{"id":1090,"date":"2026-04-24T00:04:09","date_gmt":"2026-04-23T17:04:09","guid":{"rendered":"https:\/\/vncybers.vn\/ba-lo-hong-zero-day-trong-microsoft-defender-dang-bi-khai-thac-tich-cuc\/"},"modified":"2026-04-24T00:04:09","modified_gmt":"2026-04-23T17:04:09","slug":"ba-lo-hong-zero-day-trong-microsoft-defender-dang-bi-khai-thac-tich-cuc","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/ba-lo-hong-zero-day-trong-microsoft-defender-dang-bi-khai-thac-tich-cuc\/","title":{"rendered":"Ba l\u1ed7 h\u1ed5ng zero-day trong Microsoft Defender \u0111ang b\u1ecb khai th\u00e1c t\u00edch c\u1ef1c"},"content":{"rendered":"<figure class=\"wp-block-image size-full\"><img fetchpriority=\"high\" decoding=\"async\" width=\"2528\" height=\"1696\" src=\"https:\/\/vncybers.vn\/wp-content\/uploads\/2026\/04\/microsoft-defender-zero-day-2026.jpg\" alt=\"Ba l\u1ed7 h\u1ed5ng zero-day trong Microsoft Defender \u0111ang b\u1ecb khai th\u00e1c t\u00edch c\u1ef1c\" class=\"wp-image-1089\" srcset=\"https:\/\/vncybers.vn\/wp-content\/uploads\/2026\/04\/microsoft-defender-zero-day-2026.jpg 2528w, https:\/\/vncybers.vn\/wp-content\/uploads\/2026\/04\/microsoft-defender-zero-day-2026-300x201.jpg 300w, https:\/\/vncybers.vn\/wp-content\/uploads\/2026\/04\/microsoft-defender-zero-day-2026-1024x687.jpg 1024w, https:\/\/vncybers.vn\/wp-content\/uploads\/2026\/04\/microsoft-defender-zero-day-2026-768x515.jpg 768w, https:\/\/vncybers.vn\/wp-content\/uploads\/2026\/04\/microsoft-defender-zero-day-2026-1536x1030.jpg 1536w, https:\/\/vncybers.vn\/wp-content\/uploads\/2026\/04\/microsoft-defender-zero-day-2026-2048x1374.jpg 2048w\" sizes=\"(max-width: 2528px) 100vw, 2528px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Ba l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt nghi\u00eam tr\u1ecdng trong Microsoft Defender \u0111ang b\u1ecb khai th\u00e1c t\u00edch c\u1ef1c trong c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng th\u1ef1c t\u1ebf, trong \u0111\u00f3 hai l\u1ed7 h\u1ed5ng v\u1eabn ch\u01b0a c\u00f3 b\u1ea3n v\u00e1. C\u01a1 quan An ninh m\u1ea1ng v\u00e0 C\u01a1 s\u1edf h\u1ea1 t\u1ea7ng Hoa K\u1ef3 (CISA) v\u1eeba ra l\u1ec7nh cho c\u00e1c c\u01a1 quan li\u00ean bang kh\u1ea9n c\u1ea5p v\u00e1 l\u1ed7 h\u1ed5ng \u0111\u00e3 \u0111\u01b0\u1ee3c x\u1eed l\u00fd tr\u01b0\u1edbc ng\u00e0y 7\/5\/2026.