?????????:???????????????????????

???????????????????????????1??????????????????17???????????? ??????????????17?????????,???????????????????

?

2024?????12??????18??????,???????CNCERT????????????????(

????????

(????????????)?

2024?8?19?,???????????,????/????????????????2024??????8?????????21??????,??????????/????????????????????

(????)????

2024?????????????????????8?????????????21???12??,???????????????????????????,??,????????????,???/xxx/xxxx?flag=syn_user_policy???????,??????????/xxx/xxxStats?

(?????????????????????????????????)?????

2024?11?6????????2024???11?8????????????2024????????11????????????16??????,?276???????????????????????????????????????????

?????????????????

(??)????????????????

??????????IP???????,???????,???????????????,????????????????,?????

(?????????)?

2024???????????11??????????6???11???16??????,?3??????????????IP???????????????,???????????????????????????,?,????????????????????,???????????????????????,????????????????????4.98GB?

????????????????

(???????)???????????

????,???????????22?????8?,?10??????????20????????,?,???????????

(?????????????)?

???????????????????????5???????????IP?,?????????????????,?????????

(?)?????????

???????????,?????????????????,??

?,????????????????,?????????????????????????

(?)????????????????????????????

??????????????,??????,??????????????,?????276????????????,????,?????????????????

????????????IP??

??

2024????????????????????????12?18?,????CNCERT?????(

??????

(?)???????

?Exchange??????????2??????????????Exchange?,????,???????,????????????????

(???????????????????????)???????????

?,??????2???????????????,?????,???????????????????????,??????????/owa/auth/xxx/xx.aspx????????/owa/auth/xxx/yy.aspx,???????????????????,???????????????,???????????

(??)?30?

???,??,??,?SSH?SMB?????????30?????????;?????,???????????????????????????????????????,?websocket+SSH??,????????????????????????,??????????WeChatxxxxxxxx.exe?????2???????????PIPE?,?????

????????

(?????????)??????

??????,??????????????,?,??????????,???????????,????????????

(?)??????????????

?3?,????????????????,2023???????????????????????5?2??????????????????????,?????(95.179.XX.XX)???????,??????,???????????????,?????????????,???????????????????????????“??????????????”?“???????????????”?“?????????????????”?“?(????????+??????????)”?“??????????????IP????????????????”?“?”???????????????????????????

(???????????)??

????????????????????????????,????????????????????????????????????????????????????????,2023?????????7????26????,?(65.21.XX.XX)?????????????????,??????,??,?????????????,??????????1.03GB???????,??????????????????????????????????“??????”???????????????????“tip4XXXXXXXX.php”?

(?)?

??,?????????????,???????????????????,?????????????SSH????,????,??

???

(??????????????????)??

?????????,??????????????22???????????8?,?????????????10???????????????????20?,??????,???????????????????????

(?)??????????????

2023???5?2023???????10??????????????????????????????,????30?????,?????IP????,??

(????????????????????????)?

????????????????????2????PIPE??????????????“c:\windows\system32\”?????????????????????,?????????????????.net?????,????????,????????KB,???????????????????TLS??????????????????????,??https?,????????????websocket+SSH???????????????????,??

???????IP??????????????????????