{"id":1691,"date":"2026-06-24T07:26:16","date_gmt":"2026-06-24T00:26:16","guid":{"rendered":"https:\/\/vncybers.vn\/ho-so-unc2814-chien-dich-gridtide-google-sheets-c2\/"},"modified":"2026-06-24T07:26:16","modified_gmt":"2026-06-24T00:26:16","slug":"ho-so-unc2814-chien-dich-gridtide-google-sheets-c2","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/ho-so-unc2814-chien-dich-gridtide-google-sheets-c2\/","title":{"rendered":"H\u1ed3 s\u01a1 UNC2814: Chi\u1ebfn d\u1ecbch GRIDTIDE v\u00e0 c\u00e1ch Google Sheets b\u1ecb l\u1ea1m d\u1ee5ng l\u00e0m k\u00eanh \u0111i\u1ec1u khi\u1ec3n"},"content":{"rendered":"

Google Threat Intelligence Group (GTIG) cho bi\u1ebft \u0111\u00e3 ph\u1ed1i h\u1ee3p v\u1edbi Mandiant v\u00e0 c\u00e1c \u0111\u1ed1i t\u00e1c \u0111\u1ec3 l\u00e0m gi\u00e1n \u0111o\u1ea1n m\u1ed9t chi\u1ebfn d\u1ecbch gi\u00e1n \u0111i\u1ec7p m\u1ea1ng to\u00e0n c\u1ea7u d\u00f9ng m\u00e3 \u0111\u1ed9c GRIDTIDE. Nh\u00f3m \u0111\u1ee9ng sau ho\u1ea1t \u0111\u1ed9ng n\u00e0y \u0111\u01b0\u1ee3c Google theo d\u00f5i l\u00e0 UNC2814, m\u1ed9t t\u00e1c nh\u00e2n b\u1ecb nghi c\u00f3 li\u00ean h\u1ec7 v\u1edbi Trung Qu\u1ed1c, nh\u1eafm tr\u1ecdng t\u00e2m v\u00e0o vi\u1ec5n th\u00f4ng v\u00e0 c\u01a1 quan ch\u00ednh ph\u1ee7 t\u1ea1i nhi\u1ec1u khu v\u1ef1c.<\/strong><\/p>\n

\u0110i\u1ec3m \u0111\u00e1ng ch\u00fa \u00fd c\u1ee7a h\u1ed3 s\u01a1 UNC2814 kh\u00f4ng ch\u1ec9 n\u1eb1m \u1edf quy m\u00f4 n\u1ea1n nh\u00e2n, m\u00e0 c\u00f2n \u1edf c\u00e1ch nh\u00f3m n\u00e0y bi\u1ebfn d\u1ecbch v\u1ee5 h\u1ee3p ph\u00e1p th\u00e0nh h\u1ea1 t\u1ea7ng ch\u1ec9 huy v\u00e0 ki\u1ec3m so\u00e1t. Thay v\u00ec duy tr\u00ec m\u1ed9t m\u00e1y ch\u1ee7 C2 d\u1ec5 b\u1ecb ch\u1eb7n, GRIDTIDE d\u00f9ng Google Sheets API \u0111\u1ec3 nh\u1eadn l\u1ec7nh, chuy\u1ec3n d\u1eef li\u1ec7u v\u00e0 che gi\u1ea5u ho\u1ea1t \u0111\u1ed9ng b\u00ean trong l\u01b0u l\u01b0\u1ee3ng tr\u00f4ng c\u00f3 v\u1ebb quen thu\u1ed9c v\u1edbi nhi\u1ec1u m\u00f4i tr\u01b0\u1eddng doanh nghi\u1ec7p.<\/p>\n

\"S\u01a1
V\u00f2ng \u0111\u1eddi th\u1ef1c thi c\u1ee7a GRIDTIDE \u0111\u01b0\u1ee3c Google Threat Intelligence Group c\u00f4ng b\u1ed1 trong b\u00e1o c\u00e1o v\u1ec1 UNC2814.<\/figcaption><\/figure>\n

B\u1ed1i c\u1ea3nh: Gi\u00e1n \u0111i\u1ec7p m\u1ea1ng trong h\u1ea1 t\u1ea7ng quen thu\u1ed9c<\/h2>\n

