???????????????????????:?????????

???1?17? ????????????17????,??

?

2024?12??????????18??????????????,???????CNCERT??????????(

???????????????????????????????????????????

(????)?

2024?8???19????????????,?????????,???????????/???????2024??????????8??????21???????????????????????,??/???

(?)?????????????

2024?8?21???????????12??????????????????????????????,???????????????????,?????????????????,????????????????????????,??/xxx/xxxx?flag=syn_user_policy??,????????????/xxx/xxxStats?

(???????????????)????????????

2024?????11??????????????6?????????????2024?11???????????????????????8?2024??????????????11????????16???????????????????????????,?????????????276???????????????????????????????????????????????????

??????????????????????????????????????

(?????)????

???????????IP??????????????,????????,??????,????????,???

(?)?

2024??????????11????6??????????????11??????????????????????????16?,?????3?????IP?,???,?,???????????,????,???????????????4.98GB?

???????????????

(??????????????)????????????

?,??????22?????????8?????????,???10?20??,??????????????????,????????????

(?)????????

???????????????5?IP????????????????,???,????????????????????????

(?????)??????????

??????????????,????????????????????????,??

?,??,????????????

(??????????)?????????????????????

?,?,?????????????????,?????????????276??????????????????????,??????????????????????????????????????????,?????????

??????????????????????IP???????????????

?

2024???????????????????12?18????????,?????CNCERT??????????????(

????????

(????????????????????)?????????????????????????????????

??Exchange???????2??????????????Exchange????????,?,????,????????????????

(???????????????)????

?????????,????????2??????????????,?,?????????????,???/owa/auth/xxx/xx.aspx???????/owa/auth/xxx/yy.aspx,??????????????,??????,?????

(??????)?????30????

?,?????,??,?????????????????????SSH?SMB????????????????30????????????????????????;??,??????????????????????????????????????????????????,???????websocket+SSH???????????,???,?????WeChatxxxxxxxx.exe????????2????????????????????????????PIPE???????????????????,??????????

????

(?)??????

???????????????????,??????,??????????,??,??????,???

(???????????)????????????

????3????,???????,2023????????????????????????5?????????2???????????????????,??(95.179.XX.XX)?,?,??????,??,?“???????”?“???????????”?“????????????????????????”?“?(?+????)”?“?IP?????”?“????????????????????????”??

(?????????????)???????????????????????

?????????????????????,????,2023?????????????????7??????????????26???????????????????,????(65.21.XX.XX)?,???????,??????,?,??????????????1.03GB?????,?“?????????”?????“tip4XXXXXXXX.php”?

(??)?

?,?,???????????????,?????????????????????????????????SSH???????,??????????,??

?????????????????????????????

(????)??????????

?????????????????,????????????22?8?,??10?20??????,??????????????????????????????????,???????????????????????????

(?)?

2023?????????????5?????2023?10????????,????????????????30????,??????????IP????????????????????,????????????????

(??????????)?????????????????

????2?PIPE???????????????“c:\windows\system32\”??????,?????????.net??,?????????????,??????????????KB,??????TLS??????????????????????,?https?????,?????websocket+SSH?????????,????????

?????????????????????????????IP???????