{"id":222370,"date":"2023-06-19T11:23:47","date_gmt":"2023-06-19T04:23:47","guid":{"rendered":"https:\/\/hoanghamobile.com\/tin-tuc\/?p=222370"},"modified":"2023-06-19T11:23:47","modified_gmt":"2023-06-19T04:23:47","slug":"chien-dich-tan-cong-bang-ma-doc-gay-nguy-hiem-cho-15-trieu-may-tinh-tai-viet-nam","status":"publish","type":"post","link":"https:\/\/hoanghamobile.com\/tin-tuc\/chien-dich-tan-cong-bang-ma-doc-gay-nguy-hiem-cho-15-trieu-may-tinh-tai-viet-nam\/","title":{"rendered":"Chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng b\u1eb1ng m\u00e3 \u0111\u1ed9c g\u00e2y nguy hi\u1ec3m cho 1,5 tri\u1ec7u m\u00e1y t\u00ednh t\u1ea1i Vi\u1ec7t Nam"},"content":{"rendered":"

Elastic Security Labs c\u1ea3nh b\u00e1o, m\u1ed9t chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng b\u1eb1ng m\u00e3 \u0111\u1ed9c c\u00f3 t\u00ean SPECTRALVIPER \u0111ang nh\u1eafm v\u00e0o h\u00e0ng tri\u1ec7u m\u00e1y t\u00ednh ho\u1ea1t \u0111\u1ed9ng t\u1ea1i Vi\u1ec7t Nam.<\/p>\n

SPECTRALVIPER l\u00e2y nhi\u1ec5m v\u00e0o m\u00e1y t\u00ednh th\u00f4ng qua l\u1ed7 h\u1ed5ng SMB<\/strong><\/h2>\n

D\u1eef li\u1ec7u t\u1eeb Elastic cho th\u1ea5y chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng g\u00e2y ra b\u1edfi REF2754. C\u00f3 m\u00e3 tham chi\u1ebfu tr\u00f9ng kh\u1edbp v\u1edbi nh\u00f3m tin t\u1eb7c c\u1ee7a Vi\u1ec7t Nam c\u00f3 t\u00ean APT32. Bi\u1ec7t \u0111\u1ed9i n\u00e0y c\u00f2n \u0111\u01b0\u1ee3c g\u1ecdi l\u00e0 Canvas Cyclone, Cobalt Kitty v\u00e0 OceanLotus.<\/p>\n

\"chien-dich-tan-cong-bang-ma-doc-gay-nguy-hiem-cho-15-trieu-may-tinh-tai-viet-nam-1\"
Chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng g\u00e2y ra b\u1edfi REF2754, c\u00f2n \u0111\u01b0\u1ee3c g\u1ecdi l\u00e0 Canvas Cyclone, Cobalt Kitty v\u00e0 OceanLotus.<\/figcaption><\/figure>\n

\u0110\u1ea1i di\u1ec7n Elastic cho bi\u1ebft SPECTRALVIPER l\u00e0 c\u1eeda h\u1eadu (backdoor) ch\u01b0a t\u1eebng ti\u1ebft l\u1ed9 tr\u00ean ki\u1ebfn tr\u00fac x64. Ch\u00fang d\u00f9ng k\u1ef9 thu\u1eadt x\u00e1o tr\u1ed9n m\u00e3 (obfuscated) v\u1edbi kh\u1ea3 n\u0103ng \u0111\u01b0a d\u1eef li\u1ec7u \u0111\u1ed9c h\u1ea1i v\u00e0o h\u1ec7 th\u1ed1ng. C\u00f4ng c\u1ee5 ProcDump b\u1ecb l\u1ee3i d\u1ee5ng \u0111\u1ec3 \u0111\u01b0a file DLL ch\u1ee9a DONUTLOADER. Lo\u1ea1i n\u00e0y \u0111\u01b0\u1ee3c c\u00e0i \u0111\u1eb7t \u0111\u1ec3 ch\u00e8n SPECTRALVIPER v\u00e0 c\u00e1c m\u00e3 \u0111\u1ed9c kh\u00e1c v\u00e0o h\u1ec7 th\u1ed1ng nh\u01b0 P8LOADER, POWERSEAL.<\/p>\n

P8LOADER \u0111\u01b0\u1ee3c vi\u1ebft b\u1eb1ng ng\u00f4n ng\u1eef C++, c\u00f3 kh\u1ea3 n\u0103ng k\u00edch ho\u1ea1t g\u00f3i d\u1eef li\u1ec7u \u0111\u1ed9c h\u1ea1i t\u1eeb file ho\u1eb7c b\u1ed9 nh\u1edb. C\u00f2n POWERSEAL c\u00f3 th\u1ec3 ch\u1ea1y l\u1ec7nh trong PowerShell m\u00e0 kh\u00f4ng c\u1ea7n s\u1ef1 cho ph\u00e9p c\u1ee7a ng\u01b0\u1eddi d\u00f9ng.<\/p>\n

SPECTRALVIPER duy tr\u00ec k\u1ebft n\u1ed1i v\u1edbi m\u00e1y ch\u1ee7 do tin t\u1eb7c ki\u1ec3m so\u00e1t. Khi nh\u1eadn l\u1ec7nh k\u00edch ho\u1ea1t, m\u00e3 \u0111\u1ed9c n\u00e0y c\u00f3 th\u1ec3 \u0111e d\u1ecda \u0111a chi\u1ec1u \u0111\u1ebfn m\u00e1y ch\u1ee7 v\u00e0 m\u00e1y kh\u00e1ch. Nh\u01b0 ti\u1ebfp c\u1eadn \u0111\u1ec3 ch\u00e8n d\u1eef li\u1ec7u \u0111\u1ed9c h\u1ea1i, truy c\u1eadp t\u00e0i nguy\u00ean nh\u1ea1y c\u1ea3m, ch\u1ec9nh s\u1eeda t\u1ec7p v\u00e0 th\u01b0 m\u1ee5c tr\u00ean h\u1ec7 th\u1ed1ng.<\/p>\n

