{"id":1653,"date":"2026-06-18T07:20:04","date_gmt":"2026-06-18T00:20:04","guid":{"rendered":"https:\/\/vncybers.vn\/ho-so-unc5221-nhom-apt-dung-sau-brickstorm-va-chien-dich-an-minh-trong-ha-tang-doanh-nghiep\/"},"modified":"2026-06-18T07:20:04","modified_gmt":"2026-06-18T00:20:04","slug":"ho-so-unc5221-nhom-apt-dung-sau-brickstorm-va-chien-dich-an-minh-trong-ha-tang-doanh-nghiep","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/ho-so-unc5221-nhom-apt-dung-sau-brickstorm-va-chien-dich-an-minh-trong-ha-tang-doanh-nghiep\/","title":{"rendered":"H\u1ed3 s\u01a1 UNC5221: Nh\u00f3m APT \u0111\u1ee9ng sau BRICKSTORM v\u00e0 chi\u1ebfn d\u1ecbch \u1ea9n m\u00ecnh trong h\u1ea1 t\u1ea7ng doanh nghi\u1ec7p"},"content":{"rendered":"

UNC5221, c\u00f2n \u0111\u01b0\u1ee3c nh\u1eafc \u0111\u1ebfn v\u1edbi t\u00ean VerdantBamboo trong m\u1ed9t s\u1ed1 b\u00e1o c\u00e1o, \u0111ang tr\u1edf th\u00e0nh m\u1ed9t trong nh\u1eefng nh\u00f3m APT \u0111\u00e1ng ch\u00fa \u00fd nh\u1ea5t trong c\u00e1c chi\u1ebfn d\u1ecbch gi\u00e1n \u0111i\u1ec7p m\u1ea1ng nh\u1eafm v\u00e0o h\u1ea1 t\u1ea7ng doanh nghi\u1ec7p. \u0110i\u1ec3m n\u1ed5i b\u1eadt c\u1ee7a nh\u00f3m kh\u00f4ng n\u1eb1m \u1edf c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng \u1ed3n \u00e0o, m\u00e0 \u1edf kh\u1ea3 n\u0103ng duy tr\u00ec quy\u1ec1n truy c\u1eadp \u00e2m th\u1ea7m trong th\u1eddi gian d\u00e0i tr\u00ean nh\u1eefng thi\u1ebft b\u1ecb bi\u00ean, h\u1ec7 th\u1ed1ng \u1ea3o h\u00f3a v\u00e0 n\u1ec1n t\u1ea3ng kh\u00f4ng \u0111\u01b0\u1ee3c gi\u00e1m s\u00e1t ch\u1eb7t nh\u01b0 m\u00e1y tr\u1ea1m truy\u1ec1n th\u1ed1ng.<\/p>\n

Theo BleepingComputer, nh\u00f3m n\u00e0y \u0111\u00e3 b\u1ecb ghi nh\u1eadn truy c\u1eadp m\u00f4i tr\u01b0\u1eddng Microsoft 365 b\u1eb1ng backdoor BRICKSTORM, \u0111\u1ed3ng th\u1eddi s\u1eed d\u1ee5ng th\u00eam c\u00e1c c\u00f4ng c\u1ee5 m\u1edbi nh\u01b0 Plenet v\u00e0 AgentPSD \u0111\u1ec3 gi\u1eef quy\u1ec1n truy c\u1eadp d\u1ef1 ph\u00f2ng. V\u1ee5 vi\u1ec7c cho th\u1ea5y m\u1ed9t xu h\u01b0\u1edbng \u0111\u00e1ng lo ng\u1ea1i: c\u00e1c t\u00e1c nh\u00e2n gi\u00e1n \u0111i\u1ec7p kh\u00f4ng ch\u1ec9 khai th\u00e1c l\u1ed7 h\u1ed5ng ban \u0111\u1ea7u, m\u00e0 c\u00f2n x\u00e2y d\u1ef1ng nhi\u1ec1u t\u1ea7ng b\u00e1m tr\u1ee5 tr\u00ean thi\u1ebft b\u1ecb m\u1ea1ng, NAS, firewall, h\u1ec7 th\u1ed1ng l\u01b0u tr\u1eef v\u00e0 h\u1ea1 t\u1ea7ng c\u1ee7a nh\u00e0 cung c\u1ea5p d\u1ecbch v\u1ee5 qu\u1ea3n l\u00fd.<\/p>\n

