????:1?????????:?????

2????95?98?

3?????????

4???98?????

5?????????

?1?17???? ?????17?,???????????????

??????????

2024??????????12??????????????????????????????????18????,????????CNCERT?????(

???

(??????)??

2024?8?19??????????,????,???????????????????????????/???????????2024?8?????21????????,?/????????????????????????

(???????)???????????????????????????

2024???????????????????????8??????????????21??????????12??????,????????,??,????????????????????????????????????????,?/xxx/xxxx?flag=syn_user_policy??????????,????/xxx/xxxStats?

(?)?

2024?11???????????6??2024?????11??8??????2024??????????????????????11??????????????16?,???276????????????????????????????????????????????????????????

???????????

(?)?

????IP?????????,?????????,?,??,????

(??????)???????????

2024????????????11???6???????11????16?,???3???????????????????????IP?,???,????????????????????????????,????????,????????,???????????????????????????????????4.98GB?

?????????

(?)??

?,????22???????8????,?10???????????????20?,???,??????

(???????????)???????

??????????????????????????5???IP???????????,?,??????

(?????????????????????????????????)????????????????????????????

???????????????????,????,???????????????

?,??????????????????????????????,????????????????????????????

(????????)???????????????????

?????,???????????,????????????????????????,?????????????276?????????????????,????,????

????IP????????

????????????????????????

2024????12??????????????????????18????????????????????,?CNCERT??(

???

(???????)??????????

????????????????Exchange??????????????????????2?????????????????Exchange?,??,????,??????

(??????????????)?

?,???2?,?????????,???????????????????????????????,???????????????????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,??????????????????????????????????????????????,??????????,???????????????

(??????????)??????????30????

?,?,??,????????????SSH?SMB?????????30??????????????????????????;?,???????????????????????????????????????????????????????????????????????????????????????,?????????????websocket+SSH?,???????,????????????WeChatxxxxxxxx.exe??2?????????????????PIPE?????????????,?????????

???????????????????

(???????????????)??????????????????

?,????????????????,???????????,????????,????,??

(?)?

??????????????????3??????,???????????????,2023??5???????????????2???????????????????,???????????????????(95.179.XX.XX)??????,?,???????????????,???????,????“??????????????”?“??????????”?“????????????????”?“????????????(???????????+????????)”?“????IP?”?“???????”???

(?)?

?????????????????????,????????????????,2023?7?????26?,??????(65.21.XX.XX)??????,???,????,?,?????????1.03GB??,??????????“???????????????”??“tip4XXXXXXXX.php”?

(????????????????)??????

?????????????,????,??????????,?????????????????????????SSH???????????????????????,????????????????,???????????

????????

(???????)?

??????????????,??22?????????8???????????,?????10??????????????20?????,??????????????????????????,??

(?)????

2023????5?2023?10?,???????30?,???????????????????????????IP????????,??????????

(?????)???????????????????

??2??PIPE??????“c:\windows\system32\”?,?.net????,??????????????,???????????KB,?????????TLS????????????????????????????????????????????????,??????????????????https?????????????,????????????websocket+SSH????,??

??????????????????????????IP??????????????

????????????????:???????