Trong nhi\u1ec1u n\u0103m, c\u00e1c nh\u00f3m APT c\u00f3 xu h\u01b0\u1edbng gi\u1ea3m d\u1ea5u v\u1ebft b\u1eb1ng c\u00e1ch tr\u1ed9n l\u01b0u l\u01b0\u1ee3ng \u0111\u1ed9c h\u1ea1i v\u00e0o nh\u1eefng d\u1ecbch v\u1ee5 \u0111\u00e1m m\u00e2y ph\u1ed5 bi\u1ebfn. C\u00e1ch ti\u1ebfp c\u1eadn n\u00e0y t\u1ea1o th\u1ebf kh\u00f3 cho \u0111\u1ed9i ph\u00f2ng th\u1ee7: ch\u1eb7n nh\u1ea7m c\u00f3 th\u1ec3 \u1ea3nh h\u01b0\u1edfng v\u1eadn h\u00e0nh h\u1ee3p ph\u00e1p, nh\u01b0ng b\u1ecf qua l\u1ea1i khi\u1ebfn k\u00eanh \u0111i\u1ec1u khi\u1ec3n t\u1ed3n t\u1ea1i l\u00e2u h\u01a1n trong m\u1ea1ng n\u1ed9i b\u1ed9.<\/p>\n

Theo GTIG, UNC2814 \u0111\u00e3 ho\u1ea1t \u0111\u1ed9ng to\u00e0n c\u1ea7u \u00edt nh\u1ea5t t\u1eeb n\u0103m 2017. Ho\u1ea1t \u0111\u1ed9ng g\u1ea7n \u0111\u00e2y d\u00f9ng GRIDTIDE t\u1eadp trung ch\u1ee7 y\u1ebfu v\u00e0o nh\u00e0 cung c\u1ea5p vi\u1ec5n th\u00f4ng, \u0111\u1ed3ng th\u1eddi c\u0169ng nh\u1eafm \u0111\u1ebfn c\u00e1c t\u1ed5 ch\u1ee9c ch\u00ednh ph\u1ee7. Google x\u00e1c nh\u1eadn 53 v\u1ee5 x\u00e2m nh\u1eadp t\u1ea1i 42 qu\u1ed1c gia v\u00e0 ghi nh\u1eadn d\u1ea5u hi\u1ec7u nh\u1eafm m\u1ee5c ti\u00eau t\u1ea1i \u00edt nh\u1ea5t 20 qu\u1ed1c gia kh\u00e1c.<\/p>\n

GRIDTIDE ho\u1ea1t \u0111\u1ed9ng nh\u01b0 th\u1ebf n\u00e0o<\/h2>\n

GRIDTIDE l\u00e0 m\u00e3 \u0111\u1ed9c d\u1ea1ng c\u1eeda h\u1eadu tr\u00ean Linux. Sau khi ch\u1ea1y tr\u00ean h\u1ec7 th\u1ed1ng n\u1ea1n nh\u00e2n, m\u00e3 \u0111\u1ed9c thu th\u1eadp t\u00ean ng\u01b0\u1eddi d\u00f9ng, t\u00ean m\u00e1y, h\u1ec7 \u0111i\u1ec1u h\u00e0nh, \u0111\u1ecba ch\u1ec9 IP c\u1ee5c b\u1ed9, th\u01b0 m\u1ee5c hi\u1ec7n t\u1ea1i, thi\u1ebft l\u1eadp ng\u00f4n ng\u1eef v\u00e0 m\u00fai gi\u1edd. C\u00e1c d\u1eef li\u1ec7u n\u00e0y \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a r\u1ed3i g\u1eedi v\u1ec1 b\u1ea3ng t\u00ednh do k\u1ebb t\u1ea5n c\u00f4ng ki\u1ec3m so\u00e1t.<\/p>\n

C\u01a1 ch\u1ebf \u0111i\u1ec1u khi\u1ec3n c\u1ee7a GRIDTIDE d\u1ef1a tr\u00ean t\u1eebng \u00f4 trong Google Sheets. M\u1ed9t \u00f4 \u0111\u01b0\u1ee3c d\u00f9ng \u0111\u1ec3 nh\u1eadn l\u1ec7nh, c\u00e1c \u00f4 kh\u00e1c d\u00f9ng \u0111\u1ec3 chuy\u1ec3n k\u1ebft qu\u1ea3, t\u1ea3i c\u00f4ng c\u1ee5 ho\u1eb7c tr\u00edch xu\u1ea5t t\u1ec7p. L\u1ec7nh c\u00f3 th\u1ec3 y\u00eau c\u1ea7u th\u1ef1c thi shell, t\u1ea3i d\u1eef li\u1ec7u l\u00ean m\u00e1y n\u1ea1n nh\u00e2n ho\u1eb7c \u0111\u1ecdc t\u1ec7p t\u1eeb m\u00e1y n\u1ea1n nh\u00e2n r\u1ed3i chia nh\u1ecf d\u1eef li\u1ec7u \u0111\u1ec3 \u0111\u01b0a ra ngo\u00e0i.<\/p>\n