\"S\u01a1<\/p>\n

UNC5221 l\u00e0 ai?<\/h2>\n

UNC5221 \u0111\u01b0\u1ee3c Google Threat Intelligence Group v\u00e0 Mandiant li\u00ean h\u1ec7 v\u1edbi c\u00e1c c\u1ee5m ho\u1ea1t \u0111\u1ed9ng nghi c\u00f3 li\u00ean quan \u0111\u1ebfn Trung Qu\u1ed1c. Trong c\u00e1c b\u00e1o c\u00e1o c\u00f4ng khai, nh\u00f3m n\u00e0y t\u1eebng g\u1eafn v\u1edbi ho\u1ea1t \u0111\u1ed9ng khai th\u00e1c thi\u1ebft b\u1ecb bi\u00ean, tri\u1ec3n khai backdoor BRICKSTORM v\u00e0 duy tr\u00ec truy c\u1eadp l\u00e2u d\u00e0i trong m\u00f4i tr\u01b0\u1eddng n\u1ea1n nh\u00e2n. Google l\u01b0u \u00fd r\u1eb1ng UNC5221 \u0111\u00f4i khi b\u1ecb nh\u1eafc chung v\u1edbi Silk Typhoon, nh\u01b0ng GTIG kh\u00f4ng coi hai c\u1ee5m ho\u1ea1t \u0111\u1ed9ng n\u00e0y l\u00e0 ho\u00e0n to\u00e0n \u0111\u1ed3ng nh\u1ea5t.<\/p>\n

\u0110\u1eb7c \u0111i\u1ec3m \u0111\u00e1ng ch\u00fa \u00fd c\u1ee7a UNC5221 l\u00e0 l\u1ef1a ch\u1ecdn m\u1ee5c ti\u00eau c\u00f3 gi\u00e1 tr\u1ecb t\u00ecnh b\u00e1o cao. C\u00e1c b\u00e1o c\u00e1o c\u1ee7a Mandiant m\u00f4 t\u1ea3 ho\u1ea1t \u0111\u1ed9ng BRICKSTORM trong c\u00e1c l\u0129nh v\u1ef1c c\u00f4ng ngh\u1ec7, SaaS, d\u1ecbch v\u1ee5 ph\u00e1p l\u00fd, nh\u00e0 cung c\u1ea5p d\u1ecbch v\u1ee5 quy tr\u00ecnh nghi\u1ec7p v\u1ee5 v\u00e0 c\u00e1c t\u1ed5 ch\u1ee9c c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh \u0111i\u1ec3m trung chuy\u1ec3n \u0111\u1ec3 ti\u1ebfp c\u1eadn n\u1ea1n nh\u00e2n h\u1ea1 ngu\u1ed3n. \u0110\u00e2y l\u00e0 m\u00f4 h\u00ecnh t\u1ea5n c\u00f4ng ph\u00f9 h\u1ee3p v\u1edbi m\u1ee5c ti\u00eau thu th\u1eadp d\u1eef li\u1ec7u, truy c\u1eadp chu\u1ed7i cung \u1ee9ng v\u00e0 m\u1edf r\u1ed9ng ph\u1ea1m vi gi\u00e1m s\u00e1t h\u01a1n l\u00e0 ph\u00e1 ho\u1ea1i t\u1ee9c th\u1eddi.<\/p>\n

BRICKSTORM: Backdoor \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf cho nh\u1eefng n\u01a1i \u00edt b\u1ecb soi chi\u1ebfu<\/h2>\n

