???????????????????????:?????????

??

????1???????17??? ???????????????????????17???????????,???????????

????????

2024???????12???????????18???????????????????????,???????????????CNCERT?????????????(

??????????????????

(????)??????????????

2024?????8???19??,????,?????????/???????????2024??8????21??????,?/????????????

(?????)??????

2024????8???????????????21?12??????????????????,?????????????????,?,???????????,?????????????????/xxx/xxxx?flag=syn_user_policy??????????????????????,?/xxx/xxxStats?

(???????????)??????

2024????????????11??????6?????2024??11????8?2024?11?16????????????????????????????,?276????????????????????????

????????

(????????????)?

????????????????????????IP??????????????,?????????,??????????????,???????????????????,????????????????????

(??????)??

2024???????11?6?11?16??????????,?3????IP???????????????,????,?,??????????,??,????????????????????????????????????????4.98GB?

??????????????????????

(???????????????????????)?????

?,??????22???????????8???????,????????????10??????????20?,??????,?????????

(???????)?

?????????????5?????????IP???,??????????????,??

(?????????)??????????????

?????????,????????????,??????

?,?????????????????????????????????,????????

(???????????????????????)?

?,?,???????????????????,???????????????????????????276?,??????????????????????????????????????,???????????????????????????????????????????????

??????????????????IP?

??

2024??????12??18???,?CNCERT????????????(

?????????????

(?)????????

?????????????????Exchange?????????2?Exchange?,?,????,????????????????????

(?????????????)?

???????,????????2?????,?,???,?????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,???????????????????????????????????????,????????,?????????????????

(??????)??????????????30????

?????????,??,????????????????,?SSH?SMB?30?????????????????????????????????????????????;??????????,?????????????????????????????????????????????????,????????????websocket+SSH????,?????????????,?????????????WeChatxxxxxxxx.exe??2????????????????????????PIPE?,???

??????????????????????

(???)?????????????

?,??????????????????????????????????????????????????,????,????,???,??

(?????????????)?

???????????????????3??????????????,????????????????????,2023?????5?2?,??(95.179.XX.XX)?????????,??????????????,?????????,??,?????????????????????“????”?“?”?“??????”?“???????????(?+???????????????)”?“?IP??????????????????????????”?“???????????”??

(??????)?

????????????????,???????????,2023?????????????7????26???????????????,??????????(65.21.XX.XX)????????????????????????????,????,?,?????????????????,?1.03GB???????????????????????,?“???”??????????????????“tip4XXXXXXXX.php”?

(??????????)????????????????

????????,???????,??,????????????????????SSH???,?,????????????????

????????????

(?)?

????????,?22????????8???????????????????????????,?????10???????????20??????????????????????????,???????????????,???????????

(??????)????????????

2023?????5????2023??10?,?30????????????,????????????????IP???????????????????,?????????????????????

(????)?

???????????????2??PIPE?????????“c:\windows\system32\”?,???????????????????????????.net?????,?,?????????????????KB,????????????TLS???????????????????????????????????????????,???????????https?,??websocket+SSH??????????,??

?????IP??????????????????????????????????

?????:?????????????????

?????????

????????????????????????????:??????????????

????????