{"id":1372,"date":"2026-06-01T02:30:03","date_gmt":"2026-05-31T19:30:03","guid":{"rendered":"https:\/\/vncybers.vn\/hacker-khai-thac-lo-hong-forticlient-ems-de-phat-tan-ma-doc-danh-cap-du-lieu-ekz\/"},"modified":"2026-06-01T03:19:03","modified_gmt":"2026-05-31T20:19:03","slug":"hacker-khai-thac-lo-hong-forticlient-ems-de-phat-tan-ma-doc-danh-cap-du-lieu-ekz","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/hacker-khai-thac-lo-hong-forticlient-ems-de-phat-tan-ma-doc-danh-cap-du-lieu-ekz\/","title":{"rendered":"Hacker khai th\u00e1c l\u1ed7 h\u1ed5ng FortiClient EMS \u0111\u1ec3 ph\u00e1t t\u00e1n m\u00e3 \u0111\u1ed9c \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u EKZ"},"content":{"rendered":"

M\u1ed9t chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng quy m\u00f4 l\u1edbn nh\u1eafm v\u00e0o c\u00e1c doanh nghi\u1ec7p s\u1eed d\u1ee5ng gi\u1ea3i ph\u00e1p qu\u1ea3n l\u00fd t\u1eadp trung FortiClient Endpoint Management Server (EMS)<\/strong> \u0111ang di\u1ec5n ra s\u00f4i n\u1ed7. K\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 l\u1ee3i d\u1ee5ng l\u1ed7 h\u1ed5ng ki\u1ec3m so\u00e1t truy c\u1eadp nghi\u00eam tr\u1ecdng \u0111\u1ec3 tri\u1ec3n khai m\u1ed9t lo\u1ea1i m\u00e3 \u0111\u1ed9c \u0111\u00e1nh c\u1eafp th\u00f4ng tin m\u1edbi mang t\u00ean EKZ Infostealer<\/strong>.<\/p>\n

\"Fortinet<\/p>\n

L\u1ed7 h\u1ed5ng CVE-2026-35616: C\u00e1nh c\u1eeda kh\u00f4ng kh\u00f3a<\/h2>\n

Vulnerability CVE-2026-35616<\/strong> (\u0111i\u1ec3m CVSS 9.1) l\u00e0 m\u1ed9t l\u1ed7i b\u1ecf qua x\u00e1c th\u1ef1c API (pre-authentication API access bypass). N\u00f3 cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng ch\u01b0a \u0111\u01b0\u1ee3c x\u00e1c th\u1ef1c g\u1eedi c\u00e1c y\u00eau c\u1ea7u \u0111\u1eb7c quy\u1ec1n tr\u1ef1c ti\u1ebfp \u0111\u1ebfn m\u00e1y ch\u1ee7 FortiClient EMS.<\/p>\n

Thay v\u00ec ph\u1ea3i \u0111\u1ed9t nh\u1eadp v\u00e0o t\u1eebng m\u00e1y t\u00ednh ri\u00eang l\u1ebb, tin t\u1eb7c ch\u1ec9 c\u1ea7n chi\u1ebfm quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n c\u1ea5u h\u00ecnh tr\u00ean m\u00e1y ch\u1ee7 EMS. T\u1eeb \u0111\u00f3, m\u1ecdi thi\u1ebft b\u1ecb \u0111\u1ea7u cu\u1ed1i (endpoint) n\u1eb1m d\u01b0\u1edbi quy\u1ec1n qu\u1ea3n l\u00fd c\u1ee7a m\u00e1y ch\u1ee7 n\u00e0y \u0111\u1ec1u tr\u1edf th\u00e0nh m\u1ee5c ti\u00eau th\u1ef1c thi m\u00e3 \u0111\u1ed9c t\u1ef1 \u0111\u1ed9ng th\u00f4ng qua c\u00e1c k\u1ecbch b\u1ea3n qu\u1ea3n tr\u1ecb tin c\u1eady.<\/p>\n