BRICKSTORM l\u00e0 backdoor c\u00f3 kh\u1ea3 n\u0103ng ho\u1ea1t \u0111\u1ed9ng tr\u00ean nhi\u1ec1u n\u1ec1n t\u1ea3ng, th\u01b0\u1eddng \u0111\u01b0\u1ee3c tri\u1ec3n khai tr\u00ean Linux, BSD ho\u1eb7c c\u00e1c thi\u1ebft b\u1ecb appliance. C\u00e1c phi\u00ean b\u1ea3n ban \u0111\u1ea7u \u0111\u01b0\u1ee3c vi\u1ebft b\u1eb1ng Go; m\u1ed9t s\u1ed1 bi\u1ebfn th\u1ec3 m\u1edbi h\u01a1n \u0111\u01b0\u1ee3c ghi nh\u1eadn c\u00f3 li\u00ean quan \u0111\u1ebfn Rust ho\u1eb7c \u0111\u01b0\u1ee3c l\u00e0m r\u1ed1i \u0111\u1ec3 tr\u00e1nh ph\u00e2n t\u00edch. \u0110i\u1ec3m m\u1ea1nh c\u1ee7a BRICKSTORM l\u00e0 kh\u1ea3 n\u0103ng proxy SOCKS, gi\u00fap k\u1ebb t\u1ea5n c\u00f4ng chuy\u1ec3n ti\u1ebfp l\u01b0u l\u01b0\u1ee3ng, truy c\u1eadp h\u1ec7 th\u1ed1ng n\u1ed9i b\u1ed9 v\u00e0 h\u00f2a v\u00e0o lu\u1ed3ng k\u1ebft n\u1ed1i h\u1ee3p ph\u00e1p.<\/p>\n

Mandiant cho bi\u1ebft c\u00e1c thi\u1ebft b\u1ecb appliance th\u01b0\u1eddng b\u1ecb b\u1ecf s\u00f3t trong ki\u1ec3m k\u00ea t\u00e0i s\u1ea3n, kh\u00f4ng \u0111\u01b0\u1ee3c c\u00e0i EDR v\u00e0 c\u0169ng kh\u00f4ng \u0111\u01b0\u1ee3c \u0111\u01b0a \u0111\u1ea7y \u0111\u1ee7 v\u00e0o h\u1ec7 th\u1ed1ng log t\u1eadp trung. Ch\u00ednh kho\u1ea3ng tr\u1ed1ng n\u00e0y gi\u00fap BRICKSTORM tr\u1edf th\u00e0nh c\u00f4ng c\u1ee5 b\u00e1m tr\u1ee5 hi\u1ec7u qu\u1ea3. Trong m\u1ed9t s\u1ed1 v\u1ee5 vi\u1ec7c, th\u1eddi gian \u1ea9n m\u00ecnh trung b\u00ecnh \u0111\u01b0\u1ee3c Mandiant ghi nh\u1eadn l\u00ean t\u1edbi 393 ng\u00e0y, \u0111\u1ee7 d\u00e0i \u0111\u1ec3 v\u01b0\u1ee3t qua chu k\u1ef3 l\u01b0u log c\u1ee7a nhi\u1ec1u doanh nghi\u1ec7p.<\/p>\n

