{"id":1192,"date":"2026-04-30T21:05:44","date_gmt":"2026-04-30T14:05:44","guid":{"rendered":"https:\/\/vncybers.vn\/ho-so-apt32-oceanlotus-chien-dich-tan-cong-chuoi-cung-ung-nganh-o-to-toan-cau\/"},"modified":"2026-04-30T21:05:44","modified_gmt":"2026-04-30T14:05:44","slug":"ho-so-apt32-oceanlotus-chien-dich-tan-cong-chuoi-cung-ung-nganh-o-to-toan-cau","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/ho-so-apt32-oceanlotus-chien-dich-tan-cong-chuoi-cung-ung-nganh-o-to-toan-cau\/","title":{"rendered":"H\u1ed3 s\u01a1 APT32 (OceanLotus): Chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng ng\u00e0nh \u00f4 t\u00f4 to\u00e0n c\u1ea7u"},"content":{"rendered":"<h1>H\u1ed3 s\u01a1 APT32 (OceanLotus): Chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng ng\u00e0nh \u00f4 t\u00f4 to\u00e0n c\u1ea7u<\/h1>\n<p>Trong b\u1ee9c tranh m\u1ed1i \u0111e d\u1ecda m\u1ea1ng to\u00e0n c\u1ea7u, APT32 &#8211; c\u00f2n \u0111\u01b0\u1ee3c bi\u1ebft \u0111\u1ebfn v\u1edbi t\u00ean g\u1ecdi OceanLotus &#8211; n\u1ed5i l\u00ean nh\u01b0 m\u1ed9t trong nh\u1eefng nh\u00f3m t\u1ea5n c\u00f4ng c\u00f3 ch\u1ee7 \u0111\u00edch (Advanced Persistent Threat) tinh vi v\u00e0 nguy hi\u1ec3m nh\u1ea5t khu v\u1ef1c \u0110\u00f4ng Nam \u00c1. \u0110\u01b0\u1ee3c cho l\u00e0 c\u00f3 li\u00ean h\u1ec7 v\u1edbi c\u00e1c l\u1ee3i \u00edch chi\u1ebfn l\u01b0\u1ee3c c\u1ee7a Vi\u1ec7t Nam, nh\u00f3m n\u00e0y \u0111\u00e3 m\u1edf r\u1ed9ng ph\u1ea1m vi t\u1ea5n c\u00f4ng t\u1eeb c\u00e1c c\u01a1 quan ch\u00ednh ph\u1ee7 sang khu v\u1ef1c t\u01b0 nh\u00e2n, \u0111\u1eb7c bi\u1ec7t nh\u1eafm v\u00e0o chu\u1ed7i cung \u1ee9ng c\u1ee7a ng\u00e0nh c\u00f4ng nghi\u1ec7p \u00f4 t\u00f4 to\u00e0n c\u1ea7u. C\u00e1c chi\u1ebfn d\u1ecbch nh\u1eafm v\u00e0o Toyota v\u00e0 BMW \u0111\u00e3 l\u00e0m l\u1ed9 ra nh\u1eefng l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong c\u00e1ch doanh nghi\u1ec7p \u0111a qu\u1ed1c gia b\u1ea3o v\u1ec7 t\u00e0i s\u1ea3n tr\u00ed tu\u1ec7 c\u1ee7a m\u00ecnh.<\/p>\n<h2>APT32 l\u00e0 ai?<\/h2>\n<p>APT32 l\u1ea7n \u0111\u1ea7u ti\u00ean \u0111\u01b0\u1ee3c FireEye ghi nh\u1eadn v\u00e0 \u0111\u1eb7t t\u00ean v\u00e0o n\u0103m 2017, d\u00f9 c\u00e1c ho\u1ea1t \u0111\u1ed9ng c\u1ee7a nh\u00f3m n\u00e0y \u0111\u00e3 \u0111\u01b0\u1ee3c truy d\u1ea5u v\u1ec1 \u00edt nh\u1ea5t t\u1eeb n\u0103m 2012. Kh\u00f4ng gi\u1ed1ng nhi\u1ec1u nh\u00f3m APT kh\u00e1c ch\u1ee7 y\u1ebfu theo \u0111u\u1ed5i