{"id":1672,"date":"2026-06-22T07:20:44","date_gmt":"2026-06-22T00:20:44","guid":{"rendered":"https:\/\/vncybers.vn\/arystinger-bien-router-d-link-cu-thanh-mang-proxy-doc-hai\/"},"modified":"2026-06-22T16:04:45","modified_gmt":"2026-06-22T09:04:45","slug":"arystinger-bien-router-d-link-cu-thanh-mang-proxy-doc-hai","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/arystinger-bien-router-d-link-cu-thanh-mang-proxy-doc-hai\/","title":{"rendered":"AryStinger bi\u1ebfn router D-Link c\u0169 th\u00e0nh m\u1ea1ng proxy \u0111\u1ed9c h\u1ea1i: B\u00e0i h\u1ecdc v\u1ec1 thi\u1ebft b\u1ecb h\u1ebft v\u00f2ng \u0111\u1eddi"},"content":{"rendered":"

M\u1ed9t botnet m\u1edbi \u0111\u01b0\u1ee3c \u0111\u1eb7t t\u00ean AryStinger<\/strong> \u0111ang cho th\u1ea5y r\u1ee7i ro quen thu\u1ed9c nh\u01b0ng v\u1eabn r\u1ea5t nghi\u00eam tr\u1ecdng c\u1ee7a c\u00e1c thi\u1ebft b\u1ecb m\u1ea1ng h\u1ebft v\u00f2ng \u0111\u1eddi: router gia \u0111\u00ecnh v\u00e0 v\u0103n ph\u00f2ng nh\u1ecf c\u00f3 th\u1ec3 b\u1ecb bi\u1ebfn th\u00e0nh h\u1ea1 t\u1ea7ng proxy, qu\u00e9t m\u1ea1ng v\u00e0 trung chuy\u1ec3n l\u01b0u l\u01b0\u1ee3ng cho k\u1ebb t\u1ea5n c\u00f4ng. Theo BleepingComputer, chi\u1ebfn d\u1ecbch \u0111\u00e3 \u1ea3nh h\u01b0\u1edfng h\u01a1n 4.000 router D-Link l\u1ed7i th\u1eddi, ch\u1ee7 y\u1ebfu l\u00e0 c\u00e1c d\u00f2ng DIR-850L v\u00e0 DIR-818LW.<\/p>\n

\"Router<\/p>\n

AryStinger l\u00e0 g\u00ec?<\/h2>\n

AryStinger l\u00e0 m\u1ed9t botnet ch\u01b0a \u0111\u01b0\u1ee3c ghi nh\u1eadn r\u1ed9ng r\u00e3i tr\u01b0\u1edbc \u0111\u00f3, \u0111\u01b0\u1ee3c nh\u00f3m t\u00ecnh b\u00e1o m\u1ed1i \u0111e d\u1ecda XLab c\u1ee7a Qianxin ph\u00e2n t\u00edch v\u00e0 BleepingComputer t\u1ed5ng h\u1ee3p l\u1ea1i trong b\u1ea3n tin ng\u00e0y 21\/06\/2026. Thay v\u00ec ch\u1ec9 d\u00f9ng thi\u1ebft b\u1ecb nhi\u1ec5m m\u00e3 \u0111\u1ed9c \u0111\u1ec3 t\u1ea5n c\u00f4ng t\u1eeb ch\u1ed1i d\u1ecbch v\u1ee5, h\u1ea1 t\u1ea7ng n\u00e0y bi\u1ebfn m\u1ed7i thi\u1ebft b\u1ecb th\u00e0nh m\u1ed9t \u201cexecutor\u201d c\u00f3 th\u1ec3 nh\u1eadn l\u1ec7nh t\u1eeb xa \u0111\u1ec3 qu\u00e9t m\u1ee5c ti\u00eau, l\u00e0m proxy, t\u1ea1o \u0111\u01b0\u1eddng h\u1ea7m, th\u1ef1c thi l\u1ec7nh v\u00e0 h\u1ed7 tr\u1ee3 c\u00e1c b\u01b0\u1edbc do th\u00e1m ban \u0111\u1ea7u.<\/p>\n

