?????????????1?17????? ?17???????????????,??

?????????

2024???????????????????????????12???????????????18?,??????????????????????????CNCERT?(

?????????????????

(??????)?

2024??????8?19???,??,????/???????2024?????????????????????8????21????,????????????????????????/?????

(???)?

2024??????????????8?????????21???????????????????????????12??,???????????????,?,????????????????????????,??????/xxx/xxxx?flag=syn_user_policy??????,??????????????/xxx/xxxStats?

(?????????????????)?????????

2024???????????11?6????????2024?11??8?2024?11????????????????????????16???????????????????????,??276?????????????????

?????????????????

(?)???????????????????

?????????????????????????????????IP????????????,????,??????,??????????,??????????????????

(?????????)???????????????

2024???11?6???????????????11?16?,?3????IP???,????????????????,???????????????????,???????,?????????????,??????4.98GB?

?????????????????????????????

(??????????????)??????????

?,???22???????????????????????8?,?10??????????????20??,???????????????????,??

(?)??????????

??????????????????5??????????????IP????????????,???,????????????

(???)??????

???,????????????????????????????????????,?????

????????????,?,???????

(?)??

???????????????????,??????????,?,????????????276??????????????,?????????,?????????????

??????????????????IP????

???????????????????????

2024??12???????????????18?????,??????CNCERT???????????????(

????????????????????????????????

(????????)?

??Exchange????????????????????2?Exchange?,????????,?,????????????

(?????????????)??????????????

??,???????2????,??????????,????????????????????????,?/owa/auth/xxx/xx.aspx????????????????/owa/auth/xxx/yy.aspx,??????????????????????????????????????????,???????????????,??????

(?)?30??

???????????,?,??????????????????,?SSH?SMB??????30??????????????????????????;????,????????????????????????????????????????????????????????,??????????????websocket+SSH??????????,????,???????????????????????WeChatxxxxxxxx.exe?????????????2??PIPE?????????????,????????????????????

???????????????

(??)????????????????????????????

????????????????,????????????,?????????,???????,???????????,????????????????????????????

(????????)?????

???????????3?,??????????,2023?????5?????????????????2?,?(95.179.XX.XX)????????,???,??????????????????????????,???????????????????,??????????“???????”?“????”?“???”?“???????????(??????????????+?????)”?“?IP????????????????????”?“?”?????

(??????????)?

??????????????????????????????????????????,???,2023?????7???????????26?????????????????????,??????????(65.21.XX.XX)????,???????????,?????????????,???????????,????????????????1.03GB????????????????,?????????“?”??????????????“tip4XXXXXXXX.php”?

(??????)????????

??????,???????,??????????????,?????????????????????SSH?,??????????,??

??????????

(?????)????

?,?????????22???????8????????????????????????,???????????10?????????20?????????,??,??

(????????????)????

2023??5???????????????????2023??????????10???????????????????????????,????30??,????IP????,??????????????

(?)?

??????2??????????????????PIPE?“c:\windows\system32\”???,?.net????????????????????,??????????????????????,?????KB,?????????????TLS?????????????????????,????https??????,???????????????????????websocket+SSH?,??????

????IP????

?????:??????????????

??

??:???????????,??????????,??????????????