{"id":1577,"date":"2026-06-08T07:21:12","date_gmt":"2026-06-08T00:21:12","guid":{"rendered":"https:\/\/vncybers.vn\/gia-danh-ho-tro-it-khi-mot-cuoc-goi-co-the-mo-duong-cho-danh-cap-du-lieu\/"},"modified":"2026-06-08T07:22:20","modified_gmt":"2026-06-08T00:22:20","slug":"gia-danh-ho-tro-it-khi-mot-cuoc-goi-co-the-mo-duong-cho-danh-cap-du-lieu","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/gia-danh-ho-tro-it-khi-mot-cuoc-goi-co-the-mo-duong-cho-danh-cap-du-lieu\/","title":{"rendered":"Gi\u1ea3 danh h\u1ed7 tr\u1ee3 IT: Khi m\u1ed9t cu\u1ed9c g\u1ecdi c\u00f3 th\u1ec3 m\u1edf \u0111\u01b0\u1eddng cho \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u"},"content":{"rendered":"

C\u00e1c chi\u1ebfn d\u1ecbch t\u1ed1ng ti\u1ec1n d\u1eef li\u1ec7u \u0111ang thay \u0111\u1ed5i nhanh: thay v\u00ec ch\u1ec9 d\u1ef1a v\u00e0o m\u00e3 \u0111\u1ed9c, k\u1ebb t\u1ea5n c\u00f4ng ng\u00e0y c\u00e0ng khai th\u00e1c ni\u1ec1m tin c\u1ee7a nh\u00e2n vi\u00ean \u0111\u1ed1i v\u1edbi b\u1ed9 ph\u1eadn h\u1ed7 tr\u1ee3 k\u1ef9 thu\u1eadt. B\u00e1o c\u00e1o m\u1edbi c\u1ee7a Google Cloud\/Mandiant cho bi\u1ebft nh\u00f3m UNC3753, c\u00f2n \u0111\u01b0\u1ee3c bi\u1ebft \u0111\u1ebfn v\u1edbi c\u00e1c t\u00ean Silent Ransom Group, Luna Moth v\u00e0 Chatty Spider, \u0111\u00e3 nh\u1eafm v\u00e0o nhi\u1ec1u t\u1ed5 ch\u1ee9c d\u1ecbch v\u1ee5 ph\u00e1p l\u00fd, t\u00e0i ch\u00ednh v\u00e0 chuy\u00ean nghi\u1ec7p t\u1ea1i M\u1ef9 trong giai \u0111o\u1ea1n t\u1eeb th\u00e1ng 1 \u0111\u1ebfn th\u00e1ng 5\/2026.<\/p>\n

\"USB<\/p>\n

\u0110i\u1ec3m \u0111\u00e1ng ch\u00fa \u00fd l\u00e0 chu\u1ed7i t\u1ea5n c\u00f4ng kh\u00f4ng nh\u1ea5t thi\u1ebft b\u1eaft \u0111\u1ea7u b\u1eb1ng m\u1ed9t t\u1eadp tin \u0111\u1ed9c h\u1ea1i. Nhi\u1ec1u tr\u01b0\u1eddng h\u1ee3p m\u1edf \u0111\u1ea7u b\u1eb1ng email h\u00f3a \u0111\u01a1n c\u00f3 v\u1ebb v\u00f4 h\u1ea1i, sau \u0111\u00f3 l\u00e0 cu\u1ed9c g\u1ecdi gi\u1ea3 danh h\u1ed7 tr\u1ee3 IT nh\u1eb1m thuy\u1ebft ph\u1ee5c n\u1ea1n nh\u00e2n tham gia phi\u00ean chia s\u1ebb m\u00e0n h\u00ecnh, c\u00e0i c\u00f4ng c\u1ee5 qu\u1ea3n tr\u1ecb t\u1eeb xa ho\u1eb7c th\u1ef1c hi\u1ec7n thao t\u00e1c thay cho k\u1ebb t\u1ea5n c\u00f4ng.<\/p>\n

