?????????:???????????????????????

????1???????????????17?????????? ??????????????????????17?????????????????????,??

??????????

2024?12?????????18????,?CNCERT?(

????????????????????

(??)???????????????????????

2024?????????????????8??????19?,?,????/????????2024????????????????????????8??????????????21??,??????/???????????????????

(?)??????

2024????8????21?????????12??????????,?????????,????????,?????????????????????????????,?????????????????/xxx/xxxx?flag=syn_user_policy??????,?/xxx/xxxStats?

(??????)??

2024???????11??????????????????6??2024????11????????????????8???????????2024??11???????????16???????????????,?276??????????????????

?????????????????

(???????????????????)?

????IP?,??????,?,???,???????????????

(?????????)???????

2024??????????????????11?6?11????????????16?,??????????????3?IP????????????????????????,??????????????????????????????????,???????????,????????????????????????,????,???????????????????????????????????????????????4.98GB?

??????????????????

(?)???

???????????????????????????,???????????22??????8??????????,?10???????????????20??????????,??????????????,??????

(??????????????)????????????????

?????5?IP????????,???????????,????

(??)???????

?????,???,???????

?,?,????????????????????

(????????????????)???

??,?,????,?276?,?????????????????????????????????,??????????????

?????????????????????????IP???????????????????

???????

2024?12?18?,??????CNCERT??????????????????????????(

??????????????????????

(????????????)?

??????????????Exchange???????????2?Exchange???????,?,?,?????

(????????????????????????????)?????????????

?,?2???????????????????????,????????????????????????,????,?????????????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,??????????????,????????????,????????????????????????????

(?????)?????????????30?????????????

??????????,???????????????,???????????????,????????????????????????????SSH?SMB?????????30?????????????????????????;???????????,????????????????????????????????????????,???????????????????????????websocket+SSH???????????????????,???,?WeChatxxxxxxxx.exe??????????????2?PIPE????,???????????

?????

(?)?????

?????????,?????????????,???,??????????????????????????,?,????????????????

(??????)??????????

??????????????3????????????,????,2023????5?2??????????????????????,?????(95.179.XX.XX)???????,????,??????????????????????????????,????,????????????“????”?“????????????”?“???????????????????”?“???????????(?+????????????????????)”?“?IP???????????????????????”?“???????????”??????????

(??)??

???????,?????????????????????????????,2023?????????7?26???????????????????????,??????????(65.21.XX.XX)??????????????,?????,??????????,???????????????,???????1.03GB????,?????????????“??????”?????????????“tip4XXXXXXXX.php”?

(?)???????????

??????????????????????,???????????,????,?????????????????????SSH??????????????,?,??

????

(?)?

??????,?22????8??????????,????????10?20?,???????,??

(??)?

2023?????????????5??2023??10??????,?????????????????????????????????30?????,????????????????IP????????,???????

(?)?????

????2???????????PIPE??????????????“c:\windows\system32\”??????????,????????.net???,??,????????KB,??????????????TLS???????????????????????????????????,???????????????https????,????websocket+SSH???????????????????,?????????????

???????IP??