m\u1ee5c ti\u00eau gi\u00e1n \u0111i\u1ec7p ch\u00ednh tr\u1ecb, OceanLotus th\u1ec3 hi\u1ec7n s\u1ef1 linh ho\u1ea1t chi\u1ebfn l\u01b0\u1ee3c \u0111\u00e1ng k\u1ec3 khi nh\u1eafm \u0111\u1ed3ng th\u1eddi v\u00e0o c\u00e1c t\u1ed5 ch\u1ee9c ch\u00ednh ph\u1ee7, t\u1ed5 ch\u1ee9c phi l\u1ee3i nhu\u1eadn, nh\u00e0 b\u00e1o, v\u00e0 \u0111\u1eb7c bi\u1ec7t l\u00e0 c\u00e1c t\u1eadp \u0111o\u00e0n n\u01b0\u1edbc ngo\u00e0i \u0111ang ho\u1ea1t \u0111\u1ed9ng ho\u1eb7c c\u00f3 k\u1ebf ho\u1ea1ch \u0111\u1ea7u t\u01b0 v\u00e0o Vi\u1ec7t Nam.<\/p>\n<p>Nh\u00f3m s\u1eed d\u1ee5ng h\u1ea1 t\u1ea7ng t\u1ea5n c\u00f4ng \u0111a d\u1ea1ng, th\u01b0\u1eddng xuy\u00ean thay \u0111\u1ed5i v\u00e0 c\u00f3 kh\u1ea3 n\u0103ng ph\u00e1t tri\u1ec3n ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i t\u00f9y ch\u1ec9nh \u1edf tr\u00ecnh \u0111\u1ed9 cao. Theo ph\u00e2n t\u00edch c\u1ee7a ESET v\u00e0 FireEye, APT32 duy tr\u00ec nhi\u1ec1u c\u1ee5m h\u1ea1 t\u1ea7ng ho\u1ea1t \u0111\u1ed9ng song song, cho ph\u00e9p nh\u00f3m nhanh ch\u00f3ng xoay tr\u1ee5c khi m\u1ed9t ph\u1ea7n b\u1ecb ph\u00e1t hi\u1ec7n v\u00e0 v\u00f4 hi\u1ec7u h\u00f3a.<\/p>\n<h2>M\u1ee5c ti\u00eau trong ng\u00e0nh \u00f4 t\u00f4: Toyota v\u00e0 BMW<\/h2>\n<p>N\u0103m 2019, chu\u1ed7i t\u1ea5n c\u00f4ng nh\u1eafm v\u00e0o Toyota tr\u1edf th\u00e0nh m\u1ed9t trong nh\u1eefng v\u1ee5 vi\u1ec7c \u0111\u01b0\u1ee3c ghi nh\u1eadn r\u00f5 r\u00e0ng nh\u1ea5t v\u1ec1 ho\u1ea1t \u0111\u1ed9ng c\u1ee7a APT32 trong l\u0129nh v\u1ef1c c\u00f4ng nghi\u1ec7p. Toyota Australia x\u00e1c nh\u1eadn \u0111\u00e3 b\u1ecb x\u00e2m nh\u1eadp v\u00e0o th\u00e1ng 2 n\u0103m 2019, ti\u1ebfp theo l\u00e0 c\u00e1c chi nh\u00e1nh t\u1ea1i Nh\u1eadt B\u1ea3n, Th\u00e1i Lan v\u00e0 Vi\u1ec7t Nam b\u1ecb \u1ea3nh h\u01b0\u1edfng trong c\u00f9ng n\u0103m. M\u1ee5c ti\u00eau kh\u00f4ng ph\u1ea3i l\u00e0 ph\u00e1 ho\u1ea1i ho\u1ea1t \u0111\u1ed9ng s\u1ea3n xu\u1ea5t m\u00e0 l\u00e0 \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u k\u1ef9 thu\u1eadt, th\u00f4ng tin thi\u1ebft k\u1ebf xe v\u00e0 d\u1eef li\u1ec7u kh\u00e1ch h\u00e0ng c\u00f3 gi\u00e1 tr\u1ecb cao.