{"id":1731,"date":"2026-07-07T07:16:12","date_gmt":"2026-07-07T00:16:12","guid":{"rendered":"https:\/\/vncybers.vn\/cisa-canh-bao-lo-hong-sharepoint-rce-bi-khai-thac-thuc-te-boi-cac-nhom-ransomware\/"},"modified":"2026-07-07T07:16:12","modified_gmt":"2026-07-07T00:16:12","slug":"cisa-canh-bao-lo-hong-sharepoint-rce-bi-khai-thac-thuc-te-boi-cac-nhom-ransomware","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/cisa-canh-bao-lo-hong-sharepoint-rce-bi-khai-thac-thuc-te-boi-cac-nhom-ransomware\/","title":{"rendered":"# CISA c\u1ea3nh b\u00e1o l\u1ed7 h\u1ed5ng SharePoint RCE b\u1ecb khai th\u00e1c th\u1ef1c t\u1ebf b\u1edfi c\u00e1c nh\u00f3m ransomware"},"content":{"rendered":"

C\u01a1 quan An ninh C\u01a1 s\u1edf h\u1ea1 t\u1ea7ng v\u00e0 An ninh m\u1ea1ng Hoa K\u1ef3 (CISA) v\u1eeba b\u1ed5 sung m\u1ed9t l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn Microsoft SharePoint Server v\u00e0o danh m\u1ee5c c\u00e1c l\u1ed7 h\u1ed5ng b\u1ecb khai th\u00e1c c\u00f4ng khai (KEV), sau khi x\u00e1c nh\u1eadn c\u00f3 b\u1eb1ng ch\u1ee9ng v\u1ec1 c\u00e1c ho\u1ea1t \u0111\u1ed9ng t\u1ea5n c\u00f4ng th\u1ef1c t\u1ebf nh\u1eafm v\u00e0o l\u1ed7 h\u1ed5ng n\u00e0y.<\/p>\n

L\u1ed7 h\u1ed5ng \u0111\u01b0\u1ee3c x\u00e1c \u0111\u1ecbnh m\u00e3 s\u1ed1 **CVE-2026-45659** (\u0111i\u1ec3m CVSS: 8.8), cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng th\u1ef1c thi m\u00e3 t\u1eeb xa (RCE) th\u00f4ng qua vi\u1ec7c gi\u1ea3i tu\u1ea7n t\u1ef1 h\u00f3a d\u1eef li\u1ec7u kh\u00f4ng tin c\u1eady (deserialization of untrusted data). V\u1ea5n \u0111\u1ec1 n\u00e0y \u0111\u00e3 \u0111\u01b0\u1ee3c Microsoft ph\u00e1t h\u00e0nh b\u1ea3n v\u00e1 v\u00e0o th\u00e1ng 5 n\u0103m 2026 cho c\u00e1c phi\u00ean b\u1ea3n SharePoint Server Subscription Edition, SharePoint Server 2019 v\u00e0 SharePoint Enterprise Server 2016.<\/p>\n

C\u01a1 ch\u1ebf t\u1ea5n c\u00f4ng v\u00e0 m\u1ee9c \u0111\u1ed9 nguy hi\u1ec3m<\/h2>\n