\"chien-dich-tan-cong-bang-ma-doc-gay-nguy-hiem-cho-15-trieu-may-tinh-tai-viet-nam-2\"
S\u01a1 \u0111\u1ed3 th\u1ef1c thi m\u00e3 \u0111\u1ed9c SPECTRALVIPER c\u1ee7a tin t\u1eb7c.<\/figcaption><\/figure>\n

SPECTRALVIPER l\u00e2y nhi\u1ec5m v\u00e0o m\u00e1y t\u00ednh th\u00f4ng qua l\u1ed7 h\u1ed5ng SMB. C\u00f3 1\/10 m\u00e1y t\u00ednh t\u1ea1i Vi\u1ec7t Nam t\u1ed3n t\u1ea1i l\u1ed7 h\u1ed5ng SMB v\u00e0 nguy c\u01a1 b\u1ecb nhi\u1ec5m SPECTRALVIPER. L\u1ed7 h\u1ed5ng SMB t\u1eebng b\u1ecb virus WannaCry khai th\u00e1c \u0111\u1ec3 l\u00e2y nhi\u1ec5m h\u01a1n 300.000 m\u00e1y t\u00ednh tr\u00ean th\u1ebf gi\u1edbi trong v\u00e0i gi\u1edd. C\u00f3 735.000 m\u00e1y t\u00ednh t\u1ea1i Vi\u1ec7t Nam b\u1ecb m\u00e3 \u0111\u1ed9c \u0111\u00e0o ti\u1ec1n m\u00e3 h\u00f3a W32.CoinMiner t\u1ea5n c\u00f4ng b\u1eb1ng SMB trong n\u0103m 2018.<\/p>\n

L\u00e0m sao \u0111\u1ec3 tr\u00e1nh \u0111\u01b0\u1ee3c thi\u1ec7t h\u1ea1i l\u00ean m\u1ee9c t\u1ed1i \u0111a<\/strong><\/h2>\n

Ng\u01b0\u1eddi d\u00f9ng \u0111\u01b0\u1ee3c khuy\u1ebfn c\u00e1o c\u1eadp nh\u1eadt c\u00e1c b\u1ea3n v\u00e1 b\u1ea3o m\u1eadt cho m\u00e1y t\u00ednh c\u00e0ng s\u1edbm c\u00e0ng t\u1ed1t. B\u00ean c\u1ea1nh \u0111\u00f3 l\u00e0 vi\u1ec7c sao l\u01b0u d\u1eef li\u1ec7u quan tr\u1ecdng \u0111\u1ec3 ph\u00f2ng tr\u00e1nh thi\u1ec7t h\u1ea1i. Trong c\u00e1c t\u1ed5 ch\u1ee9c v\u00e0 doanh nghi\u1ec7p c\u1ea7n tri\u1ec3n khai c\u00e1c gi\u1ea3i ph\u00e1p an ninh m\u1ea1ng. Nh\u01b0 t\u01b0\u1eddng l\u1eeda, trung t\u00e2m gi\u00e1m s\u00e1t (SOC) \u0111\u1ec3 k\u1ecbp th\u1eddi ph\u00e1t hi\u1ec7n b\u1ea5t th\u01b0\u1eddng v\u00e0 \u1ee9ng c\u1ee9u nhanh ch\u00f3ng.<\/p>\n

Ngo\u00e0i ra, c\u1ea7n li\u00ean h\u1ec7 c\u00e1c \u0111\u01a1n v\u1ecb chuy\u00ean v\u1ec1 an ninh m\u1ea1ng \u0111\u1ec3 \u0111\u01b0\u1ee3c h\u1ed7 tr\u1ee3 r\u00e0 so\u00e1t to\u00e0n b\u1ed9 h\u1ec7 th\u1ed1ng. C\u1ea7n ch\u00fa \u00fd \u0111\u1ebfn m\u00e1y ch\u1ee7, m\u00e1y tr\u1ea1m v\u00e0 n\u1ec1n t\u1ea3ng \u0111\u00e1m m\u00e2y nh\u1eb1m lo\u1ea1i b\u1ecf tri\u1ec7t \u0111\u1ec3 m\u00e3 \u0111\u1ed9c.<\/p>\n

T\u1ea1m k\u1ebft<\/b><\/h2>\n

H\u00e3y theo d\u00f5i trang tin t\u1ee9c\u00a0Ho\u00e0ng H\u00e0 Mobile<\/b><\/a>\u00a0\u0111\u1ec3 c\u1eadp nh\u1eadt nh\u1eefng th\u00f4ng tin c\u00f4ng ngh\u1ec7 m\u1edbi nh\u1ea5t nh\u00e9. V\u00e0 \u0111\u1eebng qu\u00ean truy c\u1eadp k\u00eanh YouTube\u00a0Ho\u00e0ng H\u00e0 Channel<\/b><\/a>\u00a0\u0111\u1ec3 c\u1eadp nh\u1eadt nhi\u1ec1u h\u01a1n nh\u1eefng tin t\u1ee9c c\u00f4ng ngh\u1ec7 n\u00f3ng h\u1ed5i.<\/p>\n

Xem th\u00eam:<\/strong><\/em> \u0110\u1eadp h\u1ed9p Tecno Camon 20 & Tecno Camon 20 Premier 5G c\u1ef1c HOT<\/p>\n