\u0110i\u1ec3m \u0111\u00e1ng ch\u00fa \u00fd n\u1eb1m \u1edf c\u00e1ch ph\u00e2n t\u00e1n c\u00f4ng vi\u1ec7c. K\u1ebb v\u1eadn h\u00e0nh c\u00f3 th\u1ec3 chia m\u1ed9t nhi\u1ec7m v\u1ee5 qu\u00e9t l\u1edbn th\u00e0nh nhi\u1ec1u ph\u1ea7n nh\u1ecf r\u1ed3i \u0111\u1ea9y xu\u1ed1ng nhi\u1ec1u thi\u1ebft b\u1ecb \u0111\u00e3 b\u1ecb chi\u1ebfm quy\u1ec1n. C\u00e1ch l\u00e0m n\u00e0y gi\u00fap ho\u1ea1t \u0111\u1ed9ng do th\u00e1m di\u1ec5n ra nhanh h\u01a1n, kh\u00f3 quy v\u1ec1 m\u1ed9t ngu\u1ed3n duy nh\u1ea5t v\u00e0 c\u00f3 th\u1ec3 t\u1eadn d\u1ee5ng ch\u00ednh \u0111\u1ecba ch\u1ec9 IP d\u00e2n d\u1ee5ng ho\u1eb7c doanh nghi\u1ec7p nh\u1ecf \u0111\u1ec3 che gi\u1ea5u ngu\u1ed3n g\u1ed1c t\u1ea5n c\u00f4ng.<\/p>\n

C\u00e1c thi\u1ebft b\u1ecb b\u1ecb nh\u1eafm m\u1ee5c ti\u00eau<\/h2>\n

Th\u00f4ng tin hi\u1ec7n c\u00f3 cho th\u1ea5y AryStinger khai th\u00e1c c\u00e1c l\u1ed7 h\u1ed5ng c\u0169 nh\u01b0 CVE-2013-3307, CVE-2016-5681 v\u00e0 CVE-2025-11837. M\u1ee5c ti\u00eau ch\u00ednh l\u00e0 c\u00e1c router D-Link DIR-850L v\u00e0 DIR-818LW \u0111\u00e3 c\u0169, trong \u0111\u00f3 m\u1ed9t s\u1ed1 model t\u1eebng b\u1ecb c\u00e1c botnet kh\u00e1c nh\u01b0 AVrecon nh\u1eafm \u0111\u1ebfn tr\u01b0\u1edbc \u0111\u00e2y.<\/p>\n

Vi\u1ec7c t\u1eadp trung v\u00e0o thi\u1ebft b\u1ecb h\u1ebft v\u00f2ng \u0111\u1eddi kh\u00f4ng ph\u1ea3i ng\u1eabu nhi\u00ean. Khi nh\u00e0 s\u1ea3n xu\u1ea5t \u0111\u00e3 ng\u1eebng h\u1ed7 tr\u1ee3, firmware m\u1edbi c\u00f3 th\u1ec3 kh\u00f4ng c\u00f2n \u0111\u01b0\u1ee3c ph\u00e1t h\u00e0nh, giao di\u1ec7n qu\u1ea3n tr\u1ecb th\u01b0\u1eddng v\u1eabn m\u1edf trong m\u1ea1ng n\u1ed9i b\u1ed9 ho\u1eb7c b\u1ecb c\u1ea5u h\u00ecnh sai ra Internet, c\u00f2n ng\u01b0\u1eddi d\u00f9ng cu\u1ed1i \u00edt khi ki\u1ec3m tra b\u1ea3n v\u00e1 cho router nh\u01b0 v\u1edbi m\u00e1y t\u00ednh hay \u0111i\u1ec7n tho\u1ea1i.<\/p>\n

