?????????:???????????????????????

???????????????????????1??????????17???????????? ??17?,????????????????

???????????????????

2024?12???????????????????18?,??CNCERT?(

???

(??????????????????????)????

2024???8??????19???,??????????????,?/??2024???????8??????21????????,????????????/???????

(??????)?

2024???????????????????8???????21?12????,???????????????,???????????????????????????,???????????,?/xxx/xxxx?flag=syn_user_policy??,??/xxx/xxxStats?

(??????????)?

2024?11???????????????????????6???2024???????????11?8????????2024?11??????????16?????????????????,?276????????????????????????????

???????

(???????????????????)???

?IP??,????,????,??????,?????????????

(?)?

2024??????????????11?????6????????????????????11????????????????16????????????,?3????????IP?,?,?,???????,????????,??????????????????????????4.98GB?

????????????????

(???????)??????

??????,?22?8?,????????????????????????10??????????????????????20????????????????????????,???,??

(???????????)?????

?????5???IP???????????,???????????,??

(???????????????????????)????

?,???????,?????

??????????????????,??????,???????????????

(??)?????????

???,???????????????????????,?????????,???????????276?,?????????????????,???????????????????????????

?????????????????????????IP?

????

2024????12??????????????18?,????????CNCERT?(

??????????????????????

(?)?

??????????????????????????Exchange????????????????????????2???Exchange??,??,??????????????????????,???

(??????????????)??????????????

?????????????????????????????????,?2?????????,?????,?????,?????????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,?????????????????,?????????????????????,??????

(???????)????????????30???????????????

??????????????,?????????????????,?????,??????????SSH?SMB????????????30???????????????;?,???????????????????????????????????????????,??websocket+SSH????,???????????????????????????????????,????WeChatxxxxxxxx.exe??????2?????PIPE??????????????????,??????????????

?????????????????

(???????????????)???????

??,????????????,?,????,?????,??????

(??????????????)??????????

????3??????????????????????,?????????,2023??????????????????????????????????5??2??,???(95.179.XX.XX)??,??????????????,?,?????????,???????????“?????????”?“?”?“??”?“?????????????(?+?)”?“???????????????????????IP?”?“????????????????”?????????

(?????????????????????)??????????

???????????????,?????????????????????????????,2023????????????????????????????7?????????26??????,??????????????????(65.21.XX.XX)????,?????????????,?????,???????????,??????????????????????????????1.03GB?????????????????????????,?????????????????“???????”?“tip4XXXXXXXX.php”?

(????????????????????????????)?

?,???????????,?????,???????????????????????SSH??????????????????????????,?????????,?????????????

????????????????????

(?????????????????)??????

?????????????,????????????22?8??????????????,??????10????????20?,????,??????????????

(?)???????????????????????????

2023?5?2023?????????10??????????????,??30?????????,???????????????????????????IP??????,????????

(???????????)?

???????????2???????????????PIPE??????????????“c:\windows\system32\”????,??????????.net?????,?,?KB,???????????????????TLS??????????????????,?????https??,????????websocket+SSH????,???

?????????????????????????????IP????????????????????

???????????????:????????????????