{"id":1318,"date":"2026-05-25T17:46:56","date_gmt":"2026-05-25T10:46:56","guid":{"rendered":"https:\/\/vncybers.vn\/ho-so-operation-saffron-dau-cham-het-cho-de-che-first-vpn\/"},"modified":"2026-05-26T15:57:56","modified_gmt":"2026-05-26T08:57:56","slug":"ho-so-operation-saffron-dau-cham-het-cho-de-che-first-vpn","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/ho-so-operation-saffron-dau-cham-het-cho-de-che-first-vpn\/","title":{"rendered":"H\u1ed3 s\u01a1 Operation Saffron: D\u1ea5u ch\u1ea5m h\u1ebft cho \u0111\u1ebf ch\u1ebf First VPN"},"content":{"rendered":"

Chi\u1ebfn d\u1ecbch Operation Saffron<\/strong> l\u00e0 m\u1ed9t cu\u1ed9c v\u00e2y r\u00e1p xuy\u00ean l\u1ee5c \u0111\u1ecba quy m\u00f4 l\u1edbn, \u0111\u00e1nh s\u1eadp m\u1ed9t trong nh\u1eefng c\u00f4ng c\u1ee5 \u0111\u1eafc l\u1ef1c nh\u1ea5t c\u1ee7a gi\u1edbi t\u1ed9i ph\u1ea1m m\u1ea1ng: First VPN<\/strong>.<\/p>\n

1. B\u00f3ng Ma Trong M\u1ea1ng L\u01b0\u1edbi An Ninh<\/h3>\n
\"Cu\u1ed9c
Chi\u1ebfn d\u1ecbch Operation Saffron \u0111\u00e3 tri\u1ec7t ph\u00e1 h\u1ea1 t\u1ea7ng First VPN ph\u1ee5c v\u1ee5 ransomware xuy\u00ean qu\u1ed1c gia.<\/figcaption><\/figure>\n

Trong su\u1ed1t m\u1ed9t th\u1eadp k\u1ef7 qua, k\u1ec3 t\u1eeb n\u0103m 2014, gi\u1edbi hacker m\u0169 \u0111en v\u00e0 c\u00e1c nh\u00f3m ransomware kh\u00e9t ti\u1ebfng nh\u01b0 Avaddon<\/strong> \u0111\u00e3 r\u1ec9 tai nhau v\u1ec1 m\u1ed9t “thi\u00ean \u0111\u01b0\u1eddng an to\u00e0n” mang t\u00ean First VPN. V\u1edbi l\u1eddi h\u1ee9a ch\u1eafc n\u1ecbch: “Kh\u00f4ng l\u01b0u log, kh\u00f4ng h\u1ee3p t\u00e1c v\u1edbi c\u01a1 quan \u0111i\u1ec1u tra, v\u00e0 \u0111\u1ee9ng ngo\u00e0i m\u1ecdi quy\u1ec1n t\u00e0i ph\u00e1n”<\/em>, First VPN \u0111\u00e3 tr\u1edf th\u00e0nh “chi\u1ebfc \u00e1o cho\u00e0ng t\u00e0ng h\u00ecnh” cho h\u01a1n 25 nh\u00f3m ransomware th\u1ef1c hi\u1ec7n c\u00e1c phi v\u1ee5 t\u1ed1ng ti\u1ec1n, \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u v\u00e0 t\u1ea5n c\u00f4ng DDoS tr\u00ean to\u00e0n c\u1ea7u.<\/p>\n

H\u1ec7 th\u1ed1ng c\u1ee7a First VPN kh\u00f4ng \u0111\u01a1n gi\u1ea3n ch\u1ec9 l\u00e0 v\u00e0i m\u00e1y ch\u1ee7 c\u1ea5u h\u00ecnh s\u1eb5n. Ch\u00fang thi\u1ebft l\u1eadp m\u1ed9t h\u1ea1 t\u1ea7ng tinh vi v\u1edbi 32 exit node tr\u1ea3i kh\u1eafp 27 qu\u1ed1c gia. \u0110i\u1ec3m \u0111\u1eb7c bi\u1ec7t khi\u1ebfn c\u00e1c k\u1ef9 s\u01b0 an ninh \u0111au \u0111\u1ea7u ch\u00ednh l\u00e0 vi\u1ec7c s\u1eed d\u1ee5ng c\u00e1c giao th\u1ee9c VLESS<\/strong> v\u00e0 Reality<\/strong>. Nh\u1eefng giao th\u1ee9c n\u00e0y c\u00f3 kh\u1ea3 n\u0103ng “ng\u1ee5y trang” l\u01b0u l\u01b0\u1ee3ng VPN th\u00e0nh l\u01b0u l\u01b0\u1ee3ng HTTPS th\u00f4ng th\u01b0\u1eddng qua c\u00e1c c\u1ed5ng ti\u00eau chu\u1ea9n, khi\u1ebfn c\u00e1c h\u1ec7 th\u1ed1ng gi\u00e1m s\u00e1t m\u1ea1ng g\u1ea7n nh\u01b0 b\u1ea5t l\u1ef1c trong vi\u1ec7c nh\u1eadn di\u1ec7n.<\/p>\n

