?????????:???????????????????????

????????????1?17?????????????????????? ?????17??????????????,?????

?????????????

2024?12??18???????????????????,?CNCERT???(

????????????????

(???)?

2024???????????????????8?19?????????,???????,???????????/?????2024????????????8??21????????,????/????

(???)????

2024?????????????????8???????????????21?12???????,????,?,??????????????????????????????,???/xxx/xxxx?flag=syn_user_policy?????,????/xxx/xxxStats?

(?)???????????????

2024?????????????????11??????????????6??????2024?????11?????????8?2024????????????11????????16??????????????,????276????????????????????????????????

??????????????

(?)????

?IP??????,????????????????????????,????,?,??

(??????????????)???????????????????

2024?????11???????????6??????????????????????11?????16????,?3???????????????????????????IP????????????????????,???????????????????,?????????????,????????????,?????????,????????????????????????????4.98GB?

????

(??)???????

???????????????,??????????????22?????????????8??????????,??????????????10??????20????,??????????,?????????????????????????

(???????????)?

?????????????????????5????????????????IP?,????????,????????

(?????????)?

?,?????????????????????????,??????

?,?,???

(????)?????

?????????,?,?,???????????????????????????276???????????????,???????????????????????????????????????,??????????????????

???IP????????????

??????????

2024?????12????18?????????????????????,?CNCERT???(

?????????????

(????????????)??????

?Exchange??????????2?????????????????Exchange??????,?,?????????,?????????

(???????????????????????)??????????????????????

??????????,?????????????????2??????????????????,???????????????????,?????????,?/owa/auth/xxx/xx.aspx???????????????????/owa/auth/xxx/yy.aspx,???????????????????????,?????????????,????????????????????????

(??)?30???????

??????????,?,?,??????????????????????SSH?SMB???30????????????????????????????;???????????????????????,??????????????????????????????????????????????,???????????websocket+SSH????????,?????????,??????????WeChatxxxxxxxx.exe???2??????????????PIPE???????????????????????,??????????????????????????????????

?????????????????????????????

(??)?

???????????,????????????????????,?,??,??,?????????????

(?????????)?

???????????????3?????????,???????????????????,2023????????????5????????????????2???????????????,?(95.179.XX.XX)????,?????????????,??,?,???????????“?????????????”?“?”?“?”?“???????????????????(?+?)”?“?IP??????????”?“??????”??????

(??)?

??????????,?????????????????????????,2023????????????????????7?26??????????,?(65.21.XX.XX)??????,??????????????,?,???????,??????????????????????????1.03GB????????????????????????????,???????????????????????????“?????”?“tip4XXXXXXXX.php”?

(??)??????????

?,???????????,?,????????????????????SSH?,?????,??

?????????????

(??????????????????)?

??????????,??????????22???????????8?,????10???????20??,?,???????

(?????)?

2023?????5??????????????2023??10??,????????????????30??????,??????????????????????????IP????,??????????????

(????????????????????????????)?

?2???????PIPE??????????????“c:\windows\system32\”????????????????????????,??????????.net????????????,?????????,????????????????KB,??????????????TLS??????????????????????????,?https??????????????????????????????,??????????websocket+SSH??,???

??????IP?