Vishing l\u00e0 g\u00ec v\u00e0 v\u00ec sao nguy hi\u1ec3m?<\/h2>\n

Vishing l\u00e0 h\u00ecnh th\u1ee9c l\u1eeba \u0111\u1ea3o qua tho\u1ea1i, trong \u0111\u00f3 k\u1ebb t\u1ea5n c\u00f4ng d\u00f9ng l\u1eddi n\u00f3i, \u00e1p l\u1ef1c th\u1eddi gian v\u00e0 b\u1ed1i c\u1ea3nh c\u00f3 v\u1ebb h\u1ee3p l\u00fd \u0111\u1ec3 khi\u1ebfn n\u1ea1n nh\u00e2n t\u1ef1 trao quy\u1ec1n truy c\u1eadp. V\u1edbi UNC3753, k\u1ecbch b\u1ea3n th\u01b0\u1eddng xoay quanh vi\u1ec7c x\u1eed l\u00fd s\u1ef1 c\u1ed1 b\u1ea3o m\u1eadt, h\u1ed7 tr\u1ee3 di chuy\u1ec3n d\u1eef li\u1ec7u ho\u1eb7c x\u00e1c minh m\u1ed9t email h\u00f3a \u0111\u01a1n \u0111\u00e1ng ng\u1edd.<\/p>\n

\u0110\u00e2y l\u00e0 d\u1ea1ng t\u1ea5n c\u00f4ng kh\u00f3 ph\u00e1t hi\u1ec7n n\u1ebfu t\u1ed5 ch\u1ee9c ch\u1ec9 d\u1ef1a v\u00e0o b\u1ed9 l\u1ecdc email ho\u1eb7c ph\u1ea7n m\u1ec1m ch\u1ed1ng m\u00e3 \u0111\u1ed9c. Khi nh\u00e2n vi\u00ean t\u1ef1 m\u1edf phi\u00ean Zoom, Microsoft Teams, Quick Assist, AnyDesk, Bomgar ho\u1eb7c Zoho Assist, l\u01b0u l\u01b0\u1ee3ng c\u00f3 th\u1ec3 tr\u00f4ng gi\u1ed1ng ho\u1ea1t \u0111\u1ed9ng h\u1ed7 tr\u1ee3 h\u1ee3p ph\u00e1p. K\u1ebb t\u1ea5n c\u00f4ng v\u00ec v\u1eady c\u00f3 th\u1ec3 v\u01b0\u1ee3t qua nhi\u1ec1u l\u1edbp ki\u1ec3m so\u00e1t k\u1ef9 thu\u1eadt b\u1eb1ng ch\u00ednh h\u00e0nh vi h\u1ee3p t\u00e1c c\u1ee7a n\u1ea1n nh\u00e2n.<\/p>\n

\"S\u01a1<\/p>\n

Chu\u1ed7i t\u1ea5n c\u00f4ng di\u1ec5n ra nh\u01b0 th\u1ebf n\u00e0o?<\/h2>\n

Theo Mandiant, nhi\u1ec1u v\u1ee5 vi\u1ec7c c\u00f3 nh\u1ecbp \u0111\u1ed9 r\u1ea5t nhanh: t\u1eeb l\u00fac li\u00ean h\u1ec7 ban \u0111\u1ea7u \u0111\u1ebfn khi t\u00ecm ki\u1ebfm, gom d\u1eef li\u1ec7u v\u00e0 g\u1eedi th\u01b0 t\u1ed1ng ti\u1ec1n c\u00f3 th\u1ec3 ch\u1ec9 di\u1ec5n ra trong c\u00f9ng m\u1ed9t ng\u00e0y l\u00e0m vi\u1ec7c. M\u1ed9t s\u1ed1 t\u00ecnh hu\u1ed1ng ghi nh\u1eadn ho\u1ea1t \u0111\u1ed9ng t\u00ecm ki\u1ebfm v\u00e0 \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u b\u1eaft \u0111\u1ea7u trong ch\u01b0a \u0111\u1ea7y m\u1ed9t gi\u1edd.<\/p>\n

