?????????:???????????????????????

????????????????????1?????17? ????????17??????????,?????

?????????

2024?12?????????????18??????????????????????????????,?CNCERT???????(

??????????????????????????

(?????????)?

2024???????????????????????8??????19????,?????????????????,??/??2024??8????21??????????,?/???????

(???????????????????)?

2024??8??????21?12???????????????????,????????????,???????????????????????,?????,???????????????????????/xxx/xxxx?flag=syn_user_policy??????????????????,??????????????/xxx/xxxStats?

(?????????????)?????????????????

2024??11??????????????6??2024????????????????11?8??2024????????11?16?????,??????????276???????????????????????????

?????????????????

(?)????

?IP????,??????????????????????,????????????????,?,???????????

(???????)????

2024???????????????????????????11????6????????????11?????16?,???????????3???IP?,?????,?,??????????????????????????????????,??????,??????????????????4.98GB?

???????????????????

(?)??????????????

?,?22?8???????,?????????10?20?????,??????????????????????????????????,?????

(????)????????

????5????????????????????????IP???????,??????????????????????????,??????????????

(??????????????)???????

??????,??????????????????,??????

??????????????,???????????????,???

(?)????

?,???,??????????,?????????????276?,??????,???????????????????

???????????IP?????????

??????????????

2024???????????????12?????18?,???CNCERT??????????(

???????????????????????

(????????????)???????????

??????????????Exchange??????????2?????Exchange??????,?????????,??????????????????????,??

(?)???????????????????????????

???????,??????????2???????????,???????,?????????????????????????,??????????????????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,??????????????????????????????,??????????????,????????????????????

(??????????????????)???????????????????30???????????????????

?,???????????????,??,????SSH?SMB?????????????30???????;??,???????????????????????????????????????????????????????????????????????????????????????,????????websocket+SSH?,????????,?????????????WeChatxxxxxxxx.exe???????????????2????PIPE?????,??????????????

????????????????

(???????????????)????????

?,????????????????,?????????,?,?????,?????

(??)???????

??3??????????,???,2023????5?2?????,???????????????(95.179.XX.XX)??,??????????????????,????,???????????????,?????????“????????????”?“?”?“?????”?“???(????????????+??????????)”?“?IP??????”?“?”???????????

(?)?

????????????????????????????????????????,??????????????????,2023??????7???????????????????????????26?????????????????????,?(65.21.XX.XX)????????,??,??,?,??????1.03GB????????,??????????“???????????”???????????????????“tip4XXXXXXXX.php”?

(?)????????????????????????????

?????????,?????????????????????????????????,??,?????????????????????????SSH??????????????,?,??????

??????????????????????????

(????????????????????????)?

??,??????22?8????????????,?10??20????,???????????????,?????

(?)??????????????????????????

2023????5????????????????????????2023???????10???????????,?????????30???????????????????,?IP????????????,??

(???????????????)??????????????

?2?PIPE?“c:\windows\system32\”??????,???????????????????????????.net?,??????????????,???KB,??TLS?????????????????????????????????????,??https????????????,??websocket+SSH????????????????????,??

???IP??

????:??