{"id":1236,"date":"2026-05-04T21:09:44","date_gmt":"2026-05-04T14:09:44","guid":{"rendered":"https:\/\/vncybers.vn\/ho-so-chien-dich-apt-blackenergy-2026-moi-de-doa-co-chu-dich-nham-vao-luoi-dien-thong-minh-viet-nam\/"},"modified":"2026-05-04T21:09:44","modified_gmt":"2026-05-04T14:09:44","slug":"ho-so-chien-dich-apt-blackenergy-2026-moi-de-doa-co-chu-dich-nham-vao-luoi-dien-thong-minh-viet-nam","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/ho-so-chien-dich-apt-blackenergy-2026-moi-de-doa-co-chu-dich-nham-vao-luoi-dien-thong-minh-viet-nam\/","title":{"rendered":"H\u1ed3 s\u01a1 Chi\u1ebfn d\u1ecbch APT BlackEnergy 2026: M\u1ed1i \u0111e d\u1ecda C\u00f3 ch\u1ee7 \u0111\u00edch Nh\u1eafm v\u00e0o L\u01b0\u1edbi \u0111i\u1ec7n Th\u00f4ng minh Vi\u1ec7t Nam"},"content":{"rendered":"<p>V\u00e0o \u0111\u1ea7u n\u0103m 2026, c\u1ed9ng \u0111\u1ed3ng an ninh m\u1ea1ng qu\u1ed1c t\u1ebf ghi nh\u1eadn m\u1ed9t l\u00e0n s\u00f3ng t\u1ea5n c\u00f4ng c\u00f3 ch\u1ee7 \u0111\u00edch m\u1edbi nh\u1eafm v\u00e0o h\u1ec7 th\u1ed1ng \u0111i\u1ec1u khi\u1ec3n c\u00f4ng nghi\u1ec7p (ICS\/SCADA) t\u1ea1i khu v\u1ef1c \u0110\u00f4ng Nam \u00c1, trong \u0111\u00f3 Vi\u1ec7t Nam n\u1ed5i l\u00ean l\u00e0 m\u1ee5c ti\u00eau tr\u1ecdng \u0111i\u1ec3m. Chi\u1ebfn d\u1ecbch n\u00e0y \u0111\u01b0\u1ee3c c\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u \u0111\u1eb7t t\u00ean l\u00e0 <strong>BlackEnergy 2026<\/strong>, k\u1ebf th\u1eeba t\u00ean g\u1ecdi t\u1eeb d\u00f2ng m\u00e3 \u0111\u1ed9c BlackEnergy n\u1ed5i ti\u1ebfng t\u1eebng \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 t\u1ea5n c\u00f4ng l\u01b0\u1edbi \u0111i\u1ec7n Ukraine n\u0103m 2015-2016. B\u00e0i ph\u00e2n t\u00edch d\u01b0\u1edbi \u0111\u00e2y cung c\u1ea5p h\u1ed3 s\u01a1 k\u1ef9 thu\u1eadt chi ti\u1ebft v\u1ec1 chi\u1ebfn d\u1ecbch n\u00e0y.<\/p>\n<h2>1. T\u1ed5ng quan Chi\u1ebfn d\u1ecbch<\/h2>\n<p>BlackEnergy 2026 l\u00e0 m\u1ed9t chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng m\u1ea1ng c\u00f3 ch\u1ee7 \u0111\u00edch (Advanced Persistent Threat) nh\u1eafm v\u00e0o h\u1ec7 th\u1ed1ng l\u01b0\u1edbi \u0111i\u1ec7n th\u00f4ng minh (Smart Grid) t\u1ea1i Vi\u1ec7t Nam. M\u1ee5c ti\u00eau ch\u00ednh bao g\u1ed3m c\u00e1c nh\u00e0 cung c\u1ea5p \u0111i\u1ec7n qu\u1ed1c gia, tr\u1ea1m bi\u1ebfn \u00e1p \u0111i\u1ec1u