Di\u1ec5n bi\u1ebfn ch\u00ednh c\u1ee7a chi\u1ebfn d\u1ecbch<\/h2>\n

C\u00e1c \u0111i\u1ec1u tra g\u1ea7n \u0111\u00e2y cho th\u1ea5y UNC5221 c\u00f3 th\u1ec3 x\u00e2m nh\u1eadp m\u1ea1ng n\u1ea1n nh\u00e2n trong nhi\u1ec1u th\u00e1ng tr\u01b0\u1edbc khi b\u1ecb ph\u00e1t hi\u1ec7n. BleepingComputer d\u1eabn th\u00f4ng tin t\u1eeb Volexity cho bi\u1ebft m\u1ed9t t\u1ed5 ch\u1ee9c \u0111\u00e3 b\u1ecb truy c\u1eadp \u00edt nh\u1ea5t 18 th\u00e1ng tr\u01b0\u1edbc th\u1eddi \u0111i\u1ec3m ph\u00e1t hi\u1ec7n, sau \u0111\u00f3 c\u00f2n b\u1ecb x\u00e2m nh\u1eadp l\u1ea1i sau giai \u0111o\u1ea1n kh\u1eafc ph\u1ee5c. K\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 s\u1eed d\u1ee5ng th\u00f4ng tin x\u00e1c th\u1ef1c b\u1ecb \u0111\u00e1nh c\u1eafp \u0111\u1ec3 b\u1eadt v\u00e0 c\u1ea5u h\u00ecnh SSL VPN tr\u00ean firewall, k\u1ebft n\u1ed1i v\u00e0o h\u1ec7 th\u1ed1ng n\u1ed9i b\u1ed9 r\u1ed3i tri\u1ec3n khai th\u00eam m\u00e3 \u0111\u1ed9c tr\u00ean thi\u1ebft b\u1ecb Synology NAS.<\/p>\n

\u0110i\u1ec3m \u0111\u00e1ng ch\u00fa \u00fd h\u01a1n l\u00e0 d\u1ea5u v\u1ebft t\u1ea1i nh\u00e0 cung c\u1ea5p d\u1ecbch v\u1ee5 qu\u1ea3n l\u00fd c\u1ee7a n\u1ea1n nh\u00e2n. Volexity ph\u00e1t hi\u1ec7n m\u1ed9t bi\u1ebfn th\u1ec3 BRICKSTORM tr\u00ean firewall pfSense c\u1ee7a MSP, cho th\u1ea5y kh\u1ea3 n\u0103ng k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 d\u00f9ng h\u1ea1 t\u1ea7ng c\u1ee7a b\u00ean th\u1ee9 ba \u0111\u1ec3 quay l\u1ea1i ho\u1eb7c m\u1edf r\u1ed9ng truy c\u1eadp v\u00e0o t\u1ed5 ch\u1ee9c m\u1ee5c ti\u00eau. \u0110\u00e2y l\u00e0 r\u1ee7i ro \u0111\u1eb7c bi\u1ec7t l\u1edbn v\u1edbi doanh nghi\u1ec7p ph\u1ee5 thu\u1ed9c v\u00e0o \u0111\u1ed1i t\u00e1c v\u1eadn h\u00e0nh h\u1ec7 th\u1ed1ng, v\u00ec m\u1ed9t \u0111i\u1ec3m y\u1ebfu ngo\u00e0i bi\u00ean gi\u1edbi t\u1ed5 ch\u1ee9c v\u1eabn c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh \u0111\u01b0\u1eddng v\u00e0o h\u1ee3p l\u1ec7.<\/p>\n

C\u00f4ng c\u1ee5 Plenet v\u00e0 AgentPSD trong t\u1ea7ng b\u00e1m tr\u1ee5 m\u1edbi<\/h2>\n

Ngo\u00e0i BRICKSTORM, nh\u00f3m c\u00f2n \u0111\u01b0\u1ee3c ghi nh\u1eadn s\u1eed d\u1ee5ng Plenet, m\u1ed9t backdoor n\u1ec1n .NET c\u00f3 kh\u1ea3 n\u0103ng m\u1edf shell t\u01b0\u01a1ng t\u00e1c, th\u1ef1c thi l\u1ec7nh t\u1eeb xa, thao t\u00e1c t\u1ec7p v\u00e0 chuy\u1ec3n \u0111\u1ed5i m\u00e1y ch\u1ee7 \u0111i\u1ec1u khi\u1ec3n. Google theo d\u00f5i Plenet v\u1edbi t\u00ean Grimbolt. C\u00f4ng c\u1ee5 n\u00e0y s\u1eed d\u1ee5ng WebSocket cho li\u00ean l\u1ea1c C2, t\u1ea1o th\u00eam k\u00eanh \u0111i\u1ec1u khi\u1ec3n linh ho\u1ea1t sau khi nh\u00f3m \u0111\u00e3 kh\u00f4i ph\u1ee5c quy\u1ec1n truy c\u1eadp v\u00e0o m\u00f4i tr\u01b0\u1eddng n\u1ea1n nh\u00e2n.<\/p>\n

