{"id":1249,"date":"2026-05-22T17:08:32","date_gmt":"2026-05-22T10:08:32","guid":{"rendered":"https:\/\/vncybers.vn\/triet-pha-botnet-kimwolf-2-trieu-thiet-bi-iot-bi-no-dich-cho-cac-vu-tan-cong-ddos-ky-luc\/"},"modified":"2026-05-22T17:10:53","modified_gmt":"2026-05-22T10:10:53","slug":"triet-pha-botnet-kimwolf-2-trieu-thiet-bi-iot-bi-no-dich-cho-cac-vu-tan-cong-ddos-ky-luc","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/triet-pha-botnet-kimwolf-2-trieu-thiet-bi-iot-bi-no-dich-cho-cac-vu-tan-cong-ddos-ky-luc\/","title":{"rendered":"Tri\u1ec7t ph\u00e1 botnet Kimwolf: 2 tri\u1ec7u thi\u1ebft b\u1ecb IoT b\u1ecb &#8220;n\u00f4 d\u1ecbch&#8221; cho c\u00e1c v\u1ee5 t\u1ea5n c\u00f4ng DDoS k\u1ef7 l\u1ee5c"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><strong>C\u1ea3nh s\u00e1t M\u1ef9 v\u00e0 Canada v\u1eeba ph\u1ed1i h\u1ee3p tri\u1ec7t ph\u00e1 th\u00e0nh c\u00f4ng h\u1ea1 t\u1ea7ng c\u1ee7a botnet Kimwolf v\u00e0 b\u1eaft gi\u1eef Jacob Butler, qu\u1ea3n tr\u1ecb vi\u00ean 23 tu\u1ed5i \u0111\u1ee9ng sau m\u1ea1ng l\u01b0\u1edbi l\u00e2y nhi\u1ec5m h\u01a1n 2 tri\u1ec7u thi\u1ebft b\u1ecb Android v\u00e0 IoT tr\u00ean to\u00e0n c\u1ea7u.<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Cu\u1ed9c b\u1eaft gi\u1eef t\u1ea1i Ottawa v\u00e0 ch\u00e2n dung qu\u1ea3n tr\u1ecb vi\u00ean &#8220;Dort&#8221;<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><img fetchpriority=\"high\" decoding=\"async\" width=\"900\" height=\"470\" src=\"https:\/\/vncybers.vn\/wp-content\/uploads\/2026\/05\/ddos-canada.jpg\" alt=\"Tri\u1ec7t ph\u00e1 botnet Kimwolf\" class=\"wp-image-1250\" srcset=\"https:\/\/vncybers.vn\/wp-content\/uploads\/2026\/05\/ddos-canada.jpg 900w, https:\/\/vncybers.vn\/wp-content\/uploads\/2026\/05\/ddos-canada-300x157.jpg 300w, https:\/\/vncybers.vn\/wp-content\/uploads\/2026\/05\/ddos-canada-768x401.jpg 768w\" sizes=\"(max-width: 900px) 100vw, 900px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Theo th\u00f4ng b\u00e1o t\u1eeb B\u1ed9 T\u01b0 ph\u00e1p M\u1ef9 (DoJ), Jacob Butler (th\u01b0\u1eddng \u0111\u01b0\u1ee3c bi\u1ebft \u0111\u1ebfn v\u1edbi bi\u1ec7t danh &#8220;Dort&#8221; ho\u1eb7c &#8220;resi.to&#8221; tr\u00ean Discord) \u0111\u00e3 b\u1ecb b\u1eaft gi\u1eef t\u1ea1i Ottawa, Canada. Butler b\u1ecb c\u00e1o bu\u1ed9c v\u1eadn h\u00e0nh m\u1ea1ng l\u01b0\u1edbi botnet Kimwolf \u2013 m\u1ed9t bi\u1ebfn th\u1ec3 nguy hi\u1ec3m c\u1ee7a AISURU \u2013 chuy\u00ean nh\u1eafm v\u00e0o c\u00e1c thi\u1ebft b\u1ecb IoT nh\u01b0 khung \u1ea3nh k\u1ef9 thu\u1eadt s\u1ed1, webcam v\u00e0 c\u00e1c \u0111\u1ea7u thu Android TV (TV Box).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">D\u00f9 Butler t\u1eebng ph\u1ee7 nh\u1eadn s\u1ef1 li\u00ean quan v\u00e0 cho r\u1eb1ng t\u00e0i kho\u1ea3n c\u0169 c\u1ee7a m\u00ecnh b\u1ecb chi\u1ebfm quy\u1ec1n, c\u00e1c b\u1eb1ng ch\u1ee9ng t\u1eeb \u0111\u1ecba ch\u1ec9 IP, h\u1ed3 s\u01a1 tin nh\u1eafn Discord v\u00e0 c\u00e1c t\u00e0i kho\u1ea3n tr\u1ef1c tuy\u1ebfn \u0111\u00e3 tr\u1ef1c ti\u1ebfp li\u00ean k\u1ebft anh ta v\u1edbi vai tr\u00f2 \u0111i\u1ec1u h\u00e0nh m\u1ea1ng l\u01b0\u1edbi t\u1ed9i ph\u1ea1m n\u00e0y.