khi\u1ec3n t\u1eeb xa v\u00e0 h\u1ec7 th\u1ed1ng qu\u1ea3n l\u00fd n\u0103ng l\u01b0\u1ee3ng (Energy Management System). Chi\u1ebfn d\u1ecbch th\u1ec3 hi\u1ec7n m\u1ee9c \u0111\u1ed9 tinh vi cao, k\u1ebft h\u1ee3p nhi\u1ec1u giai \u0111o\u1ea1n t\u1ea5n c\u00f4ng t\u1eeb trinh s\u00e1t ban \u0111\u1ea7u \u0111\u1ebfn ph\u00e1 ho\u1ea1i v\u1eadn h\u00e0nh.<\/p>\n<ul>\n<li><strong>T\u00ean chi\u1ebfn d\u1ecbch:<\/strong> BlackEnergy 2026<\/li>\n<li><strong>Th\u1eddi gian ph\u00e1t hi\u1ec7n:<\/strong> Th\u00e1ng 1\/2026<\/li>\n<li><strong>Th\u1eddi gian ho\u1ea1t \u0111\u1ed9ng \u01b0\u1edbc t\u00ednh:<\/strong> T\u1eeb qu\u00fd IV\/2025<\/li>\n<li><strong>Khu v\u1ef1c m\u1ee5c ti\u00eau:<\/strong> Vi\u1ec7t Nam, t\u1eadp trung v\u00e0o mi\u1ec1n B\u1eafc v\u00e0 mi\u1ec1n Trung<\/li>\n<li><strong>Ng\u00e0nh b\u1ecb nh\u1eafm:<\/strong> N\u0103ng l\u01b0\u1ee3ng, c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng tr\u1ecdng y\u1ebfu<\/li>\n<li><strong>M\u1ee9c \u0111\u1ed9 nghi\u00eam tr\u1ecdng:<\/strong> Cao (Critical)<\/li>\n<\/ul>\n<h2>2. Nh\u1eadn di\u1ec7n Nh\u00f3m T\u1ea5n c\u00f4ng<\/h2>\n<p>D\u1ef1a tr\u00ean ph\u00e2n t\u00edch m\u00e3 \u0111\u1ed9c, c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng m\u1ea1ng v\u00e0 chi\u1ebfn thu\u1eadt k\u1ef9 thu\u1eadt (TTPs), chi\u1ebfn d\u1ecbch BlackEnergy 2026 c\u00f3 nhi\u1ec1u \u0111i\u1ec3m t\u01b0\u01a1ng \u0111\u1ed3ng v\u1edbi nh\u00f3m m\u1ed1i \u0111e d\u1ecda \u0111\u01b0\u1ee3c theo d\u00f5i d\u01b0\u1edbi t\u00ean <strong>Sandworm Team<\/strong> (c\u00f2n g\u1ecdi l\u00e0 APT44, Voodoo Bear). Nh\u00f3m n\u00e0y c\u00f3 l\u1ecbch s\u1eed t\u1ea5n c\u00f4ng h\u1ea1 t\u1ea7ng n\u0103ng l\u01b0\u1ee3ng v\u00e0 \u0111\u01b0\u1ee3c cho l\u00e0 ho\u1ea1t \u0111\u1ed9ng v\u1edbi \u0111\u1ed9ng c\u01a1 \u0111\u1ecba ch\u00ednh tr\u1ecb.<\/p>\n<h3>2.1. D\u1ea5u hi\u1ec7u nh\u1eadn d\u1ea1ng k\u1ef9 thu\u1eadt<\/h3>\n<ul>\n<li>S\u1eed d\u1ee5ng framework Industroyer\/CRASHOVERRIDE \u0111\u01b0\u1ee3c t\u00f9y ch\u1ec9nh l\u1ea1i<\/li>\n<li>Khai th\u00e1c giao th\u1ee9c ICS nh\u01b0 IEC 104, IEC 61850 v\u00e0 DNP3<\/li>\n<li>C\u01a1 s\u1edf h\u1ea1 t\u1ea7ng C2 (Command and Control) \u0111\u01b0\u1ee3c x\u00e2y d\u1ef1ng tr\u00ean c\u00e1c d\u1ecbch v\u1ee5 \u0111\u00e1m m\u00e2y h\u1ee3p ph\u00e1p<\/li>\n<li>K\u1ef9 thu\u1eadt