?????????:???????????????????????

???????????????????????1?????????????????????????????????17??????????????? ?17???????????????????????,?????????????????????????

??

2024???????????????????????????12?18??,????CNCERT?(

???????????????????

(????????????????)?????

2024???????????????????8?19????,???????,??????????/???????????????????????2024???????????8?????????21?????????????,??/??

(????)????????

2024?????????8???????????????????21??12??????????????????????,????????????????????,????,?????????????????????????????????,??????????/xxx/xxxx?flag=syn_user_policy????????????????????,???????/xxx/xxxStats?

(?????????????)?

2024???????11?6??????2024??11??????8????2024???????????????11?????16???????,?276?????????????????????????????????????

??????????????????

(?)?????????

?IP?????,??????????????????????????,?????,??,????????????????????????????

(???????????)????????????

2024?11??????????????6?11??????????16??,????????????????3?????IP??????????????,???,???????????,???,??????????,????????????????????????4.98GB?

???????????????????

(???????????????????????????)??

???????????,???????????????????????22??????????????8?????????????????,?10????20???,??????,??

(?)???????????

??????????5?IP?????????????,?,??

(?????????????????)????????

??????????????,???????????,?????????????

?,????????????????????,?????????

(??????????????)?

??????????????????,?????,???????????????????,??????276?,?????????????????,???????????????????

????IP?

?

2024????12?18????,???????CNCERT??????????(

????????????????????

(?)?

?Exchange???????????????????2??????Exchange????,???????????????,???????????????,??

(???????????????????)?

???????,??2???,??????????,??????????,?/owa/auth/xxx/xx.aspx?????????/owa/auth/xxx/yy.aspx,?????????????????????????????????,?????,??

(???????????)????30?????

?,????,?????????????,??????????????SSH?SMB??????30????????????????????????????????????????????;???????????,????????????????????????????????????,?websocket+SSH??????????,???????????????????????????????,?WeChatxxxxxxxx.exe???????????????2????PIPE??????????????????????,??????????

??????????

(?)?

?????????,???????????????????????????????,?????????????,???????,?,??

(??)?????????

??????????????????????3??????????,??????????????????,2023?5????????????????????????2?,??(95.179.XX.XX)????????,????????????,???????????,???,?“??????????????”?“???????”?“??????????”?“??????(?????????+??????)”?“?IP????”?“?”??

(??????)???????????????????

???????????,?????????????????????,2023?????????7?????????????????????26????????????????????,????(65.21.XX.XX)?????,???????????,???????????????????,????,?1.03GB????????????????,??????“?????????”?????????????????????“tip4XXXXXXXX.php”?

(?)??????????????????????????

?,??????????,??????????????,??????????????????????????SSH????????,?,???

????????????????

(?????)???????

??????????????????,?22????????????8???,???????????????????????????10????????????20??????????????,????????????????,?????????

(???????????????????????)???????????????

2023?5?????????????????2023??????10?,????????????????????????30?????,?????IP?????????????,???????

(??????????????????????????????????)????

?2???????????????PIPE???????????????“c:\windows\system32\”????,?.net?,?,??KB,????TLS????????,???????https?,??websocket+SSH???????????,??

?????????????IP???