AgentPSD \u0111\u01b0\u1ee3c m\u00f4 t\u1ea3 l\u00e0 m\u1ed9t reverse shell vi\u1ebft b\u1eb1ng Python, c\u00f3 th\u1ec3 \u0111\u00f3ng vai tr\u00f2 c\u01a1 ch\u1ebf truy c\u1eadp d\u1ef1 ph\u00f2ng n\u1ebfu nh\u1eefng backdoor kh\u00e1c b\u1ecb m\u1ea5t. Trong tr\u01b0\u1eddng h\u1ee3p \u0111\u01b0\u1ee3c Volexity ph\u00e2n t\u00edch, AgentPSD \u0111\u01b0\u1ee3c c\u1ea5u h\u00ecnh k\u1ebft n\u1ed1i \u0111\u1ebfn m\u1ed9t mi\u1ec1n kh\u00e1c v\u1edbi BRICKSTORM nh\u01b0ng kh\u00f4ng c\u1ea7n k\u00edch ho\u1ea1t, v\u00ec BRICKSTORM v\u1eabn c\u00f2n ho\u1ea1t \u0111\u1ed9ng. \u0110i\u1ec1u n\u00e0y cho th\u1ea5y c\u00e1ch UNC5221 x\u00e2y d\u1ef1ng nhi\u1ec1u l\u1edbp d\u1ef1 ph\u00f2ng thay v\u00ec ph\u1ee5 thu\u1ed9c v\u00e0o m\u1ed9t implant duy nh\u1ea5t.<\/p>\n

V\u00ec sao chi\u1ebfn d\u1ecbch n\u00e0y nguy hi\u1ec3m v\u1edbi doanh nghi\u1ec7p?<\/h2>\n

R\u1ee7i ro l\u1edbn nh\u1ea5t n\u1eb1m \u1edf vi\u1ec7c nh\u00f3m nh\u1eafm v\u00e0o c\u00e1c h\u1ec7 th\u1ed1ng c\u00f3 quy\u1ec1n cao nh\u01b0ng \u0111\u1ed9 quan s\u00e1t th\u1ea5p. VMware vCenter, ESXi, firewall, NAS, h\u1ec7 th\u1ed1ng l\u01b0u tr\u1eef, email archive v\u00e0 thi\u1ebft b\u1ecb bi\u00ean th\u01b0\u1eddng c\u00f3 vai tr\u00f2 then ch\u1ed1t trong v\u1eadn h\u00e0nh nh\u01b0ng kh\u00f4ng ph\u1ea3i l\u00fac n\u00e0o c\u0169ng \u0111\u01b0\u1ee3c gi\u00e1m s\u00e1t nh\u01b0 m\u00e1y ch\u1ee7 \u1ee9ng d\u1ee5ng ho\u1eb7c endpoint ng\u01b0\u1eddi d\u00f9ng. Khi b\u1ecb chi\u1ebfm quy\u1ec1n, ch\u00fang c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh b\u1ec7 ph\u00f3ng \u0111\u1ec3 thu th\u1eadp th\u00f4ng tin x\u00e1c th\u1ef1c, sao ch\u00e9p m\u00e1y \u1ea3o, truy c\u1eadp mailbox ho\u1eb7c di chuy\u1ec3n ngang trong h\u1ec7 th\u1ed1ng.<\/p>\n