Sau khi v\u00e0o \u0111\u01b0\u1ee3c m\u00f4i tr\u01b0\u1eddng l\u00e0m vi\u1ec7c, k\u1ebb t\u1ea5n c\u00f4ng th\u01b0\u1eddng l\u1eadp b\u1ea3n \u0111\u1ed3 th\u01b0 m\u1ee5c c\u1ee5c b\u1ed9, ki\u1ec3m tra OneDrive, \u1ed5 \u0111\u0129a m\u1ea1ng ho\u1eb7c h\u1ec7 th\u1ed1ng qu\u1ea3n l\u00fd t\u00e0i li\u1ec7u. C\u00e1c t\u1eeb kh\u00f3a li\u00ean quan \u0111\u1ebfn h\u1ed3 s\u01a1 thu\u1ebf, h\u1ee3p \u0111\u1ed3ng, th\u00f4ng tin nh\u1eadn d\u1ea1ng c\u00e1 nh\u00e2n v\u00e0 d\u1eef li\u1ec7u t\u00e0i ch\u00ednh \u0111\u01b0\u1ee3c d\u00f9ng \u0111\u1ec3 khoanh v\u00f9ng t\u00e0i li\u1ec7u nh\u1ea1y c\u1ea3m.<\/p>\n

D\u1eef li\u1ec7u sau \u0111\u00f3 c\u00f3 th\u1ec3 b\u1ecb \u0111\u01b0a ra ngo\u00e0i b\u1eb1ng WinSCP, Rclone, t\u00e0i kho\u1ea3n l\u01b0u tr\u1eef \u0111\u00e1m m\u00e2y do k\u1ebb t\u1ea5n c\u00f4ng ki\u1ec3m so\u00e1t ho\u1eb7c th\u1eadm ch\u00ed qua email c\u1ee7a ch\u00ednh n\u1ea1n nh\u00e2n. Google cho bi\u1ebft \u0111\u00e3 v\u00f4 hi\u1ec7u h\u00f3a c\u00e1c t\u00e0i kho\u1ea3n Drive v\u00e0 t\u00e0i s\u1ea3n li\u00ean quan \u0111\u1ebfn ho\u1ea1t \u0111\u1ed9ng n\u00e0y khi ph\u00e1t hi\u1ec7n.<\/p>\n

Khi t\u1ea5n c\u00f4ng m\u1ea1ng b\u01b0\u1edbc ra \u0111\u1eddi th\u1ef1c<\/h2>\n

M\u1ed9t \u0111i\u1ec3m leo thang \u0111\u00e1ng lo ng\u1ea1i l\u00e0 y\u1ebfu t\u1ed1 truy c\u1eadp v\u1eadt l\u00fd. Google Cloud\/Mandiant d\u1eabn c\u1ea3nh b\u00e1o t\u1eeb FBI cho bi\u1ebft trong m\u1ed9t s\u1ed1 v\u1ee5 c\u00f3 li\u00ean quan, ng\u01b0\u1eddi gi\u1ea3 danh k\u1ef9 thu\u1eadt vi\u00ean \u0111\u00e3 \u0111\u1ebfn tr\u1ef1c ti\u1ebfp v\u0103n ph\u00f2ng n\u1ea1n nh\u00e2n, y\u00eau c\u1ea7u thao t\u00e1c tr\u00ean m\u00e1y t\u00ednh v\u1edbi l\u00fd do sao l\u01b0u ho\u1eb7c x\u1eed l\u00fd s\u1ef1 c\u1ed1, r\u1ed3i t\u00ecm c\u00e1ch sao ch\u00e9p d\u1eef li\u1ec7u ra thi\u1ebft b\u1ecb USB.<\/p>\n

\u0110i\u1ec1u n\u00e0y cho th\u1ea5y ranh gi\u1edbi gi\u1eefa an ninh m\u1ea1ng v\u00e0 an ninh c\u01a1 s\u1edf v\u1eadt l\u00fd \u0111ang m\u1edd d\u1ea7n. M\u1ed9t doanh nghi\u1ec7p c\u00f3 th\u1ec3 \u0111\u1ea7u t\u01b0 m\u1ea1nh v\u00e0o t\u01b0\u1eddng l\u1eeda, MFA v\u00e0 EDR nh\u01b0ng v\u1eabn g\u1eb7p r\u1ee7i ro n\u1ebfu quy tr\u00ecnh ti\u1ebfp nh\u1eadn kh\u00e1ch, x\u00e1c minh nh\u00e2n s\u1ef1 IT ho\u1eb7c ki\u1ec3m so\u00e1t thi\u1ebft b\u1ecb l\u01b0u tr\u1eef r\u1eddi kh\u00f4ng \u0111\u1ee7 ch\u1eb7t.<\/p>\n

