?????????:???????????????????????

?????????????1???????????17?????? ???17?,??????????

?

2024???????12????????????????????????????18??????????,?CNCERT????(

????????????????????

(???)???????

2024?????????????????8?19????,???????????,?????/???????????????2024??????8????????????????????????21?????????????????????,??????/???????

(????????)??????????????

2024???????????????8?????????????21???????????????????12???????????,???,???,?????????????????????????,????/xxx/xxxx?flag=syn_user_policy????????????,?????????????/xxx/xxxStats?

(???????????????????????????)?

2024???????11???????????6??2024????????11??????????????8??2024??????11??16???????????????????????????,????????276??????????????

?????????????????????????

(???????????????????????????)?????????

?IP??????????,?????????????,??,??????????????,??

(?)?

2024????11??6?11???????????????16??????,??3??????????????IP??????????,????????,???????????????????????,????????????,???,??????????????????????4.98GB?

?????????????????

(??)??????????????????

????????????,?????????????22?????????????????8?????????,???????????????10?20?,?,?????

(???)??

???????????????????5???????????????IP???????????????,????????????,?????????????

(?????)?

?,??????????????,???

?????,?,???????????????

(???????)??????????

?,?,?,??????????276??,?????????????????????????????????,????????????

???????????IP?

???????

2024????????????????????????????12?18?????,?????CNCERT?????????(

???????????????

(??????)?

??????????????????????????Exchange????????????????2?Exchange?,?????,?,??

(???????????????????????)????????????

?,??????2?????????????,??,????????????,????/owa/auth/xxx/xx.aspx??????/owa/auth/xxx/yy.aspx,?????????????????????????,?,?????

(??)???????????????????????30?

??????????????????,???????????????????,??????????,?????SSH?SMB??30??????????????;???????????,??????????????????????????????????????????????????????,????????????????????websocket+SSH?,????????????????????????????????,?WeChatxxxxxxxx.exe??2????PIPE?,?????

????????????????????????

(??????)????

???????????????????,????????????????????????????????,??????????????????????,???????,??????????,?????

(?)??????????

?3?,???????,2023?5??????????????2???,?????????(95.179.XX.XX)???????????,????????????,????,???????,??????????????????????“?”?“??????????????????????????”?“???”?“?(?+???????????)”?“???????????????IP????”?“??????????????”?????

(????)????

?????????????????????????,????,2023?????7?????????????????26??,????????????????????????(65.21.XX.XX)??,????????????????????,??????????,?????,?1.03GB??????,??“???????????”?????“tip4XXXXXXXX.php”?

(???)?

??????????????,?????,??????,??????????????????????????????????????????????????????????SSH????????????????????????,?,?????????

???

(??????)???????????????

??????,?????????22????8????????,?10??20???????????,?,??????

(???????)???????

2023?5????????????????2023????10??????,????????????????30??,?IP?????????????????????,??

(????????????)??????????????

??????????????2?????????????????PIPE???????????“c:\windows\system32\”??????????,??????????????.net??,???????????????????????,??????KB,??????????????TLS????????????????????????,?https??????????????????????????????????,???????????????????websocket+SSH????,???????????????????????

??????????IP?????????????????????????????????

?????:?????????