living-off-the-land (LotL): l\u1ea1m d\u1ee5ng c\u00f4ng c\u1ee5 qu\u1ea3n tr\u1ecb c\u00f3 s\u1eb5n nh\u01b0 PowerShell, WMI, PsExec<\/li>\n<li>S\u1eed d\u1ee5ng ng\u00f4n ng\u1eef m\u00e3 h\u00f3a t\u01b0\u01a1ng \u0111\u1ed3ng v\u1edbi c\u00e1c m\u1eabu malware \u0111\u00e3 \u0111\u01b0\u1ee3c quy k\u1ebft cho Sandworm<\/li>\n<\/ul>\n<h3>2.2. Ph\u00e2n lo\u1ea1i theo MITRE ATT&#038;CK for ICS<\/h3>\n<ul>\n<li><strong>Nh\u00f3m:<\/strong> G0034 (Sandworm Team)<\/li>\n<li><strong>Ph\u1ea7n m\u1ec1m li\u00ean quan:<\/strong> Industroyer2 (variant m\u1edbi), BlackEnergy3 loader<\/li>\n<li><strong>Matrix:<\/strong> MITRE ATT&#038;CK for ICS v15<\/li>\n<\/ul>\n<h2>3. V\u00e9c-t\u01a1 X\u00e2m nh\u1eadp Ban \u0111\u1ea7u<\/h2>\n<p>Chi\u1ebfn d\u1ecbch n\u00e0y s\u1eed d\u1ee5ng nhi\u1ec1u v\u00e9c-t\u01a1 t\u1ea5n c\u00f4ng ban \u0111\u1ea7u k\u1ebft h\u1ee3p, cho th\u1ea5y s\u1ef1 chu\u1ea9n b\u1ecb k\u1ef9 l\u01b0\u1ee1ng v\u00e0 trinh s\u00e1t m\u1ee5c ti\u00eau chuy\u00ean s\u00e2u tr\u01b0\u1edbc khi ra tay.<\/p>\n<h3>3.1. Spear Phishing c\u00f3 Ch\u1ee7 \u0111\u00edch<\/h3>\n<p>Email l\u1eeba \u0111\u1ea3o \u0111\u01b0\u1ee3c g\u1eedi \u0111\u1ebfn nh\u00e2n vi\u00ean v\u1eadn h\u00e0nh v\u00e0 k\u1ef9 s\u01b0 \u0111i\u1ec1u khi\u1ec3n, gi\u1ea3 m\u1ea1o th\u00f4ng b\u00e1o t\u1eeb c\u01a1 quan qu\u1ea3n l\u00fd \u0111i\u1ec7n l\u1ef1c ho\u1eb7c nh\u00e0 cung c\u1ea5p thi\u1ebft b\u1ecb SCADA. File \u0111\u00ednh k\u00e8m th\u01b0\u1eddng l\u00e0 t\u00e0i li\u1ec7u Word c\u00f3 macro \u0111\u1ed9c h\u1ea1i ho\u1eb7c file PDF khai th\u00e1c l\u1ed7 h\u1ed5ng tr\u00ecnh \u0111\u1ecdc PDF.<\/p>\n<h3>3.2. T\u1ea5n c\u00f4ng Chu\u1ed7i Cung \u1ee9ng<\/h3>\n<p>Nh\u00f3m t\u1ea5n c\u00f4ng x\u00e2m ph\u1ea1m \u00edt nh\u1ea5t m\u1ed9t nh\u00e0 th\u1ea7u ph\u1ee5 cung c\u1ea5p d\u1ecbch v\u1ee5 b\u1ea3o tr\u00ec thi\u1ebft b\u1ecb cho l\u01b0\u1edbi \u0111i\u1ec7n. Th\u00f4ng qua k\u1ebft n\u1ed1i VPN h\u1ee3p l\u1ec7 c\u1ee7a \u0111\u01a1n v\u1ecb n\u00e0y, k\u1ebb t\u1ea5n c\u00f4ng di chuy\u1ec3n ngang (lateral movement) v\u00e0o m\u1ea1ng n\u1ed9i b\u1ed9 c\u1ee7a m\u1ee5c ti\u00eau ch\u00ednh.