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ba l\u1ed7 h\u1ed5ng t\u1eeb m\u1ed9t nh\u00e0 nghi\u00ean c\u1ee9u b\u1ee9c x\u00fac v\u1edbi Microsoft<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ngu\u1ed3n g\u1ed1c c\u1ee7a ba l\u1ed7 h\u1ed5ng n\u00e0y xu\u1ea5t ph\u00e1t t\u1eeb nh\u00e0 nghi\u00ean c\u1ee9u b\u1ea3o m\u1eadt t\u1ef1 g\u1ecdi l\u00e0 &#8220;Chaotic Eclipse&#8221;, ng\u01b0\u1eddi c\u00f4ng b\u1ed1 m\u00e3 khai th\u00e1c (PoC) \u0111\u1ec3 ph\u1ea3n \u0111\u1ed1i c\u00e1ch MSRC (Microsoft Security Response Center) x\u1eed l\u00fd quy tr\u00ecnh ti\u1ebft l\u1ed9 l\u1ed7 h\u1ed5ng. Ba l\u1ed7 h\u1ed5ng \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1 g\u1ed3m:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>BlueHammer (CVE-2026-33825):<\/strong> M\u1ee9c \u0111\u1ed9 nghi\u00eam tr\u1ecdng cao v\u1edbi \u0111i\u1ec3m CVSS 7.8. Cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 \u0111\u1eb7c quy\u1ec1n th\u1ea5p leo thang l\u00ean quy\u1ec1n SYSTEM tr\u00ean thi\u1ebft b\u1ecb ch\u01b0a v\u00e1, l\u1ee3i d\u1ee5ng c\u01a1 ch\u1ebf ki\u1ec3m so\u00e1t truy c\u1eadp kh\u00f4ng \u0111\u1ee7 chi ti\u1ebft. Microsoft \u0111\u00e3 v\u00e1 l\u1ed7 h\u1ed5ng n\u00e0y ng\u00e0y 14\/4 trong b\u1ea3n Patch Tuesday th\u00e1ng 4\/2026.<\/li><li><strong>RedSun:<\/strong> M\u1ed9t l\u1ed7 h\u1ed5ng leo thang \u0111\u1eb7c quy\u1ec1n c\u1ee5c b\u1ed9 (LPE) kh\u00e1c trong Defender, hi\u1ec7n ch\u01b0a c\u00f3 b\u1ea3n v\u00e1 ch\u00ednh th\u1ee9c.<\/li><li><strong>UnDefend:<\/strong> Cho ph\u00e9p ng\u01b0\u1eddi d\u00f9ng th\u00f4ng th\u01b0\u1eddng ch\u1eb7n Defender c\u1eadp nh\u1eadt c\u01a1 s\u1edf d\u1eef li\u1ec7u nh\u1eadn di\u1ec7n m\u00e3 \u0111\u1ed9c, hi\u1ec7n c\u0169ng ch\u01b0a \u0111\u01b0\u1ee3c v\u00e1.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\u0110ang b\u1ecb khai th\u00e1c t\u00edch c\u1ef1c, c\u00f3 d\u1ea5u hi\u1ec7u li\u00ean quan \u0111\u1ebfn Nga<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ng\u00e0y 16\/4, c\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u c\u1ee7a Huntress Labs x\u00e1c nh\u1eadn c\u1ea3 ba l\u1ed7 h\u1ed5ng \u0111ang b\u1ecb khai th\u00e1c trong c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng th\u1ef1c t\u1ebf k\u1ec3 t\u1eeb kho\u1ea3ng ng\u00e0y 10\/4\/2026. \u0110i\u1ec1u \u0111\u00e1ng lo ng\u1ea1i l\u00e0 ho\u1ea1t \u0111\u1ed9ng t\u1ea5n c\u00f4ng cho th\u1ea5y \u0111\u00e2y kh\u00f4ng ph\u1ea3i l\u00e0 vi\u1ec7c ki\u1ec3m th\u1eed PoC \u0111\u01a1n thu\u1ea7n m\u00e0 l\u00e0 m\u1ed9t chi\u1ebfn d\u1ecbch x\u00e2m nh\u1eadp c\u00f3 ch\u1ee7 \u0111\u00edch.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;Ho\u1ea1t \u0111\u1ed9ng n\u00e0y c\u00f3 v\u1ebb l\u00e0 m\u1ed9t ph\u1ea7n c\u1ee7a cu\u1ed9c x\u00e2m nh\u1eadp r\u1ed9ng h\u01a1n, kh\u00f4ng ph\u1ea3i ki\u1ec3m th\u1eed b\u1eb1ng ch\u1ee9ng kh\u00e1i ni\u1ec7m ri\u00eang l\u1ebb,&#8221; Huntress Labs c\u1ea3nh b\u00e1o. C\u00f4ng ty ph\u00e1t hi\u1ec7n quy\u1ec1n truy c\u1eadp FortiGate SSL VPN \u0111\u00e1ng ng\u1edd li\u00ean k\u1ebft v\u1edbi m\u00f4i tr\u01b0\u1eddng b\u1ecb x\u00e2m ph\u1ea1m, trong \u0111\u00f3 c\u00f3 m\u1ed9t \u0111\u1ecba ch\u1ec9 IP \u0111\u01b0\u1ee3c \u0111\u1ecbnh v\u1ecb t\u1ea1i Nga c\u00f9ng c\u00e1c c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng nghi v\u1ea5n kh\u00e1c \u1edf nhi\u1ec1u khu v\u1ef1c kh\u00e1c nhau.