Kh\u1ea3 n\u0103ng c\u1ee7a botnet<\/h2>\n

Theo ph\u00e2n t\u00edch \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1, AryStinger c\u00f3 \u00edt nh\u1ea5t hai bi\u1ebfn th\u1ec3. Bi\u1ebfn th\u1ec3 vi\u1ebft b\u1eb1ng C t\u1eadp trung v\u00e0o router l\u1ed7i th\u1eddi, trong khi bi\u1ebfn th\u1ec3 vi\u1ebft b\u1eb1ng Go nh\u1eafm t\u1edbi NAS v\u00e0 c\u00f3 ph\u1ea1m vi hi\u1ec7n t\u1ea1i nh\u1ecf h\u01a1n. Bi\u1ebfn th\u1ec3 cho NAS \u0111\u01b0\u1ee3c m\u00f4 t\u1ea3 l\u00e0 c\u00f3 nhi\u1ec1u ch\u1ee9c n\u0103ng n\u00e2ng cao h\u01a1n, bao g\u1ed3m qu\u00e9t IP, qu\u00e9t DNS, th\u1ef1c thi l\u1ec7nh, ch\u1ea1y payload v\u00e0 do th\u00e1m m\u1ea1ng n\u1ed9i b\u1ed9 th\u00f4ng qua vi\u1ec7c t\u00edch h\u1ee3p c\u00f4ng c\u1ee5 ki\u1ec3m th\u1eed x\u00e2m nh\u1eadp m\u00e3 ngu\u1ed3n m\u1edf.<\/p>\n

R\u1ee7i ro kh\u00f4ng d\u1eebng l\u1ea1i \u1edf chuy\u1ec7n thi\u1ebft b\u1ecb b\u1ecb d\u00f9ng l\u00e0m proxy. XLab c\u1ea3nh b\u00e1o m\u00e3 \u0111\u1ed9c c\u00f3 th\u1ec3 can thi\u1ec7p thi\u1ebft l\u1eadp DNS, chuy\u1ec3n h\u01b0\u1edbng truy c\u1eadp web, theo d\u00f5i ho\u1eb7c \u0111\u00e1nh c\u1eafp l\u01b0u l\u01b0\u1ee3ng \u0111i v\u00e0o v\u00e0 \u0111i ra thi\u1ebft b\u1ecb. Trong m\u00f4i tr\u01b0\u1eddng gia \u0111\u00ecnh, \u0111i\u1ec1u n\u00e0y c\u00f3 th\u1ec3 \u1ea3nh h\u01b0\u1edfng tr\u1ef1c ti\u1ebfp \u0111\u1ebfn t\u00e0i kho\u1ea3n c\u00e1 nh\u00e2n. Trong doanh nghi\u1ec7p nh\u1ecf, m\u1ed9t router b\u1ecb chi\u1ebfm quy\u1ec1n c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh \u0111i\u1ec3m \u0111\u1ee9ng ch\u00e2n \u0111\u1ec3 do th\u00e1m h\u1ea1 t\u1ea7ng n\u1ed9i b\u1ed9.<\/p>\n

Ph\u00e2n b\u1ed1 l\u00e2y nhi\u1ec5m v\u00e0 d\u1ea5u hi\u1ec7u c\u1ea7n ch\u00fa \u00fd<\/h2>\n

D\u1eef li\u1ec7u telemetry c\u1ee7a XLab \u0111\u01b0\u1ee3c BleepingComputer d\u1eabn l\u1ea1i cho th\u1ea5y g\u1ea7n m\u1ed9t n\u1eeda s\u1ed1 ca nhi\u1ec5m n\u1eb1m t\u1ea1i H\u00e0n Qu\u1ed1c, ti\u1ebfp theo l\u00e0 Trung Qu\u1ed1c, Th\u1ee5y \u0110i\u1ec3n, Malaysia v\u00e0 Singapore. D\u00f9 ch\u01b0a c\u00f3 b\u1eb1ng ch\u1ee9ng c\u00f4ng khai r\u1eb1ng Vi\u1ec7t Nam l\u00e0 tr\u1ecdng \u0111i\u1ec3m, b\u1ea3n ch\u1ea5t c\u1ee7a chi\u1ebfn d\u1ecbch cho th\u1ea5y b\u1ea5t k\u1ef3 thi\u1ebft b\u1ecb c\u0169 n\u00e0o v\u1eabn k\u1ebft n\u1ed1i Internet \u0111\u1ec1u c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh m\u1ee5c ti\u00eau n\u1ebfu l\u1ed7 h\u1ed5ng ph\u00f9 h\u1ee3p c\u00f2n t\u1ed3n t\u1ea1i.<\/p>\n

