?1?????17???????????? ???????????17????????,????????????????

?

2024?12?????????18????,?????CNCERT??????????????(

???????????????????????????????

(?????????????)??????????

2024?8????????????19?,?,?/???????????2024?????8?21????,?/???????????????

(?)?????

2024?8???????????????21??????????????????12??????????????????????,??????????????????,?????,???????????,???????????????????/xxx/xxxx?flag=syn_user_policy???????????????,?/xxx/xxxStats?

(?????????)??

2024?????????????11?6??2024???????????11??????????8??????????????2024?11?????????16???????,????????????276?????????????????????????????

?????????????????????

(?????????)????????????????????????

????????????????????IP???????????,?,?????,???????,???????????

(?)??

2024??????11????????6?????????????????11????16?????,???????3????????????IP????????????????,?,????????????,????????????,????????,???????????????????????4.98GB?

???????

(?)???????????

??,????????22????????????????8?,???????????10???????????????????????20?,????????????????,????????

(???????????)??

?5??????IP???,?????????????????????????????????,??????????????????????

(??)???????????????????

??????,????,???????

???,??????????,????????

(??)????

?,?????????????????,????????????????????????????,????276???,?????????????????,????????????????

???IP?

??????????

2024?12???????????????????18??????,?CNCERT?(

??????????????????????

(??????)???????????????????????

??????????????????Exchange??????2?Exchange??????????,???????????,??????????????????????,?????

(????????)??????

????,??2???????,????,???????,??/owa/auth/xxx/xx.aspx??/owa/auth/xxx/yy.aspx,???????????????????????????????,???????????????????????????,??????????????

(?)?30??????????????

??,??????????,?,???????????????SSH?SMB?30??????????????????????????????;??????????????????????,????????????????????????????????????????,?websocket+SSH??????,?????????????????????????????????,?WeChatxxxxxxxx.exe??????????????2???????????????????PIPE??????????????,??

????

(??)???????????????????

????????????,??????????????????????????????,???,?,???????,????????????????????????????

(????)?????????????

???????????????3?,???????????????,2023???????????5??2??????,?(95.179.XX.XX)???????????????????????????,??????????????????????????????,?????,??,???“?????????????????”?“?”?“??????????????????????????????????”?“???????????????????(?+?)”?“?????IP????????????????????????????”?“????”??

(??????)??????

????????????????,???,2023?7??????????26?,???????????????????????(65.21.XX.XX)???????,??????????????,??????????????,??????????????????????????,??????????????1.03GB???????????????,????????“????????”???????????????????“tip4XXXXXXXX.php”?

(?)?????????????????

?????,?,??????,????????????????SSH?,????,??

??????????????

(?????????????????)????????????

????,????22??8??????,?10????20?,?????????????,???????????????????????????

(?????????)???????????????

2023???????????????????????5?2023??????????????????????10?????????,???????????????????????????30????,?IP?,????????????????

(??????)???????????????

??????????2?PIPE???“c:\windows\system32\”?????????,??.net???????????,??????,????KB,?TLS??????????????????????????,???????https????????,?????websocket+SSH????,??????????????????????

??????????IP???

????????????????????????:?????????????????????????

??

??:???????????,??????????,??????????????