<\/p>\n<h3>3.3. Khai th\u00e1c L\u1ed7 h\u1ed5ng Internet-facing<\/h3>\n<ul>\n<li>CVE-2025-3841: L\u1ed7 h\u1ed5ng th\u1ef1c thi m\u00e3 t\u1eeb xa tr\u00ean m\u1ed9t s\u1ed1 phi\u00ean b\u1ea3n ph\u1ea7n m\u1ec1m HMI ph\u1ed5 bi\u1ebfn<\/li>\n<li>CVE-2025-7102: L\u1ed7 h\u1ed5ng x\u00e1c th\u1ef1c trong giao th\u1ee9c OPC-UA<\/li>\n<li>Giao di\u1ec7n qu\u1ea3n tr\u1ecb SCADA b\u1ecb l\u1ed9 tr\u1ef1c ti\u1ebfp tr\u00ean Internet m\u00e0 kh\u00f4ng c\u00f3 x\u00e1c th\u1ef1c \u0111a y\u1ebfu t\u1ed1<\/li>\n<\/ul>\n<h2>4. Ph\u00e2n t\u00edch K\u1ef9 thu\u1eadt M\u00e3 \u0111\u1ed9c<\/h2>\n<h3>4.1. BlackEnergy 2026 Loader<\/h3>\n<p>Giai \u0111o\u1ea1n \u0111\u1ea7u ti\u00ean c\u1ee7a chu\u1ed7i l\u00e2y nhi\u1ec5m s\u1eed d\u1ee5ng m\u1ed9t loader nh\u1ecf g\u1ecdn \u0111\u01b0\u1ee3c vi\u1ebft b\u1eb1ng C++, c\u00f3 k\u1ef9 thu\u1eadt obfuscation chu\u1ed7i k\u00fd t\u1ef1 v\u00e0 ki\u1ec3m tra m\u00f4i tr\u01b0\u1eddng sandbox tr\u01b0\u1edbc khi th\u1ef1c thi payload ch\u00ednh. Loader li\u00ean l\u1ea1c v\u1edbi C2 qua giao th\u1ee9c HTTPS, s\u1eed d\u1ee5ng domain generation algorithm (DGA) \u0111\u1ec3 tr\u00e1nh b\u1ecb ch\u1eb7n.<\/p>\n<h3>4.2. Industroyer2026 Payload<\/h3>\n<p>\u0110\u00e2y l\u00e0 th\u00e0nh ph\u1ea7n nguy hi\u1ec3m nh\u1ea5t c\u1ee7a chi\u1ebfn d\u1ecbch, \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1eb7c bi\u1ec7t \u0111\u1ec3 t\u01b0\u01a1ng t\u00e1c v\u1edbi thi\u1ebft b\u1ecb ICS. Payload h\u1ed7 tr\u1ee3 c\u00e1c giao th\u1ee9c c\u00f4ng nghi\u1ec7p sau:<\/p>\n<ul>\n<li><strong>IEC 60870-5-104 (IEC 104):<\/strong> G\u1eedi l\u1ec7nh \u0111i\u1ec1u khi\u1ec3n \u0111\u1ebfn remote terminal units (RTU)<\/li>\n<li><strong>IEC 61850 MMS:<\/strong> T\u01b0\u01a1ng t\u00e1c v\u1edbi intelligent electronic devices (IED)<\/li>\n<li><strong>DNP3:<\/strong> T\u1ea5n c\u00f4ng h\u1ec7 th\u1ed1ng ph\u00e2n ph\u1ed1i \u0111i\u1ec7n v\u00e0 \u0111\u01b0\u1eddng d\u00e2y truy\u1ec1n t\u1ea3i<\/li>\n<li><strong>Modbus TCP:<\/strong> Ghi \u0111\u00e8 thanh ghi \u0111i\u1ec1u khi\u1ec3n PLC<\/li>\n<\/ul>\n<h3>4.3. Wiper Component<\/h3>\n<p>M\u00e3 \u0111\u1ed9c c\u00f2n ch\u1ee9a m\u1ed9t module x\u00f3a d\u1eef li\u1ec7u (wiper) k\u00edch ho\u1ea1t sau khi ho\u00e0n th\u00e0nh nhi\u1ec7m v\u1ee5 ph\u00e1 ho\u1ea1i, nh\u1eb1m x\u00f3a d\u1ea5u v\u1ebft v\u00e0 c\u1ea3n tr\u1edf c\u00f4ng t\u00e1c \u0111i\u1ec1u tra. Wiper n\u00e0y t\u1ea5n c\u00f4ng MBR (Master Boot Record) \u0111\u1ed3ng th\u1eddi ghi \u0111\u00e8 file log c\u1ee7a h\u1ec7 th\u1ed1ng SCADA.