???????????????????????:?????????

??

???????????????????????1??????????17?????????? ?????????17??????,???????????????

?????

2024?12???18??,????????????????????CNCERT?(

????????????????????

(??????????)???????????????

2024?8???????????????????19??????,??????????????,??????/???????????????2024??8??21?????????????????????,??????????????????????/?????

(??????)?

2024????????????8?21???12??????????????????????????????,????,?,????????????????????????????????,??????????????????/xxx/xxxx?flag=syn_user_policy???????,?/xxx/xxxStats?

(?????)????????

2024????11??6???????????2024????????????????????11?8???????????????2024?11???????????????16????????????????????????????,?276??????????????????????

?????

(??)?

?????????????IP???????,?,??,?,????

(????????????????)????????????

2024??11??6??????11????????????????????????????16????,?3?????IP?,??????????????,?,???????????????????????????????????,?,?????????????????????????????????4.98GB?

????????????????????

(?????????????????)?

???,??????????????????22?8????????????????????????,?10????20???,???,?????

(???????????)???????????????????????

?????????????5???????????????IP???,???????????????????????,??

(?)?

??????????????,??????????????,????????????????????????????

?,????????????,?????

(?)???????

???????????????,??????????????,????????,?276?,????,???????????

??????IP????

??????????????

2024??12???????18????????????,?CNCERT?????????????????????(

????????????????

(?)??????

???????Exchange???????2???????????????Exchange?????????????,???????????????????,????,?????

(?????)???????????

???????????????????????????,?2????????,?????????,???????????????,?/owa/auth/xxx/xx.aspx??????????????/owa/auth/xxx/yy.aspx,?????????????????????????????,???????????????????,??

(???)??????????????30?????

?,?????????????,????,?SSH?SMB?30?????????????????????;????????????????,???????????????????????????????????????,????websocket+SSH????????,??????????????????????????????????????????,??????????????WeChatxxxxxxxx.exe??2??????PIPE???????????????????????????,???????????

????????????????????

(?????)???????????????

??????,????????????????,???????????,??????????,??????????,??

(??????????????????????????????????)???????

??????????3??,?????????????????????????????,2023??????????5?2???????,?(95.179.XX.XX)?,?,?????????,?,?“???????????”?“???????????”?“?”?“????(????+?)”?“?????????????IP?????????????????????????????????”?“?????”??

(?)???????????????????????

????????????????????????????????????,???,2023????7?????????????26????????????????????????,??????(65.21.XX.XX)??????????????????????,?????,?,??????,????????????1.03GB??????,?“?”???????“tip4XXXXXXXX.php”?

(???????????)????????????????

?,?????????????????,???????????,??????????????????SSH?,?,???????????

???????????????????????

(??)????????????????

????????,?22???????????8???,????10???????????20?,?????????,?????????

(?????????)???????

2023?????????????????5??????????????2023???????????10???????????????,?????????30??????,????IP??????????????????????,????????????????????????

(??????????????????)?????

???????????????????2?????????????????PIPE??????“c:\windows\system32\”????????????????,????????????.net?,?,???????????????KB,????TLS??????????????????????,??https??????,?websocket+SSH?????,????????

???IP?????????????

?????????:????????????????????

?????????

????????????????????????????:??????????????

????????