2. Operation Saffron: Cu\u1ed9c S\u0103n \u0110u\u1ed5i \u00c2m Th\u1ea7m<\/h3>\n

Nh\u01b0ng “l\u01b0\u1edbi tr\u1eddi l\u1ed3ng l\u1ed9ng”, t\u1eeb th\u00e1ng 12\/2021, m\u1ed9t li\u00ean minh c\u1ea3nh s\u00e1t g\u1ed3m Ph\u00e1p v\u00e0 H\u00e0 Lan, v\u1edbi s\u1ef1 h\u1ed7 tr\u1ee3 c\u1ee7a 18 qu\u1ed1c gia kh\u00e1c (bao g\u1ed3m c\u1ea3 M\u1ef9, Anh, \u0110\u1ee9c, v\u00e0 Ukraine), \u0111\u00e3 b\u1eaft \u0111\u1ea7u chi\u1ebfn d\u1ecbch mang m\u1eadt danh Operation Saffron<\/strong>.<\/p>\n

Su\u1ed1t h\u01a1n 3 n\u0103m, c\u00e1c \u0111\u1eb7c v\u1ee5 \u0111\u00e3 \u00e2m th\u1ea7m l\u1ea7n theo d\u1ea5u v\u1ebft d\u00f2ng ti\u1ec1n (Bitcoin, Perfect Money…) v\u00e0 c\u00e1c \u0111i\u1ec3m y\u1ebfu trong h\u1ea1 t\u1ea7ng c\u1ee7a d\u1ecbch v\u1ee5 n\u00e0y. B\u01b0\u1edbc ngo\u1eb7t x\u1ea3y ra v\u00e0o ng\u00e0y 19-20\/05\/2026, khi m\u1ed9t cu\u1ed9c t\u1eadp k\u00edch \u0111\u1ed3ng lo\u1ea1t di\u1ec5n ra tr\u00ean nhi\u1ec1u m\u1eb7t tr\u1eadn:<\/p>\n

    \n
      \n
    • T\u1ea1i Ukraine:<\/strong> C\u1ea3nh s\u00e1t \u0111\u00e3 \u0111\u1ed9t k\u00edch nh\u00e0 ri\u00eang c\u1ee7a qu\u1ea3n tr\u1ecb vi\u00ean h\u1ec7 th\u1ed1ng, thu gi\u1eef nhi\u1ec1u thi\u1ebft b\u1ecb quan tr\u1ecdng.<\/li>\n
    • Tr\u00ean to\u00e0n c\u1ea7u:<\/strong> 33 m\u00e1y ch\u1ee7 ch\u00ednh \u0111\u00e3 b\u1ecb \u0111\u00e1nh s\u1eadp v\u00e0 t\u1ecbch thu. C\u00e1c t\u00ean mi\u1ec1n ch\u00ednh nh\u01b0 `1vpns[.]com`, `1vpns[.]net`, `1vpns[.]org` c\u00f9ng h\u00e0ng lo\u1ea1t domain Onion tr\u00ean m\u1ea1ng Tor \u0111\u00e3 b\u1ecb ki\u1ec3m so\u00e1t ho\u00e0n to\u00e0n.<\/li>\n<\/ul>\n<\/ul>\n