<\/p>\n<p>Tr\u01b0\u1eddng h\u1ee3p c\u1ee7a BMW \u0111\u01b0\u1ee3c Reuters \u0111\u01b0a tin v\u00e0o cu\u1ed1i n\u0103m 2019. K\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 x\u00e2m nh\u1eadp th\u00e0nh c\u00f4ng v\u00e0o m\u1ea1ng n\u1ed9i b\u1ed9 c\u1ee7a BMW th\u00f4ng qua m\u1ed9t c\u00f4ng c\u1ee5 truy c\u1eadp t\u1eeb xa h\u1ee3p ph\u00e1p l\u00e0 Cobalt Strike, \u0111\u01b0\u1ee3c tri\u1ec3n khai sau khi thi\u1ebft l\u1eadp ch\u1ed7 \u0111\u1ee9ng ban \u0111\u1ea7u. \u0110\u00e1ng ch\u00fa \u00fd, m\u1ea1ng l\u01b0\u1edbi c\u1ee7a Hyundai t\u1ea1i ch\u00e2u \u00c2u c\u0169ng b\u1ecb x\u00e2m ph\u1ea1m trong kho\u1ea3ng th\u1eddi gian t\u01b0\u01a1ng t\u1ef1 v\u1edbi c\u00e1c d\u1ea5u hi\u1ec7u k\u1ef9 thu\u1eadt t\u01b0\u01a1ng \u0111\u1ed3ng. \u0110i\u1ec1u n\u00e0y cho th\u1ea5y m\u1ed9t chi\u1ebfn d\u1ecbch c\u00f3 t\u1ed5 ch\u1ee9c, nh\u1eafm c\u00f3 ch\u1ee7 \u0111\u00edch v\u00e0o ng\u00e0nh c\u00f4ng nghi\u1ec7p \u00f4 t\u00f4 nh\u01b0 m\u1ed9t ng\u00e0nh chi\u1ebfn l\u01b0\u1ee3c.<\/p>\n<h2>Ph\u01b0\u01a1ng th\u1ee9c t\u1ea5n c\u00f4ng: Phishing v\u00e0 malware Denis<\/h2>\n<p>Vector x\u00e2m nh\u1eadp ban \u0111\u1ea7u c\u1ee7a APT32 th\u01b0\u1eddng b\u1eaft \u0111\u1ea7u b\u1eb1ng c\u00e1c chi\u1ebfn d\u1ecbch spear-phishing \u0111\u01b0\u1ee3c nghi\u00ean c\u1ee9u k\u1ef9 l\u01b0\u1ee1ng. Kh\u00f4ng gi\u1ed1ng phishing th\u00f4ng th\u01b0\u1eddng, nh\u00f3m d\u00e0nh th\u1eddi gian \u0111\u00e1ng k\u1ec3 \u0111\u1ec3 thu th\u1eadp th\u00f4ng tin v\u1ec1 m\u1ee5c ti\u00eau th\u00f4ng qua m\u1ea1ng x\u00e3 h\u1ed9i, LinkedIn v\u00e0 c\u00e1c ngu\u1ed3n c\u00f4ng khai tr\u00ean Internet tr\u01b0\u1edbc khi so\u1ea1n th\u1ea3o email t\u1ea5n c\u00f4ng. C\u00e1c email n\u00e0y th\u01b0\u1eddng gi\u1ea3 m\u1ea1o \u0111\u1ed1i t\u00e1c kinh doanh, c\u01a1 quan qu\u1ea3n l\u00fd ho\u1eb7c t\u1ed5 ch\u1ee9c ng\u00e0nh ngh\u1ec1 uy t\u00edn.<\/p>\n<p>T\u00e0i li\u1ec7u \u0111\u00ednh k\u00e8m \u0111\u1ed9c h\u1ea1i th\u01b0\u1eddng l\u00e0 file Microsoft Office \u0111\u01b0\u1ee3c nh\u00fang macro, ho\u1eb7c file n\u00e9n ch\u1ee9a shortcut (.lnk) gi\u1ea3 d\u1ea1ng t\u00e0i li\u1ec7u h\u1ee3p l\u1ec7. Khi ng\u01b0\u1eddi d\u00f9ng m\u1edf file, m\u1ed9t chu\u1ed7i l\u1ec7nh PowerShell \u0111\u01b0\u1ee3c th\u1ef1c thi ng\u1ea7m \u0111\u1ec3 t\u1ea3i v\u1ec1 payload giai \u0111o\u1ea1n ti\u1ebfp theo.<\/p>\n<p>Denis l\u00e0 backdoor t\u00f9y ch\u1ec9nh \u0111\u1eb7c tr\u01b0ng c\u1ee7a APT32, \u0111\u01b0\u1ee3c ESET ph\u00e2n t\u00edch chi ti\u1ebft. Malware n\u00e0y c\u00f3 kh\u1ea3 n\u0103ng:<\/p>\n<ul>\n<li>Thi\u1ebft l\u1eadp k\u00eanh li\u00ean l\u1ea1c m\u00e3 h\u00f3a v\u1edbi m\u00e1y ch\u1ee7 ch\u1ec9 huy v\u00e0 ki\u1ec3m so\u00e1t (C2) th\u00f4ng qua giao th\u1ee9c HTTP\/HTTPS \u0111\u1ec3 l\u1eabn v\u00e0o l\u01b0u l\u01b0\u1ee3ng Internet h\u1ee3p l\u1ec7.