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">B\u1ea3n ch\u1ea5t c\u1ee7a l\u1ed7 h\u1ed5ng BlueHammer cho th\u1ea5y m\u1ee9c \u0111\u1ed9 nguy hi\u1ec3m r\u00f5 r\u00e0ng: k\u1ebb t\u1ea5n c\u00f4ng ch\u1ec9 c\u1ea7n c\u00f3 quy\u1ec1n truy c\u1eadp c\u01a1 b\u1ea3n v\u00e0o h\u1ec7 th\u1ed1ng l\u00e0 c\u00f3 th\u1ec3 chi\u1ebfm to\u00e0n quy\u1ec1n ki\u1ec3m so\u00e1t \u1edf m\u1ee9c SYSTEM, v\u01b0\u1ee3t qua c\u00e1c r\u00e0o c\u1ea3n b\u1ea3o m\u1eadt c\u1ee7a Windows. K\u1ebft h\u1ee3p v\u1edbi UnDefend, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 v\u00f4 hi\u1ec7u h\u00f3a kh\u1ea3 n\u0103ng c\u1eadp nh\u1eadt c\u1ee7a Defender, khi\u1ebfn h\u1ec7 th\u1ed1ng m\u00f9 qu\u00e1ng tr\u01b0\u1edbc c\u00e1c m\u1ed1i \u0111e d\u1ecda m\u1edbi.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">CISA ra l\u1ec7nh v\u00e1 kh\u1ea9n, hai l\u1ed7 h\u1ed5ng v\u1eabn ch\u01b0a c\u00f3 b\u1ea3n v\u00e1<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ng\u00e0y 22\/4, CISA b\u1ed5 sung CVE-2026-33825 v\u00e0o danh m\u1ee5c L\u1ed7 h\u1ed5ng \u0111\u00e3 bi\u1ebft b\u1ecb khai th\u00e1c (KEV) v\u00e0 y\u00eau c\u1ea7u c\u00e1c c\u01a1 quan thu\u1ed9c nh\u00e1nh h\u00e0nh ph\u00e1p d\u00e2n s\u1ef1 li\u00ean bang (FCEB) v\u00e1 h\u1ec7 th\u1ed1ng Windows tr\u01b0\u1edbc ng\u00e0y 7\/5\/2026.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;Lo\u1ea1i l\u1ed7 h\u1ed5ng n\u00e0y l\u00e0 vector t\u1ea5n c\u00f4ng ph\u1ed5 bi\u1ebfn c\u1ee7a c\u00e1c t\u00e1c nh\u00e2n m\u1ea1ng \u0111\u1ed9c h\u1ea1i v\u00e0 \u0111\u1eb7t ra r\u1ee7i ro \u0111\u00e1ng k\u1ec3 cho h\u1ec7 th\u1ed1ng li\u00ean bang,&#8221; CISA c\u1ea3nh b\u00e1o, \u0111\u1ed3ng th\u1eddi y\u00eau c\u1ea7u c\u00e1c c\u01a1 quan \u00e1p d\u1ee5ng bi\u1ec7n ph\u00e1p gi\u1ea3m thi\u1ec3u theo h\u01b0\u1edbng d\u1eabn c\u1ee7a nh\u00e0 cung c\u1ea5p ho\u1eb7c ng\u1eebng s\u1eed d\u1ee5ng s\u1ea3n ph\u1ea9m n\u1ebfu ch\u01b0a c\u00f3 b\u1ea3n v\u00e1.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Tuy nhi\u00ean, b\u1ea3n v\u00e1 cho CVE-2026-33825 kh\u00f4ng b\u1ea3o v\u1ec7 \u0111\u01b0\u1ee3c b\u1ec1 m\u1eb7t t\u1ea5n c\u00f4ng m\u00e0 RedSun v\u00e0 UnDefend khai th\u00e1c. Hai l\u1ed7 h\u1ed5ng n\u00e0y hi\u1ec7n v\u1eabn ch\u01b0a c\u00f3 b\u1ea3n v\u00e1, \u0111\u1ed3ng ngh\u0129a ngay c\u1ea3 c\u00e1c h\u1ec7 th\u1ed1ng \u0111\u00e3 c\u1eadp nh\u1eadt \u0111\u1ea7y \u0111\u1ee7 Patch Tuesday th\u00e1ng 4\/2026 v\u1eabn c\u00f2n t\u1ed3n t\u1ea1i r\u1ee7i ro.