EKZ Infostealer: K\u1ebb tr\u1ed9m \u1ea9n m\u00ecnh d\u01b0\u1edbi l\u1edbp v\u1ecf “B\u1ea3n v\u00e1”<\/h2>\n

Theo ph\u00e2n t\u00edch t\u1eeb Arctic Wolf<\/em>, m\u00e3 \u0111\u1ed9c \u0111\u01b0\u1ee3c tri\u1ec3n khai d\u01b0\u1edbi d\u1ea1ng m\u1ed9t t\u1ec7p th\u1ef1c thi mang t\u00ean FortiEndpoint_Patch.exe<\/code> \u0111\u1ec3 \u0111\u00e1nh l\u1eeba ng\u01b0\u1eddi d\u00f9ng v\u00e0 qu\u1ea3n tr\u1ecb vi\u00ean. Quy tr\u00ecnh t\u1ea5n c\u00f4ng di\u1ec5n ra nh\u01b0 sau:<\/p>\n

    \n
  • Khai th\u00e1c:<\/strong> Tin t\u1eb7c truy c\u1eadp API tr\u00e1i ph\u00e9p \u0111\u1ec3 ch\u1ec9nh s\u1eeda h\u1ed3 s\u01a1 truy c\u1eadp t\u1eeb xa (Remote Access Profile).<\/li>\n
  • K\u00edch ho\u1ea1t:<\/strong> Ngay khi ng\u01b0\u1eddi d\u00f9ng k\u1ebft n\u1ed1i VPN th\u00f4ng qua FortiClient, m\u1ed9t t\u1ec7p l\u1ec7nh .cmd<\/code> s\u1ebd t\u1ef1 \u0111\u1ed9ng th\u1ef1c thi.<\/li>\n
  • Tri\u1ec3n khai:<\/strong> L\u1ec7nh n\u00e0y g\u1ecdi PowerShell \u0111\u1ec3 t\u1ea3i v\u1ec1 v\u00e0 ch\u1ea1y m\u00e3 \u0111\u1ed9c EKZ Infostealer t\u1eeb m\u00e1y ch\u1ee7 c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng.<\/li>\n<\/ul>\n

    Kh\u1ea3 n\u0103ng \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u v\u01b0\u1ee3t tr\u1ed9i<\/h3>\n

    EKZ Infostealer \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf chuy\u00ean bi\u1ec7t \u0111\u1ec3 v\u00e9t s\u1ea1ch d\u1eef li\u1ec7u t\u1eeb c\u00e1c tr\u00ecnh duy\u1ec7t ph\u1ed5 bi\u1ebfn nh\u01b0 Chrome, Edge v\u00e0 Firefox. M\u00e3 \u0111\u1ed9c n\u00e0y c\u00f3 kh\u1ea3 n\u0103ng:<\/p>\n

      \n
    • Gi\u1ea3i m\u00e3 c\u00e1c m\u1eadt kh\u1ea9u \u0111\u01b0\u1ee3c l\u01b0u tr\u1eef b\u1eb1ng k\u1ef9 thu\u1eadt v\u01b0\u1ee3t qua c\u01a1 ch\u1ebf b\u1ea3o m\u1eadt c\u1ee7a Chrome.<\/li>\n
    • \u0110\u00e1nh c\u1eafp Cookie phi\u00ean l\u00e0m vi\u1ec7c (Session Cookies), cho ph\u00e9p tin t\u1eb7c m\u1ea1o danh ng\u01b0\u1eddi d\u00f9ng \u0111\u1ec3 truy c\u1eadp v\u00e0o c\u00e1c d\u1ecbch v\u1ee5 Cloud m\u00e0 kh\u00f4ng c\u1ea7n qua x\u00e1c th\u1ef1c \u0111a y\u1ebfu t\u1ed1 (MFA).<\/li>\n
    • Thu th\u1eadp th\u00f4ng tin t\u1ef1 \u0111\u1ed9ng \u0111i\u1ec1n (Autofill) nh\u01b0 s\u1ed1 th\u1ebb t\u00edn d\u1ee5ng, \u0111\u1ecba ch\u1ec9 v\u00e0 s\u1ed1 \u0111i\u1ec7n tho\u1ea1i.<\/li>\n<\/ul>\n