B\u00e0i h\u1ecdc ph\u00f2ng th\u1ee7 cho doanh nghi\u1ec7p v\u00e0 ng\u01b0\u1eddi d\u00f9ng<\/h2>\n

V\u1edbi c\u00e1c t\u1ed5 ch\u1ee9c, khuy\u1ebfn ngh\u1ecb quan tr\u1ecdng nh\u1ea5t l\u00e0 chu\u1ea9n h\u00f3a quy tr\u00ecnh x\u00e1c minh ngo\u00e0i k\u00eanh. Khi nh\u1eadn cu\u1ed9c g\u1ecdi t\u1ef1 x\u01b0ng l\u00e0 h\u1ed7 tr\u1ee3 IT, nh\u00e2n vi\u00ean n\u00ean d\u1eebng t\u01b0\u01a1ng t\u00e1c v\u00e0 g\u1ecdi l\u1ea1i qua s\u1ed1 n\u1ed9i b\u1ed9 \u0111\u00e3 \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1 ch\u00ednh th\u1ee9c. Kh\u00f4ng n\u00ean c\u00e0i c\u00f4ng c\u1ee5 \u0111i\u1ec1u khi\u1ec3n t\u1eeb xa, chia s\u1ebb m\u00e0n h\u00ecnh ho\u1eb7c ch\u1ea1y l\u1ec7nh do ng\u01b0\u1eddi g\u1ecdi cung c\u1ea5p n\u1ebfu ch\u01b0a \u0111\u01b0\u1ee3c x\u00e1c minh qua k\u00eanh \u0111\u1ed9c l\u1eadp.<\/p>\n

Doanh nghi\u1ec7p c\u0169ng c\u1ea7n ki\u1ec3m so\u00e1t ch\u1eb7t ph\u1ea7n m\u1ec1m RMM v\u00e0 c\u00f4ng c\u1ee5 chia s\u1ebb m\u00e0n h\u00ecnh. Ch\u1ec9 c\u00e1c c\u00f4ng c\u1ee5 \u0111\u01b0\u1ee3c ph\u00ea duy\u1ec7t m\u1edbi \u0111\u01b0\u1ee3c ph\u00e9p ch\u1ea1y; nh\u1eefng phi\u00ean h\u1ed7 tr\u1ee3 c\u00f3 quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n m\u00e1y c\u1ea7n \u0111\u01b0\u1ee3c ghi log, gi\u1edbi h\u1ea1n theo thi\u1ebft b\u1ecb doanh nghi\u1ec7p v\u00e0 gi\u00e1m s\u00e1t theo th\u1eddi gian th\u1ef1c.<\/p>\n

\u1ede l\u1edbp v\u1eadt l\u00fd, nh\u00e2n vi\u00ean l\u1ec5 t\u00e2n v\u00e0 b\u1ed9 ph\u1eadn h\u00e0nh ch\u00ednh c\u1ea7n c\u00f3 quy tr\u00ecnh ki\u1ec3m tra danh t\u00ednh k\u1ef9 thu\u1eadt vi\u00ean, l\u1ecbch h\u1eb9n, \u0111\u01a1n v\u1ecb c\u1eed ng\u01b0\u1eddi v\u00e0 ng\u01b0\u1eddi gi\u00e1m s\u00e1t n\u1ed9i b\u1ed9. Thi\u1ebft b\u1ecb USB l\u1ea1 kh\u00f4ng n\u00ean \u0111\u01b0\u1ee3c c\u1eafm v\u00e0o m\u00e1y doanh nghi\u1ec7p; ch\u00ednh s\u00e1ch MDM ho\u1eb7c Group Policy c\u00f3 th\u1ec3 gi\u1edbi h\u1ea1n quy\u1ec1n \u0111\u1ecdc ghi c\u1ee7a thi\u1ebft b\u1ecb l\u01b0u tr\u1eef r\u1eddi.<\/p>\n