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Khuy\u1ebfn ngh\u1ecb cho ng\u01b0\u1eddi d\u00f9ng v\u00e0 qu\u1ea3n tr\u1ecb vi\u00ean h\u1ec7 th\u1ed1ng<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Trong khi ch\u1edd Microsoft ph\u00e1t h\u00e0nh b\u1ea3n v\u00e1 cho RedSun v\u00e0 UnDefend, c\u00e1c chuy\u00ean gia b\u1ea3o m\u1eadt khuy\u1ebfn ngh\u1ecb:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>C\u1eadp nh\u1eadt ngay Windows th\u00f4ng qua Patch Tuesday th\u00e1ng 4\/2026 \u0111\u1ec3 v\u00e1 CVE-2026-33825 (BlueHammer).<\/li><li>H\u1ea1n ch\u1ebf quy\u1ec1n truy c\u1eadp c\u1ee5c b\u1ed9, kh\u00f4ng c\u1ea5p \u0111\u1eb7c quy\u1ec1n cao h\u01a1n m\u1ee9c c\u1ea7n thi\u1ebft cho ng\u01b0\u1eddi d\u00f9ng.<\/li><li>T\u0103ng c\u01b0\u1eddng gi\u00e1m s\u00e1t c\u00e1c ho\u1ea1t \u0111\u1ed9ng b\u1ea5t th\u01b0\u1eddng li\u00ean quan \u0111\u1ebfn leo thang \u0111\u1eb7c quy\u1ec1n tr\u00ean h\u1ec7 th\u1ed1ng.<\/li><li>Tri\u1ec3n khai c\u00e1c l\u1edbp b\u1ea3o v\u1ec7 b\u1ed5 sung nh\u01b0 EDR, ki\u1ec3m so\u00e1t \u1ee9ng d\u1ee5ng, v\u00e0 ph\u00e2n \u0111o\u1ea1n m\u1ea1ng.<\/li><li>Theo d\u00f5i th\u00f4ng b\u00e1o t\u1eeb Microsoft v\u00e0 CISA \u0111\u1ec3 \u00e1p d\u1ee5ng b\u1ea3n v\u00e1 cho RedSun v\u00e0 UnDefend ngay khi c\u00f3.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>VNCyberS t\u1ed5ng h\u1ee3p t\u1eeb: BleepingComputer, The Hacker News, SecurityWeek, Qualys Blog<\/em><\/p>","protected":false},"excerpt":{"rendered":"<p>Ba l\u1ed7 h\u1ed5ng zero-day trong Microsoft Defender \u0111ang b\u1ecb khai th\u00e1c t\u00edch c\u1ef1c k\u1ec3 t\u1eeb ng\u00e0y 10\/4\/2026. CISA y\u00eau c\u1ea7u c\u00e1c c\u01a1 quan li\u00ean bang v\u00e1 kh\u1ea9n tr\u01b0\u1edbc 7\/5, trong khi hai l\u1ed7 h\u1ed5ng RedSun v\u00e0 UnDefend v\u1eabn ch\u01b0a c\u00f3 b\u1ea3n v\u00e1.<\/p>","protected":false},"author":2,"featured_media":1089,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[37,35,34,98,93],"class_list":["post-1090","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-cisa","tag-cve","tag-lo-hong-bao-mat","tag-microsoft-defender","tag-zero-day"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1090","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1090"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1090\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1089"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1090"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1090"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1090"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}