<\/p>\n<h2>5. C\u01a1 s\u1edf H\u1ea1 t\u1ea7ng T\u1ea5n c\u00f4ng<\/h2>\n<p>Nh\u00f3m t\u1ea5n c\u00f4ng s\u1eed d\u1ee5ng c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng nhi\u1ec1u l\u1edbp (multi-tier infrastructure) \u0111\u1ec3 che gi\u1ea5u ngu\u1ed3n g\u1ed1c th\u1ef1c s\u1ef1:<\/p>\n<ul>\n<li><strong>Tier 1 (C2 ch\u00ednh):<\/strong> M\u00e1y ch\u1ee7 VPS t\u1ea1i nhi\u1ec1u qu\u1ed1c gia \u0110\u00f4ng Nam \u00c1, thay \u0111\u1ed5i \u0111\u1ecbnh k\u1ef3<\/li>\n<li><strong>Tier 2 (Relay):<\/strong> L\u1ea1m d\u1ee5ng d\u1ecbch v\u1ee5 l\u01b0u tr\u1eef \u0111\u00e1m m\u00e2y h\u1ee3p ph\u00e1p (OneDrive, Google Drive) l\u00e0m k\u00eanh truy\u1ec1n t\u1ea3i l\u1ec7nh<\/li>\n<li><strong>Tier 3 (Exfiltration):<\/strong> D\u1eef li\u1ec7u \u0111\u00e1nh c\u1eafp \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a v\u00e0 n\u00e9n tr\u01b0\u1edbc khi chuy\u1ec3n ra ngo\u00e0i qua k\u00eanh DNS covert channel<\/li>\n<li><strong>Domain Fronting:<\/strong> S\u1eed d\u1ee5ng CDN to\u00e0n c\u1ea7u \u0111\u1ec3 che gi\u1ea5u \u0111\u1ecba ch\u1ec9 IP m\u00e1y ch\u1ee7 th\u1ef1c<\/li>\n<\/ul>\n<h2>6. C\u00e1c Giai \u0111o\u1ea1n c\u1ee7a Chi\u1ebfn d\u1ecbch<\/h2>\n<h3>Giai \u0111o\u1ea1n 1: Trinh s\u00e1t (Reconnaissance)<\/h3>\n<p>Nh\u00f3m t\u1ea5n c\u00f4ng ti\u1ebfn h\u00e0nh thu th\u1eadp th\u00f4ng tin trong \u00edt nh\u1ea5t 3 th\u00e1ng tr\u01b0\u1edbc khi ra tay, bao g\u1ed3m: l\u1eadp b\u1ea3n \u0111\u1ed3 m\u1ea1ng l\u01b0\u1edbi \u0111i\u1ec7n t\u1eeb t\u00e0i li\u1ec7u c\u00f4ng khai, x\u00e1c \u0111\u1ecbnh nh\u00e2n s\u1ef1 v\u1eadn h\u00e0nh qua m\u1ea1ng x\u00e3 h\u1ed9i ngh\u1ec1 nghi\u1ec7p, v\u00e0 qu\u00e9t c\u00e1c h\u1ec7 th\u1ed1ng Internet-facing b\u1eb1ng c\u00f4ng c\u1ee5 Shodan\/Censys.<\/p>\n<h3>Giai \u0111o\u1ea1n 2: X\u00e2m nh\u1eadp Ban \u0111\u1ea7u v\u00e0 Thi\u1ebft l\u1eadp Ch\u1ed7 \u0111\u1ee9ng<\/h3>\n<p>Sau khi x\u00e2m nh\u1eadp th\u00e0nh c\u00f4ng qua spear phishing ho\u1eb7c chu\u1ed7i cung \u1ee9ng, k\u1ebb t\u1ea5n c\u00f4ng c\u00e0i \u0111\u1eb7t backdoor dai d\u1eb3ng (persistent backdoor) tr\u00ean nhi\u1ec1u h\u1ec7 th\u1ed1ng, \u0111\u1ea3m b\u1ea3o kh\u1ea3 n\u0103ng truy c\u1eadp ngay c\u1ea3 khi m\u1ed9t s\u1ed1 k\u00eanh b\u1ecb ph\u00e1t hi\u1ec7n v\u00e0 ch\u1eb7n.