<\/li>\n<li>Thu th\u1eadp th\u00f4ng tin h\u1ec7 th\u1ed1ng, danh s\u00e1ch ti\u1ebfn tr\u00ecnh v\u00e0 n\u1ed9i dung clipboard.<\/li>\n<li>Th\u1ef1c thi l\u1ec7nh t\u00f9y \u00fd t\u1eeb xa v\u1edbi quy\u1ec1n c\u1ee7a ng\u01b0\u1eddi d\u00f9ng \u0111ang \u0111\u0103ng nh\u1eadp.<\/li>\n<li>T\u1ea3i l\u00ean v\u00e0 t\u1ea3i xu\u1ed1ng file t\u1eeb m\u00e1y ch\u1ee7 C2, cho ph\u00e9p tri\u1ec3n khai c\u00e1c c\u00f4ng c\u1ee5 b\u1ed5 sung theo t\u1eebng giai \u0111o\u1ea1n.<\/li>\n<li>T\u1ed3n t\u1ea1i dai d\u1eb3ng th\u00f4ng qua Registry key ho\u1eb7c t\u00e1c v\u1ee5 \u0111\u1ecbnh k\u1ef3 (Scheduled Task) \u0111\u1ec3 duy tr\u00ec hi\u1ec7n di\u1ec7n sau khi kh\u1edfi \u0111\u1ed9ng l\u1ea1i h\u1ec7 th\u1ed1ng.<\/li>\n<\/ul>\n<p>Ngo\u00e0i Denis, APT32 c\u00f2n s\u1eed d\u1ee5ng Cobalt Strike Beacon &#8211; m\u1ed9t framework ki\u1ec3m tra x\u00e2m nh\u1eadp th\u01b0\u01a1ng m\u1ea1i b\u1ecb l\u1ea1m d\u1ee5ng r\u1ed9ng r\u00e3i &#8211; c\u00f9ng v\u1edbi c\u00e1c c\u00f4ng c\u1ee5 living-off-the-land nh\u01b0 PowerShell, WMI v\u00e0 certutil \u0111\u1ec3 gi\u1ea3m thi\u1ec3u d\u1ea5u v\u1ebft ph\u00e1p y (forensic footprint). Chi\u1ebfn thu\u1eadt n\u00e0y l\u00e0m ph\u1ee9c t\u1ea1p \u0111\u00e1ng k\u1ec3 qu\u00e1 tr\u00ecnh ph\u00e1t hi\u1ec7n v\u00e0 quy k\u1ebft (attribution).<\/p>\n<h2>\u0110\u1eb7c \u0111i\u1ec3m n\u1ed5i b\u1eadt trong t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng<\/h2>\n<p>\u0110i\u1ec3m \u0111\u00e1ng lo ng\u1ea1i nh\u1ea5t trong c\u00e1c chi\u1ebfn d\u1ecbch nh\u1eafm v\u00e0o ng\u00e0nh \u00f4 t\u00f4 l\u00e0 c\u00e1ch APT32 khai th\u00e1c chu\u1ed7i cung \u1ee9ng thay v\u00ec t\u1ea5n c\u00f4ng tr\u1ef1c ti\u1ebfp v\u00e0o m\u1ee5c ti\u00eau ch\u00ednh. Thay v\u00ec c\u1ed1 g\u1eafng x\u00e2m nh\u1eadp v\u00e0o m\u1ea1ng l\u01b0\u1edbi \u0111\u01b0\u1ee3c b\u1ea3o v\u1ec7 nghi\u00eam ng\u1eb7t c\u1ee7a m\u1ed9t t\u1eadp \u0111o\u00e0n l\u1edbn, nh\u00f3m t\u00ecm ki\u1ebfm nh\u00e0 cung c\u1ea5p ph\u1ea7n m\u1ec1m, \u0111\u1ed1i t\u00e1c h\u1eadu c\u1ea7n, c\u00f4ng ty t\u01b0 v\u1ea5n k\u1ef9 thu\u1eadt ho\u1eb7c \u0111\u1ea1i l\u00fd \u1ee7y quy\u1ec1n c\u00f3 quy\u1ec1n truy c\u1eadp tin c\u1eady v\u00e0o h\u1ec7 th\u1ed1ng c\u1ee7a m\u1ee5c ti\u00eau.