Nh\u1eefng d\u1ea5u hi\u1ec7u \u0111\u00e1ng ch\u00fa \u00fd g\u1ed3m DNS b\u1ecb \u0111\u1ed5i b\u1ea5t th\u01b0\u1eddng, router t\u1ef1 ph\u00e1t sinh k\u1ebft n\u1ed1i t\u1edbi m\u00e1y ch\u1ee7 l\u1ea1, t\u1ed1c \u0111\u1ed9 m\u1ea1ng gi\u1ea3m kh\u00f4ng r\u00f5 nguy\u00ean nh\u00e2n, c\u1ed5ng qu\u1ea3n tr\u1ecb xu\u1ea5t hi\u1ec7n tr\u00ean Internet, ho\u1eb7c nh\u1eadt k\u00fd thi\u1ebft b\u1ecb ghi nh\u1eadn y\u00eau c\u1ea7u l\u1eb7p l\u1ea1i t\u1edbi c\u00e1c endpoint qu\u1ea3n tr\u1ecb c\u0169. V\u1edbi thi\u1ebft b\u1ecb kh\u00f4ng c\u00f2n nh\u1eadn b\u1ea3n v\u00e1, vi\u1ec7c ch\u1ec9 \u0111\u1ed5i m\u1eadt kh\u1ea9u th\u01b0\u1eddng kh\u00f4ng \u0111\u1ee7 \u0111\u1ec3 lo\u1ea1i b\u1ecf r\u1ee7i ro.<\/p>\n

Khuy\u1ebfn ngh\u1ecb cho ng\u01b0\u1eddi d\u00f9ng v\u00e0 qu\u1ea3n tr\u1ecb vi\u00ean<\/h2>\n

\u01afu ti\u00ean \u0111\u1ea7u ti\u00ean l\u00e0 x\u00e1c \u0111\u1ecbnh model router, phi\u00ean b\u1ea3n firmware v\u00e0 tr\u1ea1ng th\u00e1i h\u1ed7 tr\u1ee3 t\u1eeb nh\u00e0 s\u1ea3n xu\u1ea5t. N\u1ebfu thi\u1ebft b\u1ecb \u0111\u00e3 h\u1ebft v\u00f2ng \u0111\u1eddi, ph\u01b0\u01a1ng \u00e1n an to\u00e0n nh\u1ea5t l\u00e0 thay th\u1ebf b\u1eb1ng model c\u00f2n \u0111\u01b0\u1ee3c c\u1eadp nh\u1eadt b\u1ea3o m\u1eadt. V\u1edbi thi\u1ebft b\u1ecb v\u1eabn c\u00f2n h\u1ed7 tr\u1ee3, c\u1ea7n c\u1eadp nh\u1eadt firmware m\u1edbi nh\u1ea5t, thay m\u1eadt kh\u1ea9u qu\u1ea3n tr\u1ecb m\u1eb7c \u0111\u1ecbnh, t\u1eaft qu\u1ea3n tr\u1ecb t\u1eeb xa n\u1ebfu kh\u00f4ng c\u1ea7n thi\u1ebft v\u00e0 h\u1ea1n ch\u1ebf truy c\u1eadp giao di\u1ec7n qu\u1ea3n tr\u1ecb ch\u1ec9 t\u1eeb m\u1ea1ng tin c\u1eady.<\/p>\n

\u0110\u1ed1i v\u1edbi t\u1ed5 ch\u1ee9c, router chi nh\u00e1nh, thi\u1ebft b\u1ecb v\u0103n ph\u00f2ng nh\u1ecf v\u00e0 NAS c\u1ea7n \u0111\u01b0\u1ee3c \u0111\u01b0a v\u00e0o danh m\u1ee5c t\u00e0i s\u1ea3n b\u1ea3o m\u1eadt thay v\u00ec xem nh\u01b0 thi\u1ebft b\u1ecb ph\u1ee5 tr\u1ee3. Nh\u1eadt k\u00fd DNS, l\u01b0u l\u01b0\u1ee3ng outbound v\u00e0 c\u1ea5u h\u00ecnh NAT\/port forwarding n\u00ean \u0111\u01b0\u1ee3c r\u00e0 so\u00e1t \u0111\u1ecbnh k\u1ef3. Nh\u1eefng thi\u1ebft b\u1ecb kh\u00f4ng th\u1ec3 c\u1eadp nh\u1eadt c\u1ea7n \u0111\u01b0\u1ee3c t\u00e1ch m\u1ea1ng, h\u1ea1n ch\u1ebf quy\u1ec1n truy c\u1eadp ho\u1eb7c lo\u1ea1i b\u1ecf kh\u1ecfi m\u00f4i tr\u01b0\u1eddng s\u1ea3n xu\u1ea5t.<\/p>\n