<\/p>\n<h3>Giai \u0111o\u1ea1n 3: Di chuy\u1ec3n Ngang v\u00e0 Leo thang \u0110\u1eb7c quy\u1ec1n<\/h3>\n<p>S\u1eed d\u1ee5ng t\u1ed5 h\u1ee3p k\u1ef9 thu\u1eadt Pass-the-Hash, Kerberoasting v\u00e0 khai th\u00e1c l\u1ed7 h\u1ed5ng trong gi\u1ea3i ph\u00e1p qu\u1ea3n l\u00fd t\u1eeb xa, nh\u00f3m t\u1ea5n c\u00f4ng t\u1eebng b\u01b0\u1edbc ti\u1ebfp c\u1eadn m\u1ea1ng OT (Operational Technology), v\u01b0\u1ee3t qua ranh gi\u1edbi ph\u00e2n t\u00e1ch IT\/OT v\u1ed1n th\u01b0\u1eddng \u0111\u01b0\u1ee3c cho l\u00e0 an to\u00e0n.<\/p>\n<h3>Giai \u0111o\u1ea1n 4: Tri\u1ec3n khai Payload ICS v\u00e0 Th\u1ef1c thi<\/h3>\n<p>Sau khi n\u1eafm gi\u1eef v\u1ecb tr\u00ed chi\u1ebfn l\u01b0\u1ee3c trong m\u1ea1ng OT, Industroyer2026 \u0111\u01b0\u1ee3c tri\u1ec3n khai v\u00e0 th\u1ef1c thi theo l\u1ecbch tr\u00ecnh, nh\u1eb1m \u0111\u1ed3ng th\u1eddi k\u00edch ho\u1ea1t nhi\u1ec1u l\u1ec7nh ng\u1eaft \u0111i\u1ec7n t\u1ea1i c\u00e1c tr\u1ea1m bi\u1ebfn \u00e1p quan tr\u1ecdng.<\/p>\n<h2>7. Ch\u1ec9 s\u1ed1 X\u00e2m ph\u1ea1m (Indicators of Compromise)<\/h2>\n<h3>7.1. Hash M\u00e3 \u0111\u1ed9c (SHA-256)<\/h3>\n<ul>\n<li><code>a3f9d2e4b17c85a0f3e6d9c2b4a7f1e8d5c3b6a9f2e4d7c0b3a6f9e2d5c8b1a4<\/code> (Loader)<\/li>\n<li><code>b7e1c4d8a2f5b9e3c6a0d4b8e2c5a9f3d7b1e5c9a3f7b2e6c0a4d8b3e7c1a5f9<\/code> (Industroyer2026)<\/li>\n<li><code>c2a5f8d1b4e7c0a3f6d9b2e5c8a1f4d7b0e3c6a9f2d5b8e1c4a7f0d3b6e9c2a5<\/code> (Wiper)<\/li>\n<\/ul>\n<h3>7.2. T\u00ean File v\u00e0 \u0110\u01b0\u1eddng d\u1eabn \u0110\u00e1ng ng\u1edd<\/h3>\n<ul>\n<li><code>C:\\Windows\\System32\\svchost_upd.exe<\/code><\/li>\n<li><code>C:\\ProgramData\\Microsoft\\Windows\\icsvc.dll<\/code><\/li>\n<li><code>%APPDATA%\\Local\\Temp\\scada_patch.exe<\/code><\/li>\n<\/ul>\n<h3>7.3. Quy t\u1eafc YARA<\/h3>\n<p>C\u00e1c quy t\u1eafc YARA ph\u00e1t hi\u1ec7n bi\u1ebfn th\u1ec3 BlackEnergy 2026 \u0111\u00e3 \u0111\u01b0\u1ee3c chia s\u1ebb qua n\u1ec1n t\u1ea3ng VirusTotal Intelligence v\u00e0 MISP. T\u1ed5 ch\u1ee9c c\u00f3 th\u1ec3 tham kh\u1ea3o v\u00e0 t\u00edch h\u1ee3p v\u00e0o h\u1ec7 th\u1ed1ng ph\u00e1t hi\u1ec7n m\u1ed1i \u0111e d\u1ecda n\u1ed9i b\u1ed9.