?????????:???????????????????????

????:vc???????????:??98?

???

2024?????????????12????18???????????????????,?????????CNCERT???????(

?????????????????

(?)?

2024??8?19??,????????,?????/??????2024????????????8???????????21?????,?????/??????????????????

(??????????)????????????????????

2024????????????8?????????21?????????12????????????????????,????????????????????,????,???????????,?????/xxx/xxxx?flag=syn_user_policy??,??????????????/xxx/xxxStats?

(?)??

2024?11???????????????6???????????????2024????11????8???????????????????????2024?????????11????????????16??????????????,??????????276????????????????????????????????????????????????????

?????????????????????

(????)??

?IP??????????????,??,????????????,????????????????????????,???

(???)????

2024????????11????????????6?????????????????11??16?,?3?IP?,??,?,??????????????????????????,?,???????????4.98GB?

???????????????????????

(????????)???????????????

????????,?22??????????8?????,??????10??20??,?,?????

(?????????????)??????

?5????????????IP????????????????,??????,??

(??????????????)??????

?,????????????????????????????????,??

?,????????????????????????????,??

(?)??????

???????????,???,?,????276?,?????????????????????????????????????????????????,?????????????????

???IP?

?

2024???????????????????12???????????????????????????18??,??????CNCERT??????????????????????????????????(

????

(?????????)???????????

??Exchange??????????????????2??????????Exchange???????????,??,??????????,???????

(??????????)????????????

?,?2?,????,???????????????,?/owa/auth/xxx/xx.aspx???????????????/owa/auth/xxx/yy.aspx,?????????????????????????????????????????????????????,???????????????????,????????????

(????)?????????????30?

?????????????,?,??,?????????????SSH?SMB??????30???????????????????????????;???????????????????????,??????????????????????????????????????????????????????,????websocket+SSH????????????????,???????????????,???????????????????WeChatxxxxxxxx.exe??????2?PIPE??????????,?????????????????

???????

(??????????????????????????)?

?????????????????,?????????????????????,???????????????,????,???????????????,???????????????????????

(???????)????

?3??????????????,??????????????????,2023???????????5??2???????????,?????(95.179.XX.XX)?,?,????,?????,??????????????“?????”?“???????????????”?“??????????????”?“????(????????+???????????????????????????)”?“????????????IP?”?“?”?????

(?????????)??????????????

??????????????????????????,????????????????????,2023???7?????26?,????(65.21.XX.XX)?????????????????????,?,??????????????,????,?1.03GB???????????????????????,???????“????????????????”?????????????????????“tip4XXXXXXXX.php”?

(?)??????????????

?,????,?,?????????????????????????????????????SSH??????????????????,????????,?????????

?????????????

(??)?

???????????????????,???????22??????????8?,??????10??????20???,?,??????????????????????????????????

(??????????)????????

2023?????????????????5?2023????10?,?????????30???????????????????????,??????IP???????,??

(???????????????)???????????

?????2??PIPE??????????????“c:\windows\system32\”??????????,???.net???????????,???,?KB,??????TLS?????????????????????,????https???????,??????????????websocket+SSH?????????????,?????????????????????????

????????????????????????????????IP???

???????:????????