Cybersecurity lesson<\/h2>\n

AryStinger nh\u1eafc l\u1ea1i m\u1ed9t th\u1ef1c t\u1ebf quan tr\u1ecdng: t\u1ea5n c\u00f4ng hi\u1ec7n \u0111\u1ea1i kh\u00f4ng ch\u1ec9 nh\u1eafm v\u00e0o m\u00e1y ch\u1ee7 l\u1edbn hay m\u00e1y tr\u1ea1m c\u1ee7a nh\u00e2n vi\u00ean, m\u00e0 c\u00f2n khai th\u00e1c nh\u1eefng thi\u1ebft b\u1ecb nh\u1ecf \u00edt \u0111\u01b0\u1ee3c ch\u00fa \u00fd \u1edf r\u00eca m\u1ea1ng. M\u1ed9t router c\u0169 c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh tr\u1ea1m trung chuy\u1ec3n, \u0111i\u1ec3m do th\u00e1m ho\u1eb7c c\u00f4ng c\u1ee5 che gi\u1ea5u danh t\u00ednh cho nhi\u1ec1u chi\u1ebfn d\u1ecbch kh\u00e1c nhau.<\/p>\n

V\u00ec v\u1eady, qu\u1ea3n tr\u1ecb an to\u00e0n thi\u1ebft b\u1ecb m\u1ea1ng c\u1ea7n \u0111\u01b0\u1ee3c xem l\u00e0 m\u1ed9t ph\u1ea7n c\u1ee7a qu\u1ea3n tr\u1ecb r\u1ee7i ro t\u1ed5ng th\u1ec3. Ki\u1ec3m k\u00ea t\u00e0i s\u1ea3n, theo d\u00f5i v\u00f2ng \u0111\u1eddi h\u1ed7 tr\u1ee3, c\u1eadp nh\u1eadt firmware v\u00e0 lo\u1ea1i b\u1ecf thi\u1ebft b\u1ecb kh\u00f4ng c\u00f2n v\u00e1 l\u1ed7i l\u00e0 c\u00e1c b\u01b0\u1edbc c\u01a1 b\u1ea3n nh\u01b0ng c\u00f3 t\u00e1c \u0111\u1ed9ng l\u1edbn trong vi\u1ec7c gi\u1ea3m b\u1ec1 m\u1eb7t t\u1ea5n c\u00f4ng.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb BleepingComputer v\u00e0 XLab<\/em><\/p>","protected":false},"excerpt":{"rendered":"

M\u1ed9t botnet m\u1edbi \u0111\u01b0\u1ee3c \u0111\u1eb7t t\u00ean AryStinger \u0111ang cho th\u1ea5y r\u1ee7i ro quen thu\u1ed9c nh\u01b0ng v\u1eabn r\u1ea5t nghi\u00eam tr\u1ecdng c\u1ee7a c\u00e1c thi\u1ebft b\u1ecb m\u1ea1ng h\u1ebft v\u00f2ng \u0111\u1eddi: router gia \u0111\u00ecnh v\u00e0 v\u0103n ph\u00f2ng nh\u1ecf c\u00f3 th\u1ec3 b\u1ecb bi\u1ebfn th\u00e0nh h\u1ea1 t\u1ea7ng proxy, qu\u00e9t m\u1ea1ng v\u00e0 trung chuy\u1ec3n l\u01b0u l\u01b0\u1ee3ng cho k\u1ebb t\u1ea5n c\u00f4ng. Theo BleepingComputer, […]<\/p>\n","protected":false},"author":2,"featured_media":1670,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[234,149,235,239,238,241,236,237,240],"class_list":["post-1672","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kien-thuc","tag-arystinger","tag-botnet","tag-d-link","tag-dns-hijacking","tag-nas","tag-qianxin","tag-router-botnet","tag-thiet-bi-het-vong-doi","tag-xlab"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1672","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1672"}],"version-history":[{"count":1,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1672\/revisions"}],"predecessor-version":[{"id":1681,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1672\/revisions\/1681"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1670"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1672"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1672"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1672"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}