Thi\u1ebft k\u1ebf n\u00e0y gi\u00fap k\u1ebb t\u1ea5n c\u00f4ng t\u1eadn d\u1ee5ng d\u1ecbch v\u1ee5 h\u1ee3p ph\u00e1p l\u00e0m l\u1edbp ng\u1ee5y trang. N\u1ebfu h\u1ec7 th\u1ed1ng gi\u00e1m s\u00e1t ch\u1ec9 nh\u00ecn t\u00ean mi\u1ec1n ho\u1eb7c giao th\u1ee9c, k\u1ebft n\u1ed1i \u0111\u1ebfn Google Sheets API c\u00f3 th\u1ec3 kh\u00f4ng l\u1eadp t\u1ee9c b\u1ecb coi l\u00e0 b\u1ea5t th\u01b0\u1eddng. V\u00ec v\u1eady, t\u00edn hi\u1ec7u ph\u00e1t hi\u1ec7n c\u1ea7n \u0111i s\u00e2u h\u01a1n v\u00e0o ti\u1ebfn tr\u00ecnh kh\u1edfi t\u1ea1o k\u1ebft n\u1ed1i, \u0111\u01b0\u1eddng d\u1eabn th\u1ef1c thi, h\u00e0nh vi t\u1ea1o t\u1ec7p c\u1ea5u h\u00ecnh v\u00e0 m\u1eabu truy c\u1eadp API.<\/p>\n

M\u1ee5c ti\u00eau v\u00e0 t\u00e1c \u0111\u1ed9ng<\/h2>\n

Vi\u1ec5n th\u00f4ng l\u00e0 m\u1ee5c ti\u00eau c\u00f3 gi\u00e1 tr\u1ecb \u0111\u1eb7c bi\u1ec7t trong ho\u1ea1t \u0111\u1ed9ng gi\u00e1n \u0111i\u1ec7p m\u1ea1ng. H\u1ea1 t\u1ea7ng n\u00e0y n\u1eafm gi\u1eef lu\u1ed3ng li\u00ean l\u1ea1c, d\u1eef li\u1ec7u kh\u00e1ch h\u00e0ng, metadata v\u00e0 nhi\u1ec1u \u0111i\u1ec3m k\u1ebft n\u1ed1i v\u1edbi h\u1ec7 th\u1ed1ng ch\u00ednh ph\u1ee7 ho\u1eb7c doanh nghi\u1ec7p l\u1edbn. Khi m\u1ed9t nh\u00f3m APT b\u00e1m tr\u1ee5 \u0111\u01b0\u1ee3c trong m\u00f4i tr\u01b0\u1eddng vi\u1ec5n th\u00f4ng, r\u1ee7i ro kh\u00f4ng d\u1eebng \u1edf m\u1ed9t t\u1ed5 ch\u1ee9c \u0111\u01a1n l\u1ebb m\u00e0 c\u00f3 th\u1ec3 lan sang chu\u1ed7i kh\u00e1ch h\u00e0ng v\u00e0 \u0111\u1ed1i t\u00e1c.<\/p>\n

Vi\u1ec7c Google m\u00f4 t\u1ea3 ph\u1ea1m vi h\u01a1n 70 qu\u1ed1c gia c\u00f3 n\u1ea1n nh\u00e2n x\u00e1c nh\u1eadn ho\u1eb7c nghi ng\u1edd cho th\u1ea5y \u0111\u00e2y kh\u00f4ng ph\u1ea3i chi\u1ebfn d\u1ecbch ng\u1eafn h\u1ea1n. C\u00e1c x\u00e2m nh\u1eadp quy m\u00f4 nh\u01b0 v\u1eady th\u01b0\u1eddng \u0111\u00f2i h\u1ecfi nhi\u1ec1u n\u0103m chu\u1ea9n b\u1ecb, t\u00edch l\u0169y h\u1ea1 t\u1ea7ng, ki\u1ec3m th\u1eed c\u00f4ng c\u1ee5 v\u00e0 hi\u1ec3u bi\u1ebft s\u00e2u v\u1ec1 c\u00e1ch v\u1eadn h\u00e0nh c\u1ee7a m\u1ee5c ti\u00eau.<\/p>\n

\"B\u1ea3n
C\u00e1c qu\u1ed1c gia c\u00f3 n\u1ea1n nh\u00e2n x\u00e1c nh\u1eadn ho\u1eb7c nghi ng\u1edd li\u00ean quan UNC2814 theo b\u00e1o c\u00e1o c\u1ee7a GTIG.<\/figcaption><\/figure>\n