Google\/Mandiant c\u0169ng ghi nh\u1eadn c\u00e1c k\u1ef9 thu\u1eadt nh\u01b0 tri\u1ec3n khai web shell SLAYSTYLE, d\u00f9ng BRICKSTEAL \u0111\u1ec3 \u0111\u00e1nh c\u1eafp th\u00f4ng tin x\u00e1c th\u1ef1c t\u1eeb vCenter v\u00e0 s\u1eed d\u1ee5ng \u1ee9ng d\u1ee5ng Microsoft Entra ID c\u00f3 quy\u1ec1n \u0111\u1ecdc email. \u0110\u00e2y l\u00e0 chu\u1ed7i h\u00e0nh vi cho th\u1ea5y m\u1ee5c ti\u00eau kh\u00f4ng ch\u1ec9 l\u00e0 c\u00e0i m\u00e3 \u0111\u1ed9c, m\u00e0 l\u00e0 khai th\u00e1c to\u00e0n b\u1ed9 l\u1edbp qu\u1ea3n tr\u1ecb doanh nghi\u1ec7p \u0111\u1ec3 ph\u1ee5c v\u1ee5 gi\u00e1n \u0111i\u1ec7p l\u00e2u d\u00e0i.<\/p>\n

Defensive Lessons<\/h2>\n

V\u1edbi c\u00e1c t\u1ed5 ch\u1ee9c v\u1eadn h\u00e0nh h\u1ea1 t\u1ea7ng quan tr\u1ecdng, h\u1ed3 s\u01a1 UNC5221 nh\u1ea5n m\u1ea1nh nhu c\u1ea7u m\u1edf r\u1ed9ng m\u00f4 h\u00ecnh ph\u00f2ng th\u1ee7 ra ngo\u00e0i endpoint truy\u1ec1n th\u1ed1ng. Ki\u1ec3m k\u00ea \u0111\u1ea7y \u0111\u1ee7 thi\u1ebft b\u1ecb bi\u00ean, appliance, NAS, firewall, vCenter v\u00e0 h\u1ec7 th\u1ed1ng qu\u1ea3n tr\u1ecb l\u00e0 b\u01b0\u1edbc \u0111\u1ea7u ti\u00ean. C\u00e1c h\u1ec7 th\u1ed1ng n\u00e0y c\u1ea7n \u0111\u01b0\u1ee3c \u0111\u01b0a v\u00e0o gi\u00e1m s\u00e1t log, sao l\u01b0u c\u1ea5u h\u00ecnh, ki\u1ec3m tra t\u00ednh to\u00e0n v\u1eb9n t\u1ec7p v\u00e0 r\u00e0 so\u00e1t k\u1ebft n\u1ed1i ra ngo\u00e0i b\u1ea5t th\u01b0\u1eddng.<\/p>\n

\u0110\u1ed9i ng\u0169 b\u1ea3o m\u1eadt c\u0169ng n\u00ean \u01b0u ti\u00ean s\u0103n t\u00ecm theo h\u00e0nh vi thay v\u00ec ch\u1ec9 d\u1ef1a v\u00e0o IOC t\u0129nh. Mandiant c\u1ea3nh b\u00e1o r\u1eb1ng c\u00e1c m\u1eabu BRICKSTORM th\u01b0\u1eddng kh\u00f4ng t\u00e1i s\u1eed d\u1ee5ng domain C2 gi\u1eefa c\u00e1c n\u1ea1n nh\u00e2n, khi\u1ebfn ch\u1ec9 b\u00e1o h\u1ea1 t\u1ea7ng nhanh ch\u00f3ng m\u1ea5t gi\u00e1 tr\u1ecb. Th\u1ef1c t\u1ebf n\u00e0y \u0111\u00f2i h\u1ecfi doanh nghi\u1ec7p quan s\u00e1t c\u00e1c m\u1eabu h\u00e0nh vi nh\u01b0 b\u1eadt SSH b\u1ea5t th\u01b0\u1eddng tr\u00ean appliance, thay \u0111\u1ed5i script kh\u1edfi \u0111\u1ed9ng, truy c\u1eadp VAMI\/vCenter ngo\u00e0i chu\u1ea9n, t\u1ea1o \u1ee9ng d\u1ee5ng Entra ID quy\u1ec1n cao ho\u1eb7c l\u01b0u l\u01b0\u1ee3ng proxy t\u1eeb thi\u1ebft b\u1ecb kh\u00f4ng n\u00ean ph\u00e1t sinh k\u1ebft n\u1ed1i \u0111\u00f3.<\/p>\n