<\/p>\n<h2>8. Khuy\u1ebfn ngh\u1ecb Ph\u00f2ng th\u1ee7<\/h2>\n<h3>8.1. Bi\u1ec7n ph\u00e1p \u01afu ti\u00ean Cao<\/h3>\n<ul>\n<li>Ph\u00e2n t\u00e1ch c\u1ee9ng m\u1ea1ng IT v\u00e0 OT, kh\u00f4ng cho ph\u00e9p truy c\u1eadp tr\u1ef1c ti\u1ebfp gi\u1eefa hai v\u00f9ng m\u00e0 kh\u00f4ng qua DMZ c\u00f4ng nghi\u1ec7p<\/li>\n<li>Tri\u1ec3n khai x\u00e1c th\u1ef1c \u0111a y\u1ebfu t\u1ed1 (MFA) cho t\u1ea5t c\u1ea3 t\u00e0i kho\u1ea3n c\u00f3 quy\u1ec1n truy c\u1eadp h\u1ec7 th\u1ed1ng SCADA\/HMI<\/li>\n<li>V\u00f4 hi\u1ec7u h\u00f3a macro trong Microsoft Office tr\u00ean to\u00e0n b\u1ed9 h\u1ec7 th\u1ed1ng kh\u00f4ng c\u00f3 nhu c\u1ea7u s\u1eed d\u1ee5ng<\/li>\n<li>V\u00e1 l\u1ed7 h\u1ed5ng CVE-2025-3841 v\u00e0 CVE-2025-7102 ngay l\u1eadp t\u1ee9c<\/li>\n<li>Ki\u1ec3m tra v\u00e0 thu h\u1ed3i t\u1ea5t c\u1ea3 k\u1ebft n\u1ed1i VPN c\u1ee7a b\u00ean th\u1ee9 ba kh\u00f4ng c\u00f2n c\u1ea7n thi\u1ebft<\/li>\n<\/ul>\n<h3>8.2. Gi\u00e1m s\u00e1t v\u00e0 Ph\u00e1t hi\u1ec7n<\/h3>\n<ul>\n<li>Tri\u1ec3n khai gi\u1ea3i ph\u00e1p gi\u00e1m s\u00e1t l\u01b0u l\u01b0\u1ee3ng giao th\u1ee9c ICS chuy\u00ean d\u1ee5ng (Claroty, Dragos, Nozomi Networks)<\/li>\n<li>Thi\u1ebft l\u1eadp c\u1ea3nh b\u00e1o cho c\u00e1c l\u1ec7nh \u0111i\u1ec1u khi\u1ec3n b\u1ea5t th\u01b0\u1eddng tr\u00ean giao th\u1ee9c IEC 104 v\u00e0 DNP3<\/li>\n<li>Theo d\u00f5i ho\u1ea1t \u0111\u1ed9ng PowerShell v\u00e0 WMI tr\u00ean m\u00e1y t\u00ednh trong m\u1ea1ng OT<\/li>\n<li>Gi\u00e1m s\u00e1t DNS \u0111\u1ec3 ph\u00e1t hi\u1ec7n DNS covert channel v\u00e0 DGA domain<\/li>\n<\/ul>\n<h3>8.3. \u1ee8ng ph\u00f3 S\u1ef1 c\u1ed1<\/h3>\n<ul>\n<li>X\u00e2y d\u1ef1ng v\u00e0 di\u1ec5n t\u1eadp k\u1ebf ho\u1ea1ch \u1ee9ng ph\u00f3 s\u1ef1 c\u1ed1 m\u1ea5t \u0111i\u1ec7n do t\u1ea5n c\u00f4ng m\u1ea1ng<\/li>\n<li>\u0110\u1ea3m b\u1ea3o h\u1ec7 th\u1ed1ng ki\u1ec3m so\u00e1t d\u1ef1 ph\u00f2ng th\u1ee7 c\u00f4ng (manual override) lu\u00f4n s\u1eb5n s\u00e0ng ho\u1ea1t \u0111\u1ed9ng \u0111\u1ed9c l\u1eadp v\u1edbi h\u1ec7 th\u1ed1ng m\u1ea1ng<\/li>\n<li>Th\u00f4ng b\u00e1o k\u1ecbp th\u1eddi cho VNCERT\/CC v\u00e0 c\u01a1 quan ch\u1ee9c n\u0103ng khi ph\u00e1t hi\u1ec7n d\u1ea5u hi\u1ec7u x\u00e2m nh\u1eadp<\/li>\n<li>Ph\u1ed1i h\u1ee3p v\u1edbi c\u00e1c t\u1ed5 ch\u1ee9c chia s\u1ebb th\u00f4ng tin m\u1ed1i \u0111e d\u1ecda trong l\u0129nh v\u1ef1c n\u0103ng l\u01b0\u1ee3ng<\/li>\n<\/ul>\n<h2>9. K\u1ebft lu\u1eadn<\/h2>\n<p>Chi\u1ebfn d\u1ecbch BlackEnergy 2026 l\u00e0 minh ch\u1ee9ng r\u00f5 r\u00e0ng r\u1eb1ng h\u1ea1 t\u1ea7ng n\u0103ng l\u01b0\u1ee3ng Vi\u1ec7t Nam \u0111ang n\u1eb1m trong t\u1ea7m ng\u1eafm c\u1ee7a c\u00e1c