????:1?????????:??????

2?????????????

3???????

4???????

5?????????

???1?17?????????? ??17??????????????,????????

???????????

2024?12????18????,???????CNCERT?(

??????????????????????????

(????????????)?????

2024?8?????????????19?,??????????????,?/?????2024????8???????????????21?????????,??????????????/??????????

(?????????)??????

2024???8???????????21?12????????????????????????,????????????????????,??,????????,?/xxx/xxxx?flag=syn_user_policy??????,???????????????/xxx/xxxStats?

(?)?

2024??11???????????6?????????2024???????11??????????????????????8?????????????2024?11?????????????????????16???,?276???????????????

??????????

(???????????????)?

?????????IP??????????,????????????????,???????????????????,?????,?????

(?)??????????

2024??????????????????????11?????????????6????11???????????16????,???????????????3????????????????????????????IP?????????????????,????????????????????????,??????????????????,???????????????,??,?????????????????????4.98GB?

???

(????????????????????????????)???

???????????????????,???22????8?,?????10????????????20????????????????,?,?????

(?????)?????

??????????5?IP????????,?,?????

(?)??????????????????????????

??????,??????????????????,????????

??????????????,?,??

(?)?

???????????,????,???????????????,?276??,??????????,????????????????????????????????????????????

????????????????IP???????????????????????????

??

2024???????????????????12???????????????????18??,?CNCERT?(

?????????????????

(??)??????????????

???????????Exchange?????????????????2??????Exchange?????,?,??????????????????,??

(?)?

??,????????????????2??????????????,????????,???????????????????????????,??????/owa/auth/xxx/xx.aspx??????????/owa/auth/xxx/yy.aspx,??????????????????,??????????????????????,???????

(????????????????)???????30????????????

????????????????????????,?????????????????????,????,???????????????????????????SSH?SMB?30????????????????????????????????????????????????????;???????,?????????????????????????????????,?websocket+SSH????????????????,???????????,????WeChatxxxxxxxx.exe????????2????PIPE???????????????,??

???????????????????????????????

(??????????????????)??????

?????,????????????,?,?????,?,?????????

(?)?

??????????3???????????,???????,2023????5???????????????????2?,?????????????????(95.179.XX.XX)????,???????????,????????,????????,????????????“?????????”?“?”?“??????”?“????(?+?)”?“?IP?????”?“?????????”?????

(?????????????)?

?????????????????????????,?????????????????,2023??????????????7???????????????????????26???????,??(65.21.XX.XX)?,?,??,??????,??????????1.03GB??????,?“???????????”?????????????????“tip4XXXXXXXX.php”?

(???????????)????????

??,??????,????????????,??????????????????????????????????SSH???????????????????????,??????????????,?????????

??????????????????????

(?)?

???????????????????????,??22??????????8?,??????????????????????????????????10???????????????????????????20????,??????????????,???????????????????????????????

(?)?????????????

2023?5???????????????????2023??10???,?????30??,??IP?????,??

(??????????)????????????????????

??????????????2??????PIPE??“c:\windows\system32\”?,???????.net?????????????????????????????????,?,?KB,?TLS?????????????????????????????????,?https??????????????,?websocket+SSH???,????????????????????????

??????????????????????????????????????????IP??????????????

??:?????