?????????????1?????????????????17????? ??17?,???????????

?

2024????12???????18????,?CNCERT?(

??????????????

(???????????)??

2024???????????8?19??????????????,?,??????/???????????????2024?????8????????????????21??????????????,?????????/????

(??)?????

2024???????8???????????????21??????12?????????,????????????????????????????????????????????????,??????,????????????????????,?/xxx/xxxx?flag=syn_user_policy???????????????,????????/xxx/xxxStats?

(?)???????????????????????

2024?????11?????6??2024??????11??????8??????2024???????????????????11????16???????,???????????????276??????????????????????????????????????????

?????????????????

(????)???????

??????????IP?????????,???????????,???????????????????,????????,???

(??)???????????????????????????

2024?11????????????????????????????6????????11?16?????????,?????3?????????????????????IP???????????????????,????,?,??????,?????????,????????????????????????????4.98GB?

????????????????????????????

(?)??

?????,?????22?8?????????????,?10?20???????????????,??????????????,??

(?????????????????)?????????????

??5?IP????????????????????????,??????????????????,???????????

(??)?????

?????????,???????????????????????,?????????????

??????????????,?????????,??

(??????????????)?

?,????,???????,???276?,??????????????????????????????????????????????,?????????????????????????

????????????????????????????????????????????????IP????????????

?

2024?12???????????????????18???????????????????????????,????????????????CNCERT?(

???

(???)?

?????Exchange????2?Exchange?????????????????,?,??????????,??

(????)????????

?,????????????2??????,?,??????????????????????????????????????????????????????????????,?/owa/auth/xxx/xx.aspx????????/owa/auth/xxx/yy.aspx,???????????????????????????????????????????????????????,??????????????????????,????????????

(????)?30???????????????????????????

???????????????????????,??????????????????????,?,???????????????????SSH?SMB??30?????????????????????;????,??????????????????????????????????????????????,???????????????????websocket+SSH?????????????,???,??????WeChatxxxxxxxx.exe??2??????PIPE??,??????

?????????

(??????????????)??????

?,???????,????,????????,?,????????????????

(????????????????????)??????

??3?,??????,2023????5?2????,??????????????????(95.179.XX.XX)???????????????,????????????????,?????????????,???????????????,???????????????“??”?“????????”?“???????”?“????????????????(???+??????????????)”?“????IP?”?“??????”??

(??)??????

????????????????????????????????,?????????????????????????????????????????,2023?????????7?26??????????????????????????????,???????(65.21.XX.XX)????,???????????,?????????,?,??????????1.03GB????????????????,????“?”?????“tip4XXXXXXXX.php”?

(?????????????????)??????????????

?????????????????????,????????????????,??????,????????????????????????????????????????SSH?,???????????,???????????????????

????

(?????????)????

???????????,????????????22???8?,????????????10???20????,???,??

(??)??

2023?5?2023??????????10????,?30?????????????????,??????????IP???????????,????????????

(?)??????????

?2???????????PIPE?“c:\windows\system32\”????,??????????.net???????????????,????,?????KB,??????????TLS?????????,?https?????,?????websocket+SSH????,???

????????IP????????

?????????????:?????????????????????

??

??:???????????,??????????,??????????????