Google \u0111\u00e3 l\u00e0m gi\u00e1n \u0111o\u1ea1n chi\u1ebfn d\u1ecbch ra sao<\/h2>\n

GTIG cho bi\u1ebft \u0111\u00e3 ch\u1ea5m d\u1ee9t c\u00e1c d\u1ef1 \u00e1n \u0111\u00e1m m\u00e2y do k\u1ebb t\u1ea5n c\u00f4ng ki\u1ec3m so\u00e1t, v\u00f4 hi\u1ec7u h\u00f3a h\u1ea1 t\u1ea7ng \u0111\u00e3 bi\u1ebft, thu h\u1ed3i quy\u1ec1n truy c\u1eadp v\u00e0o c\u00e1c Google Sheets b\u1ecb l\u1ea1m d\u1ee5ng v\u00e0 ph\u00e1t th\u00f4ng b\u00e1o t\u1edbi n\u1ea1n nh\u00e2n x\u00e1c minh \u0111\u01b0\u1ee3c. Nh\u00f3m c\u0169ng c\u00f4ng b\u1ed1 ch\u1ec9 d\u1ea5u x\u00e2m nh\u1eadp v\u00e0 tri\u1ec3n khai th\u00eam t\u00edn hi\u1ec7u ph\u00e1t hi\u1ec7n trong h\u1ec7 sinh th\u00e1i b\u1ea3o m\u1eadt c\u1ee7a Google.<\/p>\n

\u0110\u00e2y l\u00e0 \u0111i\u1ec3m \u0111\u00e1ng ch\u00fa \u00fd trong xu h\u01b0\u1edbng ph\u00f2ng th\u1ee7 hi\u1ec7n \u0111\u1ea1i: nh\u00e0 cung c\u1ea5p n\u1ec1n t\u1ea3ng kh\u00f4ng ch\u1ec9 ph\u00e1t hi\u1ec7n m\u00e3 \u0111\u1ed9c m\u00e0 c\u00f2n c\u00f3 th\u1ec3 c\u1eaft chu\u1ed7i v\u1eadn h\u00e0nh c\u1ee7a \u0111\u1ed1i th\u1ee7 khi d\u1ecbch v\u1ee5 c\u1ee7a h\u1ecd b\u1ecb bi\u1ebfn th\u00e0nh h\u1ea1 t\u1ea7ng t\u1ea5n c\u00f4ng. Tuy nhi\u00ean, vi\u1ec7c m\u1ed9t chi\u1ebfn d\u1ecbch b\u1ecb gi\u00e1n \u0111o\u1ea1n kh\u00f4ng \u0111\u1ed3ng ngh\u0129a r\u1ee7i ro k\u1ebft th\u00fac. GTIG nh\u1eadn \u0111\u1ecbnh UNC2814 c\u00f3 th\u1ec3 n\u1ed7 l\u1ef1c t\u00e1i l\u1eadp d\u1ea5u ch\u00e2n to\u00e0n c\u1ea7u.<\/p>\n

B\u00e0i h\u1ecdc cho doanh nghi\u1ec7p<\/h2>\n

V\u1edbi doanh nghi\u1ec7p, b\u00e0i h\u1ecdc quan tr\u1ecdng l\u00e0 kh\u00f4ng th\u1ec3 xem m\u1ecdi k\u1ebft n\u1ed1i \u0111\u1ebfn d\u1ecbch v\u1ee5 \u0111\u00e1m m\u00e2y l\u1edbn l\u00e0 m\u1eb7c nhi\u00ean an to\u00e0n. \u0110\u1ed9i b\u1ea3o m\u1eadt c\u1ea7n gi\u00e1m s\u00e1t ti\u1ebfn tr\u00ecnh kh\u00f4ng ph\u1ea3i tr\u00ecnh duy\u1ec7t t\u1ea1o k\u1ebft n\u1ed1i \u0111\u1ebfn API nh\u1ea1y c\u1ea3m, ph\u00e1t hi\u1ec7n t\u1ec7p c\u1ea5u h\u00ecnh \u0111\u01b0\u1ee3c t\u1ea1o trong th\u01b0 m\u1ee5c b\u1ea5t th\u01b0\u1eddng, ki\u1ec3m tra shell ch\u1ea1y t\u1eeb th\u01b0 m\u1ee5c t\u1ea1m v\u00e0 theo d\u00f5i h\u00e0nh vi truy c\u1eadp d\u1eef li\u1ec7u c\u00f3 m\u1eabu l\u1eb7p l\u1ea1i.<\/p>\n

