{"id":1144,"date":"2026-04-25T21:04:11","date_gmt":"2026-04-25T14:04:11","guid":{"rendered":"https:\/\/vncybers.vn\/ho-so-nhom-apt-mustang-panda-bong-ma-dai-dang-de-doa-an-ninh-mang-viet-nam\/"},"modified":"2026-04-25T21:04:11","modified_gmt":"2026-04-25T14:04:11","slug":"ho-so-nhom-apt-mustang-panda-bong-ma-dai-dang-de-doa-an-ninh-mang-viet-nam","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/ho-so-nhom-apt-mustang-panda-bong-ma-dai-dang-de-doa-an-ninh-mang-viet-nam\/","title":{"rendered":"H\u1ed3 s\u01a1 nh\u00f3m APT Mustang Panda: &#8220;B\u00f3ng ma&#8221; dai d\u1eb3ng \u0111e d\u1ecda an ninh m\u1ea1ng Vi\u1ec7t Nam"},"content":{"rendered":"<p>Trong s\u1ed1 c\u00e1c nh\u00f3m t\u1ea5n c\u00f4ng c\u00f3 ch\u1ee7 \u0111\u00edch (APT) ho\u1ea1t \u0111\u1ed9ng m\u1ea1nh m\u1ebd nh\u1ea5t t\u1ea1i khu v\u1ef1c \u0110\u00f4ng Nam \u00c1, Mustang Panda (c\u00f2n \u0111\u01b0\u1ee3c g\u1ecdi l\u00e0 Earth Preta, Bronze President ho\u1eb7c RedDelta) n\u1ed5i l\u00ean nh\u01b0 m\u1ed9t &#8220;b\u00f3ng ma&#8221; dai d\u1eb3ng v\u1edbi c\u00e1c chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng quy m\u00f4 l\u1edbn v\u00e0 tinh vi. Nh\u00f3m n\u00e0y kh\u00f4ng ch\u1ec9 nh\u1eafm v\u00e0o c\u00e1c c\u01a1 quan ch\u00ednh ph\u1ee7 m\u00e0 c\u00f2n m\u1edf r\u1ed9ng m\u1ee5c ti\u00eau sang c\u00e1c doanh nghi\u1ec7p, t\u1ed5 ch\u1ee9c gi\u00e1o d\u1ee5c v\u00e0 t\u00e0i ch\u00ednh t\u1ea1i Vi\u1ec7t Nam.<\/p>\n<h3>Ngu\u1ed3n g\u1ed1c v\u00e0 M\u1ee5c ti\u00eau c\u1ee7a Mustang Panda<\/h3>\n<p>Mustang Panda \u0111\u01b0\u1ee3c ghi nh\u1eadn ho\u1ea1t \u0111\u1ed9ng t\u1eeb kho\u1ea3ng n\u0103m 2012. Nh\u00f3m n\u00e0y th\u01b0\u1eddng xuy\u00ean thay \u0111\u1ed5i ph\u01b0\u01a1ng th\u1ee9c nh\u01b0ng m\u1ee5c ti\u00eau c\u1ed1t l\u00f5i v\u1eabn l\u00e0 thu th\u1eadp th\u00f4ng tin t\u00ecnh b\u00e1o chi\u1ebfn l\u01b0\u1ee3c. C\u00e1c b\u00e1o c\u00e1o t\u1eeb c\u00e1c h\u00e3ng b\u1ea3o m\u1eadt l\u1edbn ch\u1ec9 ra r\u1eb1ng Mustang Panda c\u00f3 kh\u1ea3 n\u0103ng th\u00edch nghi c\u1ef1c nhanh v\u1edbi c\u00e1c bi\u1ec7n ph\u00e1p ph\u00f2ng v\u1ec7 c\u1ee7a m\u1ee5c ti\u00eau.