<\/p>\n<p>Chi\u1ebfn l\u01b0\u1ee3c n\u00e0y \u0111\u1eb7t ra th\u00e1ch th\u1ee9c c\u0103n b\u1ea3n: ngay c\u1ea3 khi t\u1eadp \u0111o\u00e0n trung t\u00e2m \u0111\u1ea7u t\u01b0 m\u1ea1nh v\u00e0o b\u1ea3o m\u1eadt, m\u1ed9t m\u1eaft x\u00edch y\u1ebfu trong chu\u1ed7i cung \u1ee9ng c\u0169ng c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh c\u1ea7u n\u1ed1i \u0111\u1ec3 k\u1ebb t\u1ea5n c\u00f4ng ti\u1ebfp c\u1eadn d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m nh\u1ea5t. Trong tr\u01b0\u1eddng h\u1ee3p Toyota, c\u00e1c d\u1ea5u hi\u1ec7u k\u1ef9 thu\u1eadt cho th\u1ea5y k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 d\u1ecbch chuy\u1ec3n ngang (lateral movement) qua nhi\u1ec1u chi nh\u00e1nh tr\u01b0\u1edbc khi b\u1ecb ph\u00e1t hi\u1ec7n, cho th\u1ea5y ch\u00fang \u0111\u00e3 hi\u1ec7n di\u1ec7n trong m\u1ea1ng l\u01b0\u1edbi m\u1ed9t kho\u1ea3ng th\u1eddi gian \u0111\u00e1ng k\u1ec3.<\/p>\n<h2>B\u00e0i h\u1ecdc cho doanh nghi\u1ec7p trong ng\u00e0nh s\u1ea3n xu\u1ea5t<\/h2>\n<p>C\u00e1c chi\u1ebfn d\u1ecbch c\u1ee7a APT32 nh\u1eafm v\u00e0o ng\u00e0nh \u00f4 t\u00f4 \u0111\u1ec3 l\u1ea1i nh\u1eefng b\u00e0i h\u1ecdc thi\u1ebft th\u1ef1c cho doanh nghi\u1ec7p \u1edf m\u1ecdi quy m\u00f4:<\/p>\n<p><strong>Qu\u1ea3n l\u00fd r\u1ee7i ro b\u00ean th\u1ee9 ba:<\/strong> Doanh nghi\u1ec7p c\u1ea7n m\u1edf r\u1ed9ng ph\u1ea1m vi \u0111\u00e1nh gi\u00e1 b\u1ea3o m\u1eadt ra ngo\u00e0i ranh gi\u1edbi t\u1ed5 ch\u1ee9c. Nh\u00e0 cung c\u1ea5p v\u00e0 \u0111\u1ed1i t\u00e1c c\u00f3 quy\u1ec1n truy c\u1eadp v\u00e0o h\u1ec7 th\u1ed1ng n\u1ed9i b\u1ed9 ph\u1ea3i tu\u00e2n th\u1ee7 c\u00e1c ti\u00eau chu\u1ea9n b\u1ea3o m\u1eadt t\u01b0\u01a1ng \u0111\u01b0\u01a1ng, v\u00e0 quy\u1ec1n truy c\u1eadp n\u00e0y c\u1ea7n \u0111\u01b0\u1ee3c gi\u00e1m s\u00e1t li\u00ean t\u1ee5c. C\u00e1c h\u1ee3p \u0111\u1ed3ng c\u1ea7n bao g\u1ed3m \u0111i\u1ec1u kho\u1ea3n v\u1ec1 y\u00eau c\u1ea7u b\u1ea3o m\u1eadt v\u00e0 quy\u1ec1n ki\u1ec3m tra (audit rights).<\/p>\n<p><strong>Ph\u00e2n \u0111o\u1ea1n m\u1ea1ng v\u00e0 nguy\u00ean t\u1eafc \u0111\u1eb7c quy\u1ec1n t\u1ed1i thi\u1ec3u:<\/strong> Ngay c\u1ea3 khi m\u1ed9t \u0111i\u1ec3m cu\u1ed1i b\u1ecb x\u00e2m ph\u1ea1m, ki\u1ebfn tr\u00fac m\u1ea1ng \u0111\u01b0\u1ee3c ph\u00e2n \u0111o\u1ea1n \u0111\u00fang c\u00e1ch s\u1ebd h\u1ea1n ch\u1ebf kh\u1ea3 n\u0103ng di chuy\u1ec3n ngang c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng. T\u00e0i kho\u1ea3n d\u1ecbch v\u1ee5 v\u00e0 ng\u01b0\u1eddi d\u00f9ng ch\u1ec9 n\u00ean c\u00f3 quy\u1ec1n truy c\u1eadp v\u1eeba \u0111\u1ee7 \u0111\u1ec3 th\u1ef1c hi\u1ec7n ch\u1ee9c n\u0103ng c\u1ee7a m\u00ecnh &#8211; kh\u00f4ng h\u01a1n.