???????????????????????:?????????

???????????1???????????17?????????????????????? ?17???????????????????????,????????????????????

??????????????

2024????????12?????????????????????????????????18?,??????CNCERT????????????????(

????

(?)?

2024??????????????8?19??????????,?????,????????/????2024????8????????????????????21?????????????????,?/???

(????????????????????????????)????

2024??????????????8?21?12???????,????????????????????????????????????????????,?,??????????,????/xxx/xxxx?flag=syn_user_policy???,????????????????/xxx/xxxStats?

(??????)????????????????????????

2024???????????11??????6??2024????11??????????8????2024?11?16??????,?????????276??????????????????????????????

????????????????????????

(??????????????)??

?IP?,??????????,???????????????????????????,??????????,????????????

(?)????

2024??11?????6?11?16?,??3?IP????????????????????????,???,???????,??????????????????????????,?,??????????????4.98GB?

?????????????????

(???????????)????

??????????,??????????????22?8?,?????????????10??????20??????????????,???,??????

(?????)???????????????????????

?5???IP???????????????????,?,????????????????????

(?)?

????????????,??????,??

?,?????,?????????

(?????????)?????????

???????????????????????,?,???????????????,??276?????????????,?????,?????????????????????

????????????????IP???????????????

?????????????

2024????????????????????????????12?18??,????????????CNCERT????(

?????????????????????

(???????????????????)??????????

????????????????Exchange????????2??????????Exchange?,???,???????????????????,???????????

(?)????????????????

??????????????,??????2?????????????????????,???,????????????????????????,?/owa/auth/xxx/xx.aspx???/owa/auth/xxx/yy.aspx,????????????????????????????????,?????????????????????,??

(?????????????)????????????30???????????????

????,???????,??????,?SSH?SMB?????30?????????????????????????????;?,???????????????????????????????????????????????????????????????,????websocket+SSH?,????,?WeChatxxxxxxxx.exe????????2?PIPE?????,???

??????????????????????????????????????????

(?)??????

???????????,????????????????????,??????????????????????,??????????,??,???

(?????????????)?

???????????????3???????????????????????,?????????????????,2023????????5???????????????2????,??????(95.179.XX.XX)????,?????,????????????????????,????,??????????????“???????????????”?“??????????????????????????”?“????????????????????????”?“????(??+?????????????????)”?“?IP???????????????????????????”?“???????????”??????????????????

(??????)???????????????

????,???????????????????????,2023?7?????????????????26??,??????(65.21.XX.XX)????????????????,?????,?????????,?,????1.03GB?????????,???????“???????????????????”???????????????“tip4XXXXXXXX.php”?

(?)?????

????,?,????,???????????????????????SSH?,?,??

??????

(???)????????????

?????,??????22???????8????,?10?????20???????,??,??

(???????)??????????

2023?5??2023??????????10?,???????????30??????????????????,?IP?????????????,????????

(?)???????????????

?2?PIPE?“c:\windows\system32\”??????????????,??.net??,??????????,?????KB,?TLS????????????????????????????????????????????,?????????https???????????,??????????????????????????????????websocket+SSH?????????????,??????????

????????????????????????????????????IP??????????????????????????

?????????????:???????????????