      3. C\u00e1i Gi\u00e1 C\u1ee7a S\u1ef1 \u1ea2o T\u01b0\u1edfng<\/h3>\n

      S\u1ef1 ho\u1ea3ng lo\u1ea1n c\u1ee7a nh\u1eefng k\u1ebb \u0111ang \u1ea9n n\u1ea5p sau “t\u1ea5m khi\u00ean” n\u00e0y khi nh\u1eadn \u0111\u01b0\u1ee3c th\u00f4ng b\u00e1o: “D\u1ecbch v\u1ee5 \u0111\u00e3 b\u1ecb \u0111\u00e1nh s\u1eadp v\u00e0 danh t\u00ednh c\u1ee7a b\u1ea1n hi\u1ec7n \u0111\u00e3 n\u1eb1m trong tay c\u01a1 quan ch\u1ee9c n\u0103ng”<\/em>. C\u00f4ng ty an ninh m\u1ea1ng Bitdefender \u0111\u00e3 chia s\u1ebb th\u00f4ng tin li\u00ean quan \u0111\u1ebfn 506 ng\u01b0\u1eddi d\u00f9ng d\u1ecbch v\u1ee5 n\u00e0y cho Europol.<\/p>\n

      C\u01a1 c\u1ea5u gi\u00e1 c\u1ee7a First VPN c\u0169ng ph\u1ea3n \u00e1nh s\u1ef1 chuy\u00ean nghi\u1ec7p trong “kinh doanh t\u1ed9i ph\u1ea1m”: t\u1eeb $2 cho 1 ng\u00e0y tr\u1ea3i nghi\u1ec7m \u0111\u1ebfn $483 cho g\u00f3i thu\u00ea bao n\u0103m. Nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 d\u1ec5 d\u00e0ng mua quy\u1ec1n truy c\u1eadp \u0111\u1ec3 \u1ea9n m\u00ecnh ch\u1ec9 trong v\u00e0i ph\u00fat.<\/p>\n

      4. G\u00f3c Khu\u1ea5t: Khi “T\u1ea5m Khi\u00ean” S\u1ee5p \u0110\u1ed5<\/h3>\n

      \u0110\u1eb1ng sau nh\u1eefng d\u00f2ng code tinh vi v\u00e0 h\u1ea1 t\u1ea7ng VPN t\u00e0ng h\u00ecnh l\u00e0 nh\u1eefng con ng\u01b0\u1eddi b\u1eb1ng x\u01b0\u01a1ng b\u1eb1ng th\u1ecbt. Cu\u1ed9c \u0111\u1ed9t k\u00edch t\u1ea1i Ukraine kh\u00f4ng ch\u1ec9 thu gi\u1eef m\u00e1y m\u00f3c, m\u00e0 c\u00f2n \u0111\u1eb7t d\u1ea5u ch\u1ea5m h\u1ebft cho cu\u1ed9c s\u1ed1ng “hai m\u1eb7t” c\u1ee7a c\u00e1c qu\u1ea3n tr\u1ecb vi\u00ean. Nh\u1eefng k\u1ebb \u0111i\u1ec1u h\u00e0nh n\u00e0y th\u01b0\u1eddng s\u1ed1ng gi\u1eefa c\u1ed9ng \u0111\u1ed3ng nh\u01b0 nh\u1eefng k\u1ef9 s\u01b0 c\u00f4ng ngh\u1ec7 b\u00ecnh th\u01b0\u1eddng, cho \u0111\u1ebfn khi th\u1ef1c t\u1ebf \u1eadp \u0111\u1ebfn d\u01b0\u1edbi h\u00ecnh h\u00e0i c\u1ee7a l\u1ec7nh b\u1eaft gi\u1eef.<\/p>\n

      H\u1ec7 l\u1ee5y kh\u00f4ng ch\u1ec9 l\u00e0 c\u00e1c m\u00e1y ch\u1ee7 b\u1ecb t\u1ecbch thu, m\u00e0 c\u00f2n l\u00e0 s\u1ef1 s\u1ee5p \u0111\u1ed5 c\u1ee7a m\u1ed9t \u1ea3o t\u01b0\u1edfng v\u1ec1 s\u1ef1 \u1ea9n danh tuy\u1ec7t \u0111\u1ed1i. V\u1edbi gia \u0111\u00ecnh v\u00e0 ng\u01b0\u1eddi th\u00e2n c\u1ee7a nh\u1eefng k\u1ebb \u0111i\u1ec1u h\u00e0nh, \u0111\u00e2y l\u00e0 m\u1ed9t c\u00fa s\u1ed1c l\u1edbn khi b\u1ee9c m\u00e0n b\u00ed m\u1eadt b\u1ecb v\u00e9n l\u00ean, \u0111\u1ec3 l\u1ed9 nh\u1eefng ho\u1ea1t \u0111\u1ed9ng phi ph\u00e1p n\u00fap b\u00f3ng d\u01b0\u1edbi danh ngh\u0129a chuy\u00ean gia CNTT. B\u00e0i h\u1ecdc r\u00fat ra l\u00e0: Trong th\u1ebf gi\u1edbi s\u1ed1, kh\u00f4ng c\u00f3 b\u00f3ng t\u1ed1i n\u00e0o l\u00e0 v\u0129nh vi\u1ec5n tr\u01b0\u1edbc s\u1ef1 h\u1ee3p t\u00e1c qu\u1ed1c t\u1ebf.<\/p>\n