\"#<\/p>\n

Theo th\u00f4ng b\u00e1o t\u1eeb Microsoft, b\u1ea5t k\u1ef3 k\u1ebb t\u1ea5n c\u00f4ng n\u00e0o \u0111\u00e3 \u0111\u01b0\u1ee3c x\u00e1c th\u1ef1c (authenticated attacker) c\u0169ng c\u00f3 th\u1ec3 k\u00edch ho\u1ea1t l\u1ed7 h\u1ed5ng n\u00e0y m\u00e0 kh\u00f4ng c\u1ea7n quy\u1ec1n qu\u1ea3n tr\u1ecb ho\u1eb7c c\u00e1c \u0111\u1eb7c quy\u1ec1n n\u00e2ng cao. Trong m\u1ed9t cu\u1ed9c t\u1ea5n c\u00f4ng qua m\u1ea1ng, k\u1ebb t\u1ea5n c\u00f4ng ch\u1ec9 c\u1ea7n c\u00f3 quy\u1ec1n h\u1ea1n t\u1ed1i thi\u1ec3u c\u1ee7a m\u1ed9t “Site Member” (PR:L) l\u00e0 c\u00f3 th\u1ec3 th\u1ef1c thi m\u00e3 t\u1eeb xa tr\u00ean m\u00e1y ch\u1ee7 SharePoint b\u1ecb \u1ea3nh h\u01b0\u1edfng.<\/p>\n

D\u00f9 l\u1ed7 h\u1ed5ng ban \u0111\u1ea7u \u0111\u01b0\u1ee3c \u0111\u00e1nh gi\u00e1 l\u00e0 “Exploitation Less Likely” (\u00cdt c\u00f3 kh\u1ea3 n\u0103ng b\u1ecb khai th\u00e1c), nh\u01b0ng di\u1ec5n bi\u1ebfn th\u1ef1c t\u1ebf cho th\u1ea5y c\u00e1c nh\u00f3m t\u1ed9i ph\u1ea1m m\u1ea1ng \u0111\u00e3 nhanh ch\u00f3ng t\u1eadn d\u1ee5ng n\u00f3. Hi\u1ec7n t\u1ea1i, th\u00f4ng tin chi ti\u1ebft v\u1ec1 c\u00e1c nh\u00f3m t\u1ea5n c\u00f4ng c\u1ee5 th\u1ec3 c\u0169ng nh\u01b0 m\u1ee5c ti\u00eau cu\u1ed1i c\u00f9ng c\u1ee7a ch\u00fang v\u1eabn \u0111ang trong qu\u00e1 tr\u00ecnh \u0111i\u1ec1u tra.<\/p>\n

S\u1ef1 hi\u1ec7n di\u1ec7n c\u1ee7a hai nh\u00f3m t\u1ea5n c\u00f4ng song song<\/h2>\n

\u0110\u00e1ng ch\u00fa \u00fd, trong qu\u00e1 tr\u00ecnh \u0111i\u1ec1u tra m\u1ed9t v\u1ee5 t\u1ea5n c\u00f4ng ransomware g\u1ea7n \u0111\u00e2y, Microsoft \u0111\u00e3 ph\u00e1t hi\u1ec7n hai nh\u00f3m t\u1ea5n c\u00f4ng ho\u00e0n to\u00e0n kh\u00f4ng li\u00ean quan c\u00f9ng ho\u1ea1t \u0111\u1ed9ng \u0111\u1ed3ng th\u1eddi trong m\u1ed9t m\u1ea1ng l\u01b0\u1edbi. Ch\u00fang s\u1eed d\u1ee5ng c\u00e1c k\u1ef9 thu\u1eadt tinh vi \u0111\u1ec3 thi\u1ebft l\u1eadp quy\u1ec1n truy c\u1eadp b\u1ec1n v\u1eefng v\u00e0 g\u00e2y kh\u00f3 kh\u0103n cho n\u1ed7 l\u1ef1c \u1ee9ng ph\u00f3 s\u1ef1 c\u1ed1.<\/p>\n

