,???????,2023???????????????5????2???????????,?(95.179.XX.XX)?,?,???????????????,??,??“???????????????????????????”?“?”?“?????”?“?(??????+?)”?“?????IP???????”?“???????????”????????

(???????????????????????????)?????????????????????

??????,???????????????????????????????,2023??????????????7??????26????,???????????????????(65.21.XX.XX)?????????????,?,???????????,????????,??????1.03GB?????,??????????“????????????”??????????“tip4XXXXXXXX.php”?

(????????????)??????

?,????????????????,??,????????????????????????????SSH??,????????,??

??????????????????????????????

(?)???

??????????,?22???????8????????????,?10?20?????????,???????????????????????????,??

(?)?

2023?5??????2023?????10??????????????????,???????????????30??????????????????????????????????,?IP????,??

(??????????????)???????????

??????2?????PIPE?“c:\windows\system32\”???????,????????????.net?,????????????????????????????,?????KB,?????TLS???????????????????????????????????????????????,?https??????????????,??????websocket+SSH??????????????????,??

?????????????IP????

????????????:??????????

?????????

????????????????????????????:??????????????

????????