?????????:???????????????????????

????:????????:???????

?1????17????? ?17?,?????

?

2024?????????????????12??????18???????????????,????CNCERT?????????????????(

??????????

(??????????????????????)??????????

2024?????????????????8?19??,?,????????????????/??2024??????????????????????8????????21????????????,????/???

(???????????????????????????)?

2024????????????????????????????8?????21??????????12?,??????????????????????????????????????,??,???,???????????/xxx/xxxx?flag=syn_user_policy???????,?/xxx/xxxStats?

(????????????)????????????????

2024????????????????????????11??????????????6??2024?11??????8????2024??11????16??????????????,?276???????????????????????????????????????

?????????????

(??????????????)?

??????IP???,???????????,?,???????,?????

(???????????)?

2024?????????????11???????????6???11????16????????????,?????????3????IP???????????????????,???,????????????????????????,????????????????????????????,???????????,???????????????????4.98GB?

????????

(???????????????????????????)?

???????????????????????,?????22????????????????????8?????,????10?20??????,?????????????,???????

(?????????)?????

?5?IP??????????,????????????????????????????,???????????????????????

(?)?

???????????????,??????????,???????????????

???????????????,???????????????????????????,??

(?)????????

???????,??????????????????,?,??????????????????????276????,???????????????????????????????????????????,?????????????????????????????????????????????????

?????????????????????????????IP???????????

??????????

2024???????????????12?18??????????????,??????????CNCERT??????(

??????????????????

(?????????????)???

?????????????Exchange?????????2?Exchange???????,??????????????????,????,???????????????????????????

(??????)??

?,???????2?,?,????????????????????,??/owa/auth/xxx/xx.aspx????????/owa/auth/xxx/yy.aspx,????????????????????????????????????,???????????????,????????????????????

(?????????????????????????????????)??30???????????????

?,?????,?????????,??????????????????????????????????SSH?SMB???????30????????????????????????;??????????????,?????????????????????????????????????????????,???websocket+SSH???????????????????,?????????????,?WeChatxxxxxxxx.exe????????????????2?PIPE?,??????????

?????????????

(?)?

???????,?????????????????????,??????,?,???,??????????

(??????????)????

?3????,?????????,2023?5?2???????????????????????,?(95.179.XX.XX)?????,?,?,????????????,??????????“?”?“?????????????????????”?“??”?“??????????(???????????+?)”?“??IP??”?“?”???

(???????????????)?

????????,????????????,2023?7??????????????????26??????????????,??(65.21.XX.XX)????????,?????????????,???????????,??????????,?1.03GB???,??????????“?????”??????????????“tip4XXXXXXXX.php”?

(?????)???????????????????

?????????????,??????????????,?,?????????????????????????????????????????????????SSH????????????????,???????????????,?????

????????

(???)?

??????????????,????????????22?????8???????????????????,????10?20???????????,??????????,??

(?)??

2023????????5??2023????10?,??????????????30????????,?????????????????????IP?????????,???????

(?)?????????

????2?????????????????PIPE?????????“c:\windows\system32\”?,??.net????????,??????????,??KB,?????????????TLS????????????????????????????????,??https????????????,?????websocket+SSH??????????,??

????????????????IP??

?????????????:???????????