<\/p>\n<p>T\u1ea1i Vi\u1ec7t Nam, nh\u00f3m n\u00e0y th\u01b0\u1eddng nh\u1eafm v\u00e0o c\u00e1c l\u0129nh v\u1ef1c nh\u1ea1y c\u1ea3m nh\u01b0 ngo\u1ea1i giao, gi\u00e1o d\u1ee5c v\u00e0 g\u1ea7n \u0111\u00e2y l\u00e0 h\u1ec7 th\u1ed1ng qu\u1ea3n l\u00fd thu\u1ebf. M\u1ee5c \u0111\u00edch ch\u00ednh kh\u00f4ng ch\u1ec9 l\u00e0 \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u m\u00e0 c\u00f2n nh\u1eb1m duy tr\u00ec s\u1ef1 hi\u1ec7n di\u1ec7n l\u00e2u d\u00e0i trong h\u1ec7 th\u1ed1ng \u0111\u1ec3 theo d\u00f5i c\u00e1c ho\u1ea1t \u0111\u1ed9ng quan tr\u1ecdng.<\/p>\n<h3>Ph\u01b0\u01a1ng th\u1ee9c t\u1ea5n c\u00f4ng \u0111\u1eb7c tr\u01b0ng<\/h3>\n<p>S\u1ef1 tinh vi c\u1ee7a Mustang Panda n\u1eb1m \u1edf c\u00e1ch h\u1ecd k\u1ebft h\u1ee3p gi\u1eefa k\u1ef9 thu\u1eadt x\u00e3 h\u1ed9i (Social Engineering) v\u00e0 c\u00e1c c\u00f4ng c\u1ee5 m\u00e3 \u0111\u1ed9c hi\u1ec7n \u0111\u1ea1i:<\/p>\n<ul>\n<li><strong>Email l\u1eeba \u0111\u1ea3o (Spear-phishing):<\/strong> Nh\u00f3m s\u1eed d\u1ee5ng c\u00e1c email c\u00f3 ti\u00eau \u0111\u1ec1 li\u00ean quan \u0111\u1ebfn c\u00e1c s\u1ef1 ki\u1ec7n ch\u00ednh tr\u1ecb, kinh t\u1ebf ho\u1eb7c th\u00f4ng b\u00e1o ch\u00ednh th\u1ee9c \u0111\u1ec3 l\u1eeba ng\u01b0\u1eddi d\u00f9ng t\u1ea3i v\u1ec1 c\u00e1c t\u1ec7p tin \u0111\u00ednh k\u00e8m ch\u1ee9a m\u00e3 \u0111\u1ed9c.<\/li>\n<li><strong>K\u1ef9 thu\u1eadt DLL Side-loading:<\/strong> \u0110\u00e2y l\u00e0 k\u1ef9 thu\u1eadt &#8220;m\u01b0\u1ee3n danh&#8221; c\u00e1c ph\u1ea7n m\u1ec1m h\u1ee3p ph\u00e1p \u0111\u1ec3 th\u1ef1c thi m\u00e3 \u0111\u1ed9c, gi\u00fap ch\u00fang v\u01b0\u1ee3t qua \u0111\u01b0\u1ee3c c\u00e1c gi\u1ea3i ph\u00e1p antivirus truy\u1ec1n th\u1ed1ng.<\/li>\n<li><strong>M\u00e3 \u0111\u1ed9c t\u00f9y ch\u1ec9nh:<\/strong> Mustang Panda n\u1ed5i ti\u1ebfng v\u1edbi vi\u1ec7c s\u1eed d\u1ee5ng c\u00e1c bi\u1ebfn th\u1ec3 c\u1ee7a PlugX, Cobalt Strike v\u00e0 c\u00e1c c\u00f4ng c\u1ee5 \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf ri\u00eang nh\u01b0 PubLoad ho\u1eb7c MQsSrv \u0111\u1ec3 \u0111i\u1ec1u khi\u1ec3n m\u00e1y t\u00ednh n\u1ea1n nh\u00e2n t\u1eeb xa.<\/li>\n<\/ul>\n<h3>C\u00e1c chi\u1ebfn d\u1ecbch g\u1ea7n \u0111\u00e2y t\u1ea1i Vi\u1ec7t Nam<\/h3>\n<p>Trong giai \u0111o\u1ea1n 2024-2025, C\u1ee5c An to\u00e0n th\u00f4ng tin v\u00e0 c\u00e1c trung t\u00e2m gi\u00e1m s\u00e1t an ninh m\u1ea1ng \u0111\u00e3 li\u00ean t\u1ee5c ph\u00e1t \u0111i c\u1ea3nh b\u00e1o v\u1ec1 c\u00e1c chi\u1ebfn d\u1ecbch c\u1ee7a Mustang Panda. M\u1ed9t \u0111i\u1ec3m \u0111\u00e1ng ch\u00fa \u00fd l\u00e0 nh\u00f3m n\u00e0y \u0111\u00e3 b\u1eaft \u0111\u1ea7u s\u1eed d\u1ee5ng c\u00e1c d\u1ecbch v\u1ee5 l\u01b0u tr\u1eef \u0111\u00e1m m\u00e2y ph\u1ed5 bi\u1ebfn nh\u01b0 Google Drive ho\u1eb7c Dropbox \u0111\u1ec3 l\u01b0u tr\u1eef m\u00e3 \u0111\u1ed9c, khi\u1ebfn vi\u1ec7c ng\u0103n ch\u1eb7n b\u1eb1ng t\u01b0\u1eddng l\u1eeda tr\u1edf n\u00ean kh\u00f3 kh\u0103n h\u01a1n do c\u00e1c t\u00ean mi\u1ec1n n\u00e0y th\u01b0\u1eddng n\u1eb1m trong danh s\u00e1ch tin c\u1eady.<\/p>\n<p>H\u01a1n n\u1eefa, c\u00e1c email l\u1eeba \u0111\u1ea3o c\u1ee7a nh\u00f3m hi\u1ec7n nay \u0111\u01b0\u1ee3c so\u1ea1n th\u1ea3o b\u1eb1ng ti\u1ebfng Vi\u1ec7t r\u1ea5t t\u1ef1 nhi\u00ean, kh\u00f4ng c\u00f2n m\u1eafc c\u00e1c l\u1ed7i d\u1ecbch thu\u1eadt ng\u00f4 ngh\u00ea nh\u01b0 tr\u01b0\u1edbc, cho th\u1ea5y s\u1ef1 nghi\u00ean c\u1ee9u k\u1ef9 l\u01b0\u1ee1ng v\u1ec1 \u0111\u1ed1i t\u01b0\u1ee3ng m\u1ee5c ti\u00eau t\u1ea1i Vi\u1ec7t Nam.<\/p>\n<h3>Khuy\u1ebfn ngh\u1ecb ph\u00f2ng th\u1ee7 cho doanh nghi\u1ec7p v\u00e0 t\u1ed5 ch\u1ee9c<\/h3>\n<p>\u0110\u1ec3 \u0111\u1ed1i ph\u00f3 v\u1edbi s\u1ef1 \u0111e d\u1ecda t\u1eeb c\u00e1c nh\u00f3m APT nh\u01b0 Mustang Panda, c\u00e1c t\u1ed5 ch\u1ee9c c\u1ea7n tri\u1ec3n khai m\u00f4 h\u00ecnh ph\u00f2ng th\u1ee7 \u0111a l\u1edbp:<\/p>\n<ul>\n<li><strong>Gi\u00e1o d\u1ee5c nh\u1eadn th\u1ee9c:<\/strong> Th\u01b0\u1eddng xuy\u00ean t\u1eadp hu\u1ea5n cho nh\u00e2n vi\u00ean v\u1ec1 c\u00e1ch nh\u1eadn bi\u1ebft email l\u1eeba \u0111\u1ea3o, \u0111\u1eb7c bi\u1ec7t l\u00e0 kh\u00f4ng m\u1edf c\u00e1c t\u1ec7p tin l\u1ea1 c\u00f3 \u0111u\u00f4i .zip, .rar ho\u1eb7c c\u00e1c t\u1ec7p th\u1ef1c thi .exe \u0111\u01b0\u1ee3c ng\u1ee5y trang.<\/li>\n<li><strong>Tri\u1ec3n khai EDR\/XDR:<\/strong> S\u1eed d\u1ee5ng c\u00e1c gi\u1ea3i ph\u00e1p ph\u00e1t hi\u1ec7n v\u00e0 ph\u1ea3n \u1ee9ng t\u1ea1i \u0111i\u1ec3m cu\u1ed1i (Endpoint Detection and Response) \u0111\u1ec3 gi\u00e1m s\u00e1t c\u00e1c h\u00e0nh vi b\u1ea5t th\u01b0\u1eddng nh\u01b0 DLL side-loading.<\/li>\n<li><strong>Ki\u1ec3m so\u00e1t quy\u1ec1n truy c\u1eadp:<\/strong> \u00c1p d\u1ee5ng nguy\u00ean t\u1eafc \u0111\u1eb7c quy\u1ec1n t\u1ed1i thi\u1ec3u v\u00e0 x\u00e1c th\u1ef1c \u0111a y\u1ebfu t\u1ed1 (MFA) cho to\u00e0n b\u1ed9 h\u1ec7 th\u1ed1ng Internet v\u00e0 n\u1ed9i b\u1ed9.