???????????????????????:?????????

??????????????1?17?????????????????????? ??????????????17????????????????????????,????????????

???????

2024???????????12?????????18????,???????????????????CNCERT???????????????????????(

?????????????????????????

(????????)?????????

2024????????8??19?,???????????????????????????,?????????/???????????????2024?8??????????????21????????????????????????????,????/?????????????????

(??????????)???????

2024???????????8???21??????????????????????????????????12?,????,???????????,?????????,??/xxx/xxxx?flag=syn_user_policy?????????????,?/xxx/xxxStats?

(???)?

2024???????????????11?6??2024??????????????11?????????8?2024??????????????11????16??,????276????????????????????????????????????????????????????????????????

????????????????

(?????????????)?

????IP????,????????????????????,?,??,?????

(????)?????

2024?11?6?11?16??,?3????IP???????????????,???????????,?,????????????????????????????,?????,??????????????????????????????????????4.98GB?

?????????????????

(???????????????????)??????

??????,?????????????????22?????????????????8?,????????????????10????20????????,????,???????

(????)?????????????????????

?????5??????????IP??????????,?,????????????????????????

(?????)?????????????

?,?????????????????????????????????????????,??????

?????????????,????????????????????????,??

(???????????????????)???????????????????????

????????????,?,???????????????????????????,?276?,????????????,????????????????????

?????????????????????IP?

?

2024??????????12?18?,?CNCERT??????(

???

(?????????????)????

?Exchange??????2?Exchange?,?????????,????,???

(?)???????

?,?2??????,?????,???,????????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,?????????????????????????????????????,?,???????????????

(???)???30?????

????????????????????,?????????,????????,???????SSH?SMB??????????30??????????????????????????????;?????????,?????????????????????????????????????????????????????????????????????,????websocket+SSH????????????,???,??WeChatxxxxxxxx.exe????????????2????PIPE?,???????????

???????????????????

(????????????)??????

?????????????,??????????????????????,?,??????????,??????,???????

(???)??

??3??????????????,?????????????????????????????????,2023?5????????????????????????????2?,?????????????????(95.179.XX.XX)??????,??????????????????,???????????????????,???????????????,???“???????”?“??”?“??????????????????????????????”?“???(???????????????????+??????????????)”?“??????????IP??????????”?“?”???????????????????

(?)???????????

???,????????????????????,2023?7??????26????????????????????????,??(65.21.XX.XX)?,????,??????,?????,?1.03GB???,??????????????????????“????”?????“tip4XXXXXXXX.php”?

(?)???

?,?????????,???????????????,????????????SSH???????,??????????,?????

???????????

(????)???????????????????????????

???????????????,??????22??????????????????????8?????????????,?10?????????????????????20??????,?????,????????????????

(???????????????????????????)?

2023???????5???????????2023??10?,?30???????????,????IP????????????,???

(?????????????)?

?2???????????????PIPE??????????????“c:\windows\system32\”???????????????,?.net?????????????,?????,?KB,??????????TLS????????????????????????????????????,??????????????https??????????,????????websocket+SSH?,????????

???????????IP???