Conclusion<\/h2>\n

UNC5221 l\u00e0 v\u00ed d\u1ee5 r\u00f5 r\u00e0ng cho th\u1ebf h\u1ec7 APT \u01b0u ti\u00ean s\u1ef1 b\u1ec1n b\u1ec9, k\u00edn \u0111\u00e1o v\u00e0 khai th\u00e1c v\u00f9ng m\u00f9 c\u1ee7a h\u1ea1 t\u1ea7ng doanh nghi\u1ec7p. BRICKSTORM, Plenet v\u00e0 AgentPSD kh\u00f4ng ch\u1ec9 l\u00e0 m\u00e3 \u0111\u1ed9c ri\u00eang l\u1ebb, m\u00e0 l\u00e0 m\u1ed9t h\u1ec7 sinh th\u00e1i b\u00e1m tr\u1ee5 \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 t\u1ed3n t\u1ea1i l\u00e2u, di chuy\u1ec3n linh ho\u1ea1t v\u00e0 gi\u1ea3m t\u1ed1i \u0111a t\u00edn hi\u1ec7u ph\u00e1t hi\u1ec7n. V\u1edbi doanh nghi\u1ec7p, b\u00e0i h\u1ecdc quan tr\u1ecdng l\u00e0 kh\u00f4ng th\u1ec3 b\u1ea3o v\u1ec7 h\u1ec7 th\u1ed1ng n\u1ebfu ch\u1ec9 nh\u00ecn v\u00e0o m\u00e1y tr\u1ea1m; nh\u1eefng thi\u1ebft b\u1ecb \u00edt \u0111\u01b0\u1ee3c ch\u00fa \u00fd nh\u1ea5t \u0111\u00f4i khi l\u1ea1i l\u00e0 n\u01a1i k\u1ebb t\u1ea5n c\u00f4ng \u1edf l\u1ea1i l\u00e2u nh\u1ea5t.<\/p>\n

Ngu\u1ed3n tham kh\u1ea3o: BleepingComputer<\/a>, Google Cloud\/Mandiant<\/a>.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb BleepingComputer v\u00e0 Google Cloud\/Mandiant<\/em><\/p>","protected":false},"excerpt":{"rendered":"

UNC5221, c\u00f2n \u0111\u01b0\u1ee3c nh\u1eafc \u0111\u1ebfn v\u1edbi t\u00ean VerdantBamboo trong m\u1ed9t s\u1ed1 b\u00e1o c\u00e1o, \u0111ang tr\u1edf th\u00e0nh m\u1ed9t trong nh\u1eefng nh\u00f3m APT \u0111\u00e1ng ch\u00fa \u00fd nh\u1ea5t trong c\u00e1c chi\u1ebfn d\u1ecbch gi\u00e1n \u0111i\u1ec7p m\u1ea1ng nh\u1eafm v\u00e0o h\u1ea1 t\u1ea7ng doanh nghi\u1ec7p. \u0110i\u1ec3m n\u1ed5i b\u1eadt c\u1ee7a nh\u00f3m kh\u00f4ng n\u1eb1m \u1edf c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng \u1ed3n \u00e0o, m\u00e0 \u1edf kh\u1ea3 […]<\/p>\n","protected":false},"author":2,"featured_media":1651,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[199,200,196,201,176,203,198,195,197,202],"class_list":["post-1653","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-agentpsd","tag-apt-trung-quoc","tag-brickstorm","tag-gian-diep-mang","tag-mandiant","tag-microsoft-365","tag-plenet","tag-unc5221","tag-verdantbamboo","tag-volexity"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1653","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1653"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1653\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1651"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1653"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1653"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1653"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}