<\/li>\n<li><strong>C\u1eadp nh\u1eadt h\u1ec7 th\u1ed1ng:<\/strong> \u0110\u1ea3m b\u1ea3o c\u00e1c ph\u1ea7n m\u1ec1m v\u00e0 h\u1ec7 \u0111i\u1ec1u h\u00e0nh lu\u00f4n \u0111\u01b0\u1ee3c v\u00e1 l\u1ed7i k\u1ecbp th\u1eddi \u0111\u1ec3 h\u1ea1n ch\u1ebf l\u1ed7 h\u1ed5ng m\u00e0 hacker c\u00f3 th\u1ec3 khai th\u00e1c.<\/li>\n<\/ul>\n<p>Mustang Panda ch\u1eafc ch\u1eafn s\u1ebd c\u00f2n ti\u1ebfp t\u1ee5c l\u00e0 m\u1ed9t m\u1ed1i \u0111e d\u1ecda l\u1edbn tr\u00ean b\u1ea3n \u0111\u1ed3 an ninh m\u1ea1ng. Vi\u1ec7c hi\u1ec3u r\u00f5 &#8220;ch\u00e2n dung&#8221; v\u00e0 c\u00e1ch th\u1ee9c ho\u1ea1t \u0111\u1ed9ng c\u1ee7a nh\u00f3m l\u00e0 b\u01b0\u1edbc \u0111\u1ea7u ti\u00ean quan tr\u1ecdng \u0111\u1ec3 c\u00e1c doanh nghi\u1ec7p Vi\u1ec7t Nam t\u1ef1 b\u1ea3o v\u1ec7 m\u00ecnh tr\u01b0\u1edbc nh\u1eefng cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00f4ng b\u00e1o tr\u01b0\u1edbc.<\/p>\n<p>&nbsp;<\/p>\n<p><em>VNCyberS t\u1ed5ng h\u1ee3p t\u1eeb: C\u1ee5c An to\u00e0n th\u00f4ng tin, Trend Micro v\u00e0 c\u00e1c b\u00e1o c\u00e1o b\u1ea3o m\u1eadt qu\u1ed1c t\u1ebf.<\/em><\/p>","protected":false},"excerpt":{"rendered":"<p>Trong s\u1ed1 c\u00e1c nh\u00f3m t\u1ea5n c\u00f4ng c\u00f3 ch\u1ee7 \u0111\u00edch (APT) ho\u1ea1t \u0111\u1ed9ng m\u1ea1nh m\u1ebd nh\u1ea5t t\u1ea1i khu v\u1ef1c \u0110\u00f4ng Nam \u00c1, Mustang Panda (c\u00f2n \u0111\u01b0\u1ee3c g\u1ecdi l\u00e0 Earth Preta, Bronze President ho\u1eb7c RedDelta) n\u1ed5i l\u00ean nh\u01b0 m\u1ed9t &#8220;b\u00f3ng ma&#8221; dai d\u1eb3ng v\u1edbi c\u00e1c chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng quy m\u00f4 l\u1edbn v\u00e0 tinh vi. Nh\u00f3m n\u00e0y [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1143,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[46,118,120,117,119],"class_list":["post-1144","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-an-ninh-mang","tag-apt","tag-bao-mat-viet-nam","tag-mustang-panda","tag-tan-cong-co-chu-dich"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1144","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1144"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1144\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1143"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1144"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1144"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1144"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}