\u0110\u1ed1i v\u1edbi nh\u00e0 m\u1ea1ng v\u00e0 t\u1ed5 ch\u1ee9c ch\u00ednh ph\u1ee7, h\u1ed3 s\u01a1 UNC2814 cho th\u1ea5y y\u00eau c\u1ea7u c\u1ea5p thi\u1ebft v\u1ec1 ph\u00e2n \u0111o\u1ea1n m\u1ea1ng, ki\u1ec3m so\u00e1t \u0111\u1eb7c quy\u1ec1n, thu th\u1eadp log chi ti\u1ebft tr\u00ean Linux, s\u0103n t\u00ecm m\u1ed1i \u0111e d\u1ecda d\u1ef1a tr\u00ean h\u00e0nh vi v\u00e0 quy tr\u00ecnh ph\u1ea3n \u1ee9ng nhanh khi ph\u00e1t hi\u1ec7n c\u00f4ng c\u1ee5 l\u1ea1 trong c\u00e1c th\u01b0 m\u1ee5c h\u1ec7 th\u1ed1ng. M\u1ed9t c\u1ea3nh b\u00e1o nh\u1ecf v\u1ec1 ti\u1ebfn tr\u00ecnh ho\u1eb7c t\u1ec7p c\u1ea5u h\u00ecnh c\u00f3 th\u1ec3 l\u00e0 d\u1ea5u hi\u1ec7u s\u1edbm c\u1ee7a chi\u1ebfn d\u1ecbch gi\u00e1n \u0111i\u1ec7p k\u00e9o d\u00e0i.<\/p>\n

Conclusion<\/h2>\n

GRIDTIDE ph\u1ea3n \u00e1nh c\u00e1ch c\u00e1c chi\u1ebfn d\u1ecbch gi\u00e1n \u0111i\u1ec7p m\u1ea1ng \u0111ang chuy\u1ec3n t\u1eeb h\u1ea1 t\u1ea7ng l\u1ed9 di\u1ec7n sang l\u1ea1m d\u1ee5ng n\u1ec1n t\u1ea3ng h\u1ee3p ph\u00e1p. H\u1ed3 s\u01a1 UNC2814 nh\u1eafc l\u1ea1i m\u1ed9t th\u1ef1c t\u1ebf: trong m\u00f4i tr\u01b0\u1eddng doanh nghi\u1ec7p hi\u1ec7n \u0111\u1ea1i, ph\u00f2ng th\u1ee7 kh\u00f4ng ch\u1ec9 l\u00e0 ch\u1eb7n m\u00e3 \u0111\u1ed9c, m\u00e0 c\u00f2n l\u00e0 hi\u1ec3u h\u00e0nh vi, ng\u1eef c\u1ea3nh v\u00e0 m\u1ed1i quan h\u1ec7 gi\u1eefa ti\u1ebfn tr\u00ecnh, d\u1ecbch v\u1ee5 \u0111\u00e1m m\u00e2y v\u00e0 d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb Google Threat Intelligence Group<\/em><\/p>","protected":false},"excerpt":{"rendered":"

Google Threat Intelligence Group (GTIG) cho bi\u1ebft \u0111\u00e3 ph\u1ed1i h\u1ee3p v\u1edbi Mandiant v\u00e0 c\u00e1c \u0111\u1ed1i t\u00e1c \u0111\u1ec3 l\u00e0m gi\u00e1n \u0111o\u1ea1n m\u1ed9t chi\u1ebfn d\u1ecbch gi\u00e1n \u0111i\u1ec7p m\u1ea1ng to\u00e0n c\u1ea7u d\u00f9ng m\u00e3 \u0111\u1ed9c GRIDTIDE. Nh\u00f3m \u0111\u1ee9ng sau ho\u1ea1t \u0111\u1ed9ng n\u00e0y \u0111\u01b0\u1ee3c Google theo d\u00f5i l\u00e0 UNC2814, m\u1ed9t t\u00e1c nh\u00e2n b\u1ecb nghi c\u00f3 li\u00ean h\u1ec7 v\u1edbi Trung Qu\u1ed1c, […]<\/p>\n","protected":false},"author":2,"featured_media":1689,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[200,255,201,254,230,253,257,176,252,256],"class_list":["post-1691","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-apt-trung-quoc","tag-c2","tag-gian-diep-mang","tag-google-sheets-api","tag-google-threat-intelligence-group","tag-gridtide","tag-linux-malware","tag-mandiant","tag-unc2814","tag-vien-thong"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1691","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1691"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1691\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1689"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1691"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1691"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1691"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}