???????????????????????:?????????

?1??????????17??????????????? ???????????????17??????????????,?????

???????????????????

2024????12?18???????,?CNCERT????(

?????????????

(?)???????????????????

2024?8???????19????,????,???/??2024???????????????8?????????21?????,??/????????????????????????????

(?)?????

2024??8?21?????????????????12???,??????,????,???,?????/xxx/xxxx?flag=syn_user_policy????????????????,??????????????/xxx/xxxStats?

(??????????????)?

2024????????11?6??????????????????????????????????2024???????????11?8???2024?11?????16??????????????????????????????????,?????????????????276?????????????????????????????

???????????????

(???????)?????

????IP????????????,??????????????,?????????????,??????????????,??????

(??????????????)?????????????????

2024?11?????????6???11????????????16?,????????????3??IP??????????,???????,??????,?????????????????,?,???????????4.98GB?

?????????????????????????????????????????????????

(?)?

???????????????????????????,?22???????????????????8??????????,?10??????????????????????????20?,??????????????,???????

(???????????????????)?

???5????IP???????????,?,???????????????

(??)?????????

??????,???????,??????

?????,??????,??

(??????????????????????)?????????

?,???????????????????,?????????????????????,??276??????????????????,??????????,?????????????

??????????????????????????????IP???????????????????????

?????????

2024????????12????????????????18?,????????????CNCERT?????(

????????????????????????????????

(?)?

??????????????Exchange???????????2???????????????????????Exchange??????????,????????,????????????,???????

(????)???????????

?????????????,????????????????2???????,???????????,???????????????????,?/owa/auth/xxx/xx.aspx??????????/owa/auth/xxx/yy.aspx,??????????????????????????????????,?????????,??????????????

(??????????)??????????30????

??????,??????,????????????????????????????,?SSH?SMB?30???????????????;??,?????????????????????????????????????????????????????????????,?????????????????websocket+SSH??,????????????????????????????,?WeChatxxxxxxxx.exe?????2?PIPE?,????

????????

(?)??

????????,????,?????????,????????,?,??

(???????????????????????)??????????????????

????????????????????????3?????,????,2023????????????????????????????5??????????2??????????????,?(95.179.XX.XX)?,???,???????????,????????????????,?????“???????”?“?”?“??????????????????????????????”?“?????????????(????+?)”?“?IP?????”?“??????????”?????????????????????????

(??????)?????

????????????????,?????????????????????????????,2023???7?26????,????(65.21.XX.XX)?,???????????????,?,?,??????????????1.03GB????????????,??????“????????”??????“tip4XXXXXXXX.php”?

(?)?????

??,??????,?????????,??????????????????????????????SSH??,?????????,?????????????????????

????????????????????????

(????????????????)?????????????

??????????????????,???????????????????????22????????????????????????8??,??10?????????????????20????,?,??????????????

(???????????)????

2023??5???????????2023?10?????????????,?30??????????????????????,?IP???????????,????

(???????????????????????)?

??????????2??????PIPE?“c:\windows\system32\”?,??.net???????????????,?,????????????KB,????TLS????????????????????????????,????????????https??????,????websocket+SSH???????????,???????????????????????????

?????????????????????IP?

??????:????????