      \"EKZ<\/p>\n

      Khuy\u1ebfn ngh\u1ecb ph\u00f2ng v\u1ec7 kh\u1ea9n c\u1ea5p<\/h2>\n

      Chi\u1ebfn d\u1ecbch n\u00e0y cho th\u1ea5y xu h\u01b0\u1edbng t\u1ed9i ph\u1ea1m m\u1ea1ng \u0111ang chuy\u1ec3n d\u1ecbch sang t\u1ea5n c\u00f4ng c\u00e1c n\u1ec1n t\u1ea3ng qu\u1ea3n tr\u1ecb t\u1eadp trung \u0111\u1ec3 t\u1ed1i \u0111a h\u00f3a thi\u1ec7t h\u1ea1i. C\u00e1c t\u1ed5 ch\u1ee9c c\u1ea7n th\u1ef1c hi\u1ec7n ngay:<\/p>\n

        \n
      • C\u1eadp nh\u1eadt ngay l\u1eadp t\u1ee9c:<\/strong> N\u00e2ng c\u1ea5p FortiClient EMS l\u00ean phi\u00ean b\u1ea3n m\u1edbi nh\u1ea5t \u0111\u00e3 \u0111\u01b0\u1ee3c v\u00e1 l\u1ed7i theo h\u01b0\u1edbng d\u1eabn c\u1ee7a Fortinet.<\/li>\n
      • H\u1ea1n ch\u1ebf truy c\u1eadp:<\/strong> Ch\u1ec9 cho ph\u00e9p c\u00e1c d\u1ea3i IP tin c\u1eady truy c\u1eadp v\u00e0o c\u1ed5ng qu\u1ea3n tr\u1ecb c\u1ee7a EMS (m\u1eb7c \u0111\u1ecbnh l\u00e0 c\u1ed5ng 8013).<\/li>\n
      • Gi\u00e1m s\u00e1t h\u1ec7 th\u1ed1ng:<\/strong> R\u00e0 so\u00e1t nh\u1eadt k\u00fd (logs) \u0111\u1ec3 t\u00ecm c\u00e1c th\u00f4ng b\u00e1o l\u1ed7i li\u00ean quan \u0111\u1ebfn x\u00e1c th\u1ef1c ch\u1ee9ng ch\u1ec9 (Certificate user: fortinet-ca2) v\u00e0 c\u00e1c thay \u0111\u1ed5i c\u1ea5u h\u00ecnh VPN b\u1ea5t th\u01b0\u1eddng.<\/li>\n<\/ul>\n

        VNCyberS<\/em><\/strong>
        T\u1ed5ng h\u1ee3p t\u1eeb BleepingComputer v\u00e0 Arctic Wolf<\/em><\/p>","protected":false},"excerpt":{"rendered":"

        M\u1ed9t chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng quy m\u00f4 l\u1edbn nh\u1eafm v\u00e0o c\u00e1c doanh nghi\u1ec7p s\u1eed d\u1ee5ng gi\u1ea3i ph\u00e1p qu\u1ea3n l\u00fd t\u1eadp trung FortiClient Endpoint Management Server (EMS) \u0111ang di\u1ec5n ra s\u00f4i n\u1ed7. K\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 l\u1ee3i d\u1ee5ng l\u1ed7 h\u1ed5ng ki\u1ec3m so\u00e1t truy c\u1eadp nghi\u00eam tr\u1ecdng \u0111\u1ec3 tri\u1ec3n khai m\u1ed9t lo\u1ea1i m\u00e3 \u0111\u1ed9c \u0111\u00e1nh c\u1eafp th\u00f4ng […]<\/p>\n","protected":false},"author":2,"featured_media":1384,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1372","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1372","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1372"}],"version-history":[{"count":14,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1372\/revisions"}],"predecessor-version":[{"id":1444,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1372\/revisions\/1444"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1384"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1372"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1372"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1372"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}