?????????:???????????????????????

????????????????????????1?17????????????? ?17???????????,???????????

??????????????????????

2024??12??????????????18????,???????????CNCERT????(

?????????????????

(?????)???????????????????

2024????8???????????19???????,????????,???????????????????????/??????2024???????????????????8?21?,?/????

(??????????????)??????????

2024??????????????8?21?12?,???????????????????,?????????,??????????,?/xxx/xxxx?flag=syn_user_policy???????????????,???????????????/xxx/xxxStats?

(????)????

2024???11??????????????6????????2024??????????????????11???????????8?2024?????11????????????????????????????16?????????????????,??276????????????????????????

????????????????

(?)????

???????IP?????????????????????,?????????????,???????????????,?,?????????????????????????

(???????????????)?????????

2024?????????????11?6???????????????11?16????????????????,??????3?IP?,?????,????????????,????????,??????????????,????????4.98GB?

????????????

(??????)?

?,?22???????????????8??,?10?20????????,?????????????,????????????????????

(???????????????????????)???????????????

?????????????????5?IP???????????,??,???????????????????

(?????????????????????????????????)??????????????????????????

?????????????,???????,????????????????????

?????????,??????,????????????????

(??????????????)?????

???????????????????,?,????????,???????????????????????????276?,???????????????????????????,????????????????????????????????

?????????????????IP??????????????

??

2024?12??????18???,?CNCERT??????????(

???????????????????

(?????)?

????Exchange???????????????????2????????????????????????Exchange??,?,?????????,????????????????

(??)??????????

???????????????,??????????????2???????????,?,??????,??????/owa/auth/xxx/xx.aspx??????????????/owa/auth/xxx/yy.aspx,?????????????????????????????,??????????,????????????????

(???????????????????)??????????????????????30??????????????????????????????

??????,?????????,??????????,??????????SSH?SMB?30??????????;???????????????????????,?????????????????????????????????????????????,??????websocket+SSH????,??????????????????????,?WeChatxxxxxxxx.exe??2????????????????PIPE???????????????????,?????

???

(?)????

??????????????????????????????????,????????????????????????,????????????????,??,?,?????????

(?)???????????????????????????

???3?????,???????,2023???????5???????????????????????2??,????(95.179.XX.XX)?,???????????????????????????,?,?,?????????“???????????”?“??????”?“?”?“?(????+????)”?“?IP??????????????”?“?”??

(??)????

???????????????????,???????????,2023???7?26?,???(65.21.XX.XX)?????,?,?????????????????,????,?????????????1.03GB??,??????????“??”??“tip4XXXXXXXX.php”?

(???)?

?,?????,?????????????,?????????????????????????SSH??????????,??????????????,???????????

???????????????????

(?)?

??,??????22????8????????????,?????????10????????20??????,?,??????????????????

(?)????????

2023?5????2023?????????????????????10????,??????????30??,??????????IP????????????,????

(????)?????????

?????2?PIPE??????????????????????“c:\windows\system32\”????????????????????,????????????????????.net???????????,??,????KB,???????TLS???????????????????????????????????????,??????https?,??????????????websocket+SSH???????????,??

???????????????IP?????