<\/p>\n<p><strong>\u0110\u00e0o t\u1ea1o nh\u1eadn th\u1ee9c v\u00e0 m\u00f4 ph\u1ecfng phishing:<\/strong> V\u00ec email l\u1eeba \u0111\u1ea3o l\u00e0 vector x\u00e2m nh\u1eadp ch\u00ednh, \u0111\u1ea7u t\u01b0 v\u00e0o \u0111\u00e0o t\u1ea1o nh\u00e2n vi\u00ean c\u00f3 kh\u1ea3 n\u0103ng nh\u1eadn di\u1ec7n c\u00e1c email \u0111\u00e1ng ng\u1edd l\u00e0 bi\u1ec7n ph\u00e1p hi\u1ec7u qu\u1ea3 v\u1ec1 chi ph\u00ed. C\u00e1c ch\u01b0\u01a1ng tr\u00ecnh m\u00f4 ph\u1ecfng phishing \u0111\u1ecbnh k\u1ef3 gi\u00fap \u0111o l\u01b0\u1eddng v\u00e0 c\u1ea3i thi\u1ec7n kh\u1ea3 n\u0103ng ph\u00f2ng th\u1ee7 c\u1ee7a con ng\u01b0\u1eddi.<\/p>\n<p><strong>Gi\u00e1m s\u00e1t h\u00e0nh vi v\u00e0 ph\u00e1t hi\u1ec7n b\u1ea5t th\u01b0\u1eddng:<\/strong> C\u00e1c c\u00f4ng c\u1ee5 EDR (Endpoint Detection and Response) v\u00e0 SIEM (Security Information and Event Management) c\u00f3 kh\u1ea3 n\u0103ng ph\u00e1t hi\u1ec7n c\u00e1c h\u00e0nh vi b\u1ea5t th\u01b0\u1eddng nh\u01b0 th\u1ef1c thi PowerShell b\u1ea5t th\u01b0\u1eddng, truy c\u1eadp file h\u00e0ng lo\u1ea1t, ho\u1eb7c l\u01b0u l\u01b0\u1ee3ng m\u1ea1ng \u0111\u1ebfn c\u00e1c \u0111\u1ecba ch\u1ec9 IP kh\u00f4ng x\u00e1c \u0111\u1ecbnh &#8211; nh\u1eefng d\u1ea5u hi\u1ec7u th\u01b0\u1eddng xu\u1ea5t hi\u1ec7n trong giai \u0111o\u1ea1n trinh s\u00e1t v\u00e0 l\u1ecdc d\u1eef li\u1ec7u (exfiltration).<\/p>\n<p><strong>K\u1ebf ho\u1ea1ch \u1ee9ng ph\u00f3 s\u1ef1 c\u1ed1:<\/strong> Kh\u00f4ng c\u00f3 t\u1ed5 ch\u1ee9c n\u00e0o mi\u1ec5n nhi\u1ec5m ho\u00e0n to\u00e0n. C\u00f3 m\u1ed9t k\u1ebf ho\u1ea1ch \u1ee9ng ph\u00f3 s\u1ef1 c\u1ed1 \u0111\u01b0\u1ee3c luy\u1ec7n t\u1eadp th\u01b0\u1eddng xuy\u00ean, bao g\u1ed3m quy tr\u00ecnh c\u00f4 l\u1eadp, b\u1ea3o t\u1ed3n b\u1eb1ng ch\u1ee9ng v\u00e0 th\u00f4ng b\u00e1o, s\u1ebd gi\u1ea3m thi\u1ec3u \u0111\u00e1ng k\u1ec3 thi\u1ec7t h\u1ea1i khi s\u1ef1 c\u1ed1 x\u1ea3y ra.