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ph\u01b0\u01a1ng th\u1ee9c t\u1ea5n c\u00f4ng tinh vi: Bi\u1ebfn thi\u1ebft b\u1ecb ng\u01b0\u1eddi d\u00f9ng th\u00e0nh &#8220;Residential Proxy&#8221;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u0110i\u1ec3m kh\u00e1c bi\u1ec7t c\u1ee7a Kimwolf so v\u1edbi c\u00e1c botnet truy\u1ec1n th\u1ed1ng l\u00e0 kh\u1ea3 n\u0103ng &#8220;n\u00f4 d\u1ecbch&#8221; thi\u1ebft b\u1ecb th\u00f4ng qua c\u00e1c d\u1ecbch v\u1ee5 Proxy d\u00e2n c\u01b0 (Residential Proxy). Thay v\u00ec ch\u1ec9 \u0111\u01a1n thu\u1ea7n l\u00e2y nhi\u1ec5m virus, Kimwolf s\u1eed d\u1ee5ng b\u1ed9 c\u00f4ng c\u1ee5 SDK mang t\u00ean ByteConnect (th\u01b0\u1eddng \u0111i k\u00e8m trong c\u00e1c \u1ee9ng d\u1ee5ng r\u00e1c ho\u1eb7c ph\u1ea7n m\u1ec1m c\u00e0i s\u1eb5n tr\u00ean TV Box gi\u00e1 r\u1ebb) \u0111\u1ec3 bi\u1ebfn thi\u1ebft b\u1ecb th\u00e0nh m\u1ed9t n\u00fat trung gian.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Botnet n\u00e0y \u0111\u1eb7c bi\u1ec7t nh\u1eafm v\u00e0o c\u00e1c thi\u1ebft b\u1ecb c\u00f3 d\u1ecbch v\u1ee5 <strong>Android Debug Bridge (ADB)<\/strong> \u0111\u1ec3 h\u1edf. B\u1eb1ng c\u00e1ch chui qua c\u00e1c m\u1ea1ng proxy d\u00e2n c\u01b0, hacker c\u00f3 th\u1ec3 v\u01b0\u1ee3t qua t\u01b0\u1eddng l\u1eeda v\u00e0 x\u00e2m nh\u1eadp s\u00e2u v\u00e0o m\u1ea1ng n\u1ed9i b\u1ed9 c\u1ee7a ng\u01b0\u1eddi d\u00f9ng, t\u1eeb \u0111\u00f3 ti\u1ebfp t\u1ee5c ph\u00e1t t\u00e1n m\u00e3 \u0111\u1ed9c sang c\u00e1c thi\u1ebft b\u1ecb kh\u00e1c trong c\u00f9ng m\u1ea1ng.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Nh\u1eefng con s\u1ed1 g\u00e2y s\u1ed1c<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>2.000.000+<\/strong>: S\u1ed1 l\u01b0\u1ee3ng thi\u1ebft b\u1ecb Android v\u00e0 IoT b\u1ecb l\u00e2y nhi\u1ec5m.<\/li>\n\n\n\n<li><strong>31,4 Tbps<\/strong>: L\u01b0u l\u01b0\u1ee3ng t\u1ea5n c\u00f4ng DDoS \u0111\u1ec9nh \u0111i\u1ec3m m\u00e0 botnet n\u00e0y c\u00f3 th\u1ec3 t\u1ea1o ra \u2013 m\u1ed9t con s\u1ed1 k\u1ef7 l\u1ee5c trong l\u1ecbch s\u1eed an ninh m\u1ea1ng.<\/li>\n\n\n\n<li><strong>25.000+<\/strong>: S\u1ed1 l\u01b0\u1ee3ng l\u1ec7nh t\u1ea5n c\u00f4ng \u0111\u00e3 \u0111\u01b0\u1ee3c ph\u00e1t \u0111i t\u1eeb c\u00e1c m\u00e1y ch\u1ee7 \u0111i\u1ec1u khi\u1ec3n (C2).<\/li>\n\n\n\n<li><strong>25%<\/strong>: T\u1ef7 l\u1ec7 kh\u00e1ch h\u00e0ng doanh nghi\u1ec7p c\u1ee7a Infoblox t\u1eebng b\u1ecb thi\u1ebft b\u1ecb trong m\u1ea1ng qu\u00e9t b\u1edfi botnet Kimwolf.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">M\u00f4 h\u00ecnh &#8220;Cybercrime-as-a-service&#8221;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Kimwolf kh\u00f4ng ch\u1ec9 d\u00f9ng \u0111\u1ec3 t\u1ea5n c\u00f4ng DDoS m\u00e0 c\u00f2n ho\u1ea1t \u0111\u1ed9ng nh\u01b0 m\u1ed9t d\u1ecbch v\u1ee5 cho thu\u00ea (DDoS-for-hire). Butler v\u00e0 c\u00e1c \u0111\u1ed3ng ph\u1ea1m \u0111\u00e3 b\u00e1n quy\u1ec1n truy c\u1eadp v\u00e0o c\u00e1c thi\u1ebft b\u1ecb b\u1ecb chi\u1ebfm quy\u1ec1n cho c\u00e1c nh\u00f3m t\u1ed9i ph\u1ea1m m\u1ea1ng kh\u00e1c th\u00f4ng qua server Discord <code>resi.to<\/code>. C\u00e1c v\u1ee5 t\u1ea5n c\u00f4ng t\u1eeb botnet n\u00e0y \u0111\u00e3 nh\u1eafm v\u00e0o nhi\u1ec1u m\u1ee5c ti\u00eau quan tr\u1ecdng, bao g\u1ed3m c\u1ea3 m\u1ea1ng l\u01b0\u1edbi th\u00f4ng tin c\u1ee7a B\u1ed9 Qu\u1ed1c ph\u00f2ng M\u1ef9 (DoDIN).