V\u1edbi ng\u01b0\u1eddi d\u00f9ng c\u00e1 nh\u00e2n, b\u00e0i h\u1ecdc t\u01b0\u01a1ng t\u1ef1 c\u0169ng r\u1ea5t th\u1ef1c t\u1ebf: kh\u00f4ng c\u1ea5p quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n m\u00e1y t\u00ednh cho ng\u01b0\u1eddi l\u1ea1 qua \u0111i\u1ec7n tho\u1ea1i, kh\u00f4ng l\u00e0m theo h\u01b0\u1edbng d\u1eabn c\u00e0i ph\u1ea7n m\u1ec1m h\u1ed7 tr\u1ee3 n\u1ebfu cu\u1ed9c g\u1ecdi \u0111\u1ebfn b\u1ea5t ng\u1edd, v\u00e0 lu\u00f4n x\u00e1c minh l\u1ea1i qua k\u00eanh ch\u00ednh th\u1ee9c c\u1ee7a ng\u00e2n h\u00e0ng, c\u00f4ng ty, nh\u00e0 cung c\u1ea5p d\u1ecbch v\u1ee5 ho\u1eb7c b\u1ed9 ph\u1eadn IT.<\/p>\n

Conclusion<\/h2>\n

Chi\u1ebfn d\u1ecbch UNC3753 cho th\u1ea5y t\u1ea5n c\u00f4ng m\u1ea1ng hi\u1ec7n \u0111\u1ea1i kh\u00f4ng ch\u1ec9 l\u00e0 cu\u1ed9c \u0111ua gi\u1eefa m\u00e3 \u0111\u1ed9c v\u00e0 ph\u1ea7n m\u1ec1m ph\u00f2ng th\u1ee7. N\u00fat y\u1ebfu th\u01b0\u1eddng n\u1eb1m \u1edf quy tr\u00ecnh, th\u00f3i quen tin t\u01b0\u1edfng v\u00e0 kho\u1ea3ng tr\u1ed1ng gi\u1eefa an ninh k\u1ef9 thu\u1eadt v\u1edbi an ninh v\u1eadn h\u00e0nh. Khi m\u1ed9t cu\u1ed9c g\u1ecdi c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh c\u1eeda v\u00e0o c\u1ee7a m\u1ed9t v\u1ee5 \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u, \u0111\u00e0o t\u1ea1o nh\u1eadn th\u1ee9c, x\u00e1c minh danh t\u00ednh v\u00e0 ki\u1ec3m so\u00e1t truy c\u1eadp v\u1eadt l\u00fd c\u1ea7n \u0111\u01b0\u1ee3c xem l\u00e0 m\u1ed9t ph\u1ea7n c\u1ee7a c\u00f9ng m\u1ed9t chi\u1ebfn l\u01b0\u1ee3c ph\u00f2ng th\u1ee7.<\/p>\n

Ngu\u1ed3n tham kh\u1ea3o:<\/strong> Google Cloud\/Mandiant, TechCrunch, BleepingComputer.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb Google Cloud\/Mandiant, TechCrunch v\u00e0 BleepingComputer<\/em><\/p>","protected":false},"excerpt":{"rendered":"

Chi\u1ebfn d\u1ecbch UNC3753\/Silent Ransom Group cho th\u1ea5y t\u1ea5n c\u00f4ng gi\u1ea3 danh h\u1ed7 tr\u1ee3 IT c\u00f3 th\u1ec3 k\u1ebft h\u1ee3p vishing, c\u00f4ng c\u1ee5 qu\u1ea3n tr\u1ecb t\u1eeb xa v\u00e0 truy c\u1eadp v\u1eadt l\u00fd \u0111\u1ec3 \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u nhanh ch\u00f3ng.<\/p>","protected":false},"author":2,"featured_media":1575,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[46,23,123,175,171,176,177,173,174,172],"class_list":["post-1577","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kien-thuc","tag-an-ninh-mang","tag-bao-mat-doanh-nghiep","tag-bao-mat-du-lieu","tag-google-cloud","tag-lua-dao-qua-dien-thoai","tag-mandiant","tag-rmm","tag-silent-ransom-group","tag-unc3753","tag-vishing"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1577","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1577"}],"version-history":[{"count":1,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1577\/revisions"}],"predecessor-version":[{"id":1578,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1577\/revisions\/1578"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1575"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1577"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1577"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1577"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}