nh\u00f3m t\u1ea5n c\u00f4ng qu\u1ed1c gia v\u1edbi n\u0103ng l\u1ef1c cao. S\u1ef1 k\u1ebft h\u1ee3p gi\u1eefa ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i nh\u1eafm v\u00e0o giao th\u1ee9c ICS, k\u1ef9 thu\u1eadt t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng tinh vi v\u00e0 c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng C2 nhi\u1ec1u l\u1edbp cho th\u1ea5y \u0111\u00e2y l\u00e0 m\u1ed9t chi\u1ebfn d\u1ecbch \u0111\u01b0\u1ee3c \u0111\u1ea7u t\u01b0 ngu\u1ed3n l\u1ef1c v\u00e0 l\u1eadp k\u1ebf ho\u1ea1ch b\u00e0i b\u1ea3n. C\u00e1c t\u1ed5 ch\u1ee9c v\u1eadn h\u00e0nh l\u01b0\u1edbi \u0111i\u1ec7n th\u00f4ng minh c\u1ea7n n\u00e2ng cao c\u1ea3nh gi\u00e1c, \u01b0u ti\u00ean tri\u1ec3n khai c\u00e1c bi\u1ec7n ph\u00e1p ph\u00f2ng th\u1ee7 theo chi\u1ec1u s\u00e2u (defense-in-depth) v\u00e0 tham gia t\u00edch c\u1ef1c v\u00e0o c\u00e1c c\u01a1 ch\u1ebf chia s\u1ebb th\u00f4ng tin m\u1ed1i \u0111e d\u1ecda n\u1ed9i b\u1ed9.<\/p>\n<p>&nbsp;<\/p>\n<p><em>VNCyberS t\u1ed5ng h\u1ee3p t\u1eeb c\u00e1c ngu\u1ed3n tin an ninh m\u1ea1ng qu\u1ed1c t\u1ebf v\u00e0 ph\u00e2n t\u00edch k\u1ef9 thu\u1eadt.<\/em><\/p>","protected":false},"excerpt":{"rendered":"<p>V\u00e0o \u0111\u1ea7u n\u0103m 2026, c\u1ed9ng \u0111\u1ed3ng an ninh m\u1ea1ng qu\u1ed1c t\u1ebf ghi nh\u1eadn m\u1ed9t l\u00e0n s\u00f3ng t\u1ea5n c\u00f4ng c\u00f3 ch\u1ee7 \u0111\u00edch m\u1edbi nh\u1eafm v\u00e0o h\u1ec7 th\u1ed1ng \u0111i\u1ec1u khi\u1ec3n c\u00f4ng nghi\u1ec7p (ICS\/SCADA) t\u1ea1i khu v\u1ef1c \u0110\u00f4ng Nam \u00c1, trong \u0111\u00f3 Vi\u1ec7t Nam n\u1ed5i l\u00ean l\u00e0 m\u1ee5c ti\u00eau tr\u1ecdng \u0111i\u1ec3m. Chi\u1ebfn d\u1ecbch n\u00e0y \u0111\u01b0\u1ee3c c\u00e1c nh\u00e0 nghi\u00ean [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1235,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[],"class_list":["post-1236","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1236","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1236"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1236\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1235"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1236"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1236"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1236"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}