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">L\u1eddi khuy\u00ean cho ng\u01b0\u1eddi d\u00f9ng<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">V\u1ee5 tri\u1ec7t ph\u00e1 Kimwolf l\u00e0 l\u1eddi c\u1ea3nh b\u00e1o m\u1ea1nh m\u1ebd v\u1ec1 an ninh cho c\u00e1c thi\u1ebft b\u1ecb IoT. \u0110\u1ec3 t\u1ef1 b\u1ea3o v\u1ec7, ng\u01b0\u1eddi d\u00f9ng n\u00ean:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>T\u1eaft d\u1ecbch v\u1ee5 ADB<\/strong> tr\u00ean c\u00e1c thi\u1ebft b\u1ecb Android TV n\u1ebfu kh\u00f4ng s\u1eed d\u1ee5ng.<\/li>\n\n\n\n<li><strong>H\u1ea1n ch\u1ebf s\u1eed d\u1ee5ng c\u00e1c TV Box<\/strong> ho\u1eb7c thi\u1ebft b\u1ecb IoT kh\u00f4ng r\u00f5 ngu\u1ed3n g\u1ed1c, gi\u00e1 r\u1ebb tr\u00f4i n\u1ed5i tr\u00ean th\u1ecb tr\u01b0\u1eddng.<\/li>\n\n\n\n<li><strong>C\u1eadp nh\u1eadt firmware<\/strong> th\u01b0\u1eddng xuy\u00ean cho c\u00e1c thi\u1ebft b\u1ecb th\u00f4ng minh trong gia \u0111\u00ecnh.<\/li>\n\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">N\u1ebfu b\u1ecb k\u1ebft \u00e1n, Jacob Butler c\u00f3 th\u1ec3 \u0111\u1ed1i m\u1eb7t v\u1edbi m\u1ee9c \u00e1n l\u00ean t\u1edbi 10 n\u0103m t\u00f9 giam.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8212;<br><em>VNCyberS t\u1ed5ng h\u1ee3p t\u1eeb The Hacker News, Krebs on Security v\u00e0 DoJ.<\/em><\/p>","protected":false},"excerpt":{"rendered":"<p>C\u1ea3nh s\u00e1t M\u1ef9 v\u00e0 Canada v\u1eeba ph\u1ed1i h\u1ee3p tri\u1ec7t ph\u00e1 th\u00e0nh c\u00f4ng h\u1ea1 t\u1ea7ng c\u1ee7a botnet Kimwolf v\u00e0 b\u1eaft gi\u1eef Jacob Butler, qu\u1ea3n tr\u1ecb vi\u00ean 23 tu\u1ed5i \u0111\u1ee9ng sau m\u1ea1ng l\u01b0\u1edbi l\u00e2y nhi\u1ec5m h\u01a1n 2 tri\u1ec7u thi\u1ebft b\u1ecb Android v\u00e0 IoT tr\u00ean to\u00e0n c\u1ea7u. Cu\u1ed9c b\u1eaft gi\u1eef t\u1ea1i Ottawa v\u00e0 ch\u00e2n dung qu\u1ea3n tr\u1ecb vi\u00ean [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1252,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1249","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1249","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1249"}],"version-history":[{"count":1,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1249\/revisions"}],"predecessor-version":[{"id":1251,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1249\/revisions\/1251"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1252"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1249"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1249"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1249"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}