<\/p>\n<h2>Nh\u1eadn \u0111\u1ecbnh t\u1ed5ng quan<\/h2>\n<p>APT32 \u0111\u1ea1i di\u1ec7n cho m\u1ed9t th\u1ebf h\u1ec7 m\u1ed1i \u0111e d\u1ecda m\u1edbi: ki\u00ean nh\u1eabn, linh ho\u1ea1t v\u00e0 c\u00f3 \u0111\u1ed9ng l\u1ef1c kinh t\u1ebf r\u00f5 r\u00e0ng b\u00ean c\u1ea1nh m\u1ee5c ti\u00eau gi\u00e1n \u0111i\u1ec7p truy\u1ec1n th\u1ed1ng. S\u1ef1 chuy\u1ec3n d\u1ecbch sang t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng ph\u1ea3n \u00e1nh m\u1ed9t th\u1ef1c t\u1ebf r\u1eb1ng c\u00e1c t\u1eadp \u0111o\u00e0n l\u1edbn \u0111\u00e3 \u0111\u1ea7u t\u01b0 \u0111\u00e1ng k\u1ec3 v\u00e0o b\u1ea3o m\u1eadt v\u00e0nh \u0111ai, bu\u1ed9c k\u1ebb t\u1ea5n c\u00f4ng ph\u1ea3i t\u00ecm ki\u1ebfm con \u0111\u01b0\u1eddng v\u00f2ng qua c\u00e1c \u0111\u1ed1i t\u00e1c tin c\u1eady h\u01a1n.<\/p>\n<p>\u0110\u1ed1i v\u1edbi ng\u00e0nh c\u00f4ng nghi\u1ec7p \u00f4 t\u00f4 &#8211; n\u01a1i t\u00e0i s\u1ea3n tr\u00ed tu\u1ec7 v\u1ec1 thi\u1ebft k\u1ebf, c\u00f4ng ngh\u1ec7 \u0111\u1ed9ng c\u01a1 v\u00e0 d\u1eef li\u1ec7u kh\u00e1ch h\u00e0ng c\u00f3 gi\u00e1 tr\u1ecb h\u00e0ng t\u1ef7 \u0111\u00f4 la &#8211; s\u1ef1 c\u1ea3nh gi\u00e1c li\u00ean t\u1ee5c v\u00e0 \u0111\u1ea7u t\u01b0 b\u00e0i b\u1ea3n v\u00e0o b\u1ea3o m\u1eadt kh\u00f4ng c\u00f2n l\u00e0 l\u1ef1a ch\u1ecdn m\u00e0 l\u00e0 y\u00eau c\u1ea7u s\u1ed1ng c\u00f2n trong th\u1eddi \u0111\u1ea1i k\u1ebft n\u1ed1i to\u00e0n c\u1ea7u qua Internet.<\/p>\n<p>&nbsp;<\/p>\n<p><em>VNCyberS t\u1ed5ng h\u1ee3p t\u1eeb: FireEye, ESET v\u00e0 Reuters.<\/em><\/p>","protected":false},"excerpt":{"rendered":"<p>H\u1ed3 s\u01a1 APT32 (OceanLotus): Chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng ng\u00e0nh \u00f4 t\u00f4 to\u00e0n c\u1ea7u Trong b\u1ee9c tranh m\u1ed1i \u0111e d\u1ecda m\u1ea1ng to\u00e0n c\u1ea7u, APT32 &#8211; c\u00f2n \u0111\u01b0\u1ee3c bi\u1ebft \u0111\u1ebfn v\u1edbi t\u00ean g\u1ecdi OceanLotus &#8211; n\u1ed5i l\u00ean nh\u01b0 m\u1ed9t trong nh\u1eefng nh\u00f3m t\u1ea5n c\u00f4ng c\u00f3 ch\u1ee7 \u0111\u00edch (Advanced Persistent Threat) tinh vi v\u00e0 nguy [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1191,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[127,128],"class_list":["post-1192","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-apt32","tag-oceanlotus"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1192","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1192"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1192\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1191"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1192"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1192"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1192"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}