      5. K\u1ebft Lu\u1eadn<\/h3>\n

      Vi\u1ec7c tri\u1ec7t ph\u00e1 First VPN l\u00e0 m\u1ed9t \u0111\u00f2n gi\u00e1ng m\u1ea1nh v\u00e0o h\u1ec7 sinh th\u00e1i t\u1ed9i ph\u1ea1m m\u1ea1ng. Nh\u01b0 Bitdefender \u0111\u00e3 nh\u1eadn \u0111\u1ecbnh: “M\u1ed7i khi m\u1ed9t d\u1ecbch v\u1ee5 \u1ea9n danh b\u1ecb \u0111\u00e1nh s\u1eadp, chi ph\u00ed v\u1eadn h\u00e0nh c\u1ee7a t\u1ed9i ph\u1ea1m l\u1ea1i t\u0103ng l\u00ean v\u00e0 c\u1eeda s\u1ed5 ho\u1ea1t \u0111\u1ed9ng c\u1ee7a ch\u00fang l\u1ea1i h\u1eb9p d\u1ea7n”<\/em>.<\/p>\n

      Tuy nhi\u00ean, cu\u1ed9c chi\u1ebfn n\u00e0y ch\u01b0a bao gi\u1edd k\u1ebft th\u00fac. Khi m\u1ed9t \u0111\u1ebf ch\u1ebf s\u1ee5p \u0111\u1ed5, nh\u1eefng b\u00f3ng ma kh\u00e1c s\u1ebd s\u1edbm xu\u1ea5t hi\u1ec7n. Nh\u01b0ng Operation Saffron \u0111\u00e3 ch\u1ee9ng minh m\u1ed9t \u0111i\u1ec1u: Kh\u00f4ng c\u00f3 t\u1ea5m khi\u00ean n\u00e0o l\u00e0 tuy\u1ec7t \u0111\u1ed1i tr\u01b0\u1edbc s\u1ee9c m\u1ea1nh c\u1ee7a s\u1ef1 h\u1ee3p t\u00e1c qu\u1ed1c t\u1ebf.<\/p>\n","protected":false},"excerpt":{"rendered":"

      Chi\u1ebfn d\u1ecbch Operation Saffron l\u00e0 m\u1ed9t cu\u1ed9c v\u00e2y r\u00e1p xuy\u00ean l\u1ee5c \u0111\u1ecba quy m\u00f4 l\u1edbn, \u0111\u00e1nh s\u1eadp m\u1ed9t trong nh\u1eefng c\u00f4ng c\u1ee5 \u0111\u1eafc l\u1ef1c nh\u1ea5t c\u1ee7a gi\u1edbi t\u1ed9i ph\u1ea1m m\u1ea1ng: First VPN. 1. B\u00f3ng Ma Trong M\u1ea1ng L\u01b0\u1edbi An Ninh Chi\u1ebfn d\u1ecbch Operation Saffron \u0111\u00e3 tri\u1ec7t ph\u00e1 h\u1ea1 t\u1ea7ng First VPN ph\u1ee5c v\u1ee5 ransomware xuy\u00ean […]<\/p>\n","protected":false},"author":2,"featured_media":1324,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[147,140,142,139,138,146,43,145,141,143,144],"class_list":["post-1318","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-bitdefender","tag-cybersecurity","tag-europol","tag-first-vpn","tag-operation-saffron","tag-privacy","tag-ransomware","tag-reality-protocol","tag-takedown","tag-ukraine","tag-vless"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1318"}],"version-history":[{"count":5,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1318\/revisions"}],"predecessor-version":[{"id":1336,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1318\/revisions\/1336"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1324"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}