????????????????1?????????????17? ???????????????????17???????????????,??

???????????

2024?12?????18??,?????????????CNCERT???????????????(

?????????????

(?)?????????

2024??????????8??????????????19???????????????????????,?,???????????/?????????????????2024???????????????8??????21????,????/????

(?)?????

2024??????????????????????8????????????21?????????12???,???????????????????????,?????????????????,????????????????????,????/xxx/xxxx?flag=syn_user_policy???????????????,??/xxx/xxxStats?

(?????)?

2024??????????????????????11?6??2024?11?????????????????8?2024????????????????11?????16????????????????????,??276???????????????????????

??????????????????????

(?)???????????????

?IP?,?????????????????,??????????,????????????????????????,?????????

(???????????????)???????

2024??11??????????????6??????11???????16?,????3?IP??,???????????,????????,???????,??????????????????????????,?????????????????????4.98GB?

?????

(??????????????)????????

?,?22?8??????????,??10??????????????20??????????????,?,????????

(???????????)??????????

???5?IP????,????????????,???????????

(?)???????????????????

?,????????????????,????

??????????????,???????????????????,????

(?)?

???????????????????,??????,?????????,?????????????????????????????????276?????????????,????????????????????,?????????

???????????IP????

??????????

2024????????????????12????18?,?CNCERT?(

?????????????

(???????????????????????)?????

??????Exchange????????????????????????2??????????????????????????????????Exchange????????,?,?,?????

(????)??????

???????????????????,?????2?,??????????????,?????????????????????????,???????/owa/auth/xxx/xx.aspx?????????????/owa/auth/xxx/yy.aspx,???????,?,??

(??????????)??30??????

???,?,?,?SSH?SMB?????????????30?????????????????????????????????????????;?,?????????????????????????????????????????????????????????????????????????????????????????????,??????websocket+SSH???????????????????????????,???,???????????????WeChatxxxxxxxx.exe???????????????????2??????????PIPE????,????????

??????

(???????????????????)???????????

?,??????????,?????,?,??,?????????????????????????

(????)?????

???????????3???????????????,?????????????,2023???????????????5??2???,??????(95.179.XX.XX)????????????,?,???????????????,?,?????????????“???????”?“??????”?“?”?“?(????????????????????????+??)”?“????IP?????????????????”?“?”??????

(??????????????????????)???????????????

??????,?????????????????????????,2023?7?????26?????????,?(65.21.XX.XX)????,??????,????????????,??????????????????,???????????????????1.03GB????????????,?“?????????”??“tip4XXXXXXXX.php”?

(?)????????????

????????,?,????????????????????????????,?????????????????????????????SSH?????,?????????,??

???????????

(?)????????????

???,??????????????22??8?????,????10????20??????????????,?,??????

(????)??????

2023?????????5?2023?????????10????????,?30??,??IP??????????????????,????????????????????????

(?????????)??????

???????????2????PIPE?????????????????????“c:\windows\system32\”????????,?.net????,???????,??????????????????????????????KB,??????????????????????TLS????????????????????????????????,?????????????https???????????????????????????,??????????websocket+SSH??????????????,?????????????????????????????

??????????????????????IP?

??????:??????????????

??

??:???????????,??????????,??????????????