M\u1ed9t trong s\u1ed1 c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng \u0111\u01b0\u1ee3c cho l\u00e0 do nh\u00f3m **Storm-2603** th\u1ef1c hi\u1ec7n. Nh\u00f3m n\u00e0y n\u1ed5i ti\u1ebfng v\u1edbi vi\u1ec7c tri\u1ec3n khai m\u00e3 \u0111\u1ed9c t\u1ed1ng ti\u1ec1n Warlock b\u1eb1ng c\u00e1ch khai th\u00e1c c\u00e1c l\u1ed7 h\u1ed5ng \u0111\u00e3 bi\u1ebft tr\u00ean m\u00e1y ch\u1ee7 SharePoint t\u1ea1i ch\u1ed7 (on-premises). Trong tr\u01b0\u1eddng h\u1ee3p n\u00e0y, k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 s\u1eed d\u1ee5ng c\u00e1c c\u00f4ng c\u1ee5 nh\u01b0 Velociraptor \u0111\u1ec3 ng\u1ee5y trang h\u00e0nh vi \u0111\u1ed9c h\u1ea1i d\u01b0\u1edbi d\u1ea1ng c\u00e1c ho\u1ea1t \u0111\u1ed9ng qu\u1ea3n tr\u1ecb h\u1ee3p ph\u00e1p.<\/p>\n

Ngo\u00e0i ra, ch\u00fang c\u00f2n thi\u1ebft l\u1eadp nhi\u1ec1u k\u00eanh truy c\u1eadp t\u1eeb xa th\u00f4ng qua Cloudflare tunneling, Zoho Assist v\u00e0 c\u00e1c k\u1ebft n\u1ed1i SSH \u0111\u01b0\u1ee3c c\u1ea5u h\u00ecnh qua Visual Studio Code. K\u1ebb t\u1ea5n c\u00f4ng c\u0169ng leo thang \u0111\u1eb7c quy\u1ec1n b\u1eb1ng c\u00e1ch t\u1ea1o c\u00e1c t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb vi\u00ean c\u1ee5c b\u1ed9 v\u00e0 t\u00ean mi\u1ec1n m\u1edbi, \u0111\u1ed3ng th\u1eddi l\u1ea1m d\u1ee5ng c\u00e1c tr\u00ecnh \u0111i\u1ec1u khi\u1ec3n d\u1ec5 b\u1ecb t\u1ed5n th\u01b0\u01a1ng \u0111\u1ec3 v\u00f4 hi\u1ec7u h\u00f3a c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o v\u1ec7 an ninh.<\/p>\n

B\u00e0i h\u1ecdc cho c\u00e1c t\u1ed5 ch\u1ee9c<\/h2>\n

S\u1ef1 vi\u1ec7c n\u00e0y cho th\u1ea5y m\u1ed9t v\u1ee5 t\u1ea5n c\u00f4ng ransomware t\u01b0\u1edfng ch\u1eebng \u0111\u01a1n l\u1ebb c\u00f3 th\u1ec3 nhanh ch\u00f3ng m\u1edf r\u1ed9ng th\u00e0nh m\u1ed9t k\u1ecbch b\u1ea3n ph\u1ee9c t\u1ea1p v\u1edbi nhi\u1ec1u t\u00e1c nh\u00e2n c\u00f9ng t\u1ed3n t\u1ea1i. \u0110\u1ed1i v\u1edbi c\u00e1c \u0111\u1ed9i ng\u0169 an ninh, c\u00e1c t\u00edn hi\u1ec7u ri\u00eang l\u1ebb hi\u1ebfm khi ph\u1ea3n \u00e1nh to\u00e0n b\u1ed9 c\u00e2u chuy\u1ec7n c\u1ee7a m\u1ed9t cu\u1ed9c x\u00e2m nh\u1eadp.<\/p>\n

CISA \u0111\u00e3 khuy\u1ebfn ngh\u1ecb c\u00e1c c\u01a1 quan li\u00ean bang v\u00e0 c\u00e1c t\u1ed5 ch\u1ee9c c\u1ea7n \u00e1p d\u1ee5ng c\u00e1c b\u1ea3n v\u00e1 l\u1ed7i tr\u01b0\u1edbc ng\u00e0y 4 th\u00e1ng 7 n\u0103m 2026 \u0111\u1ec3 ng\u0103n ch\u1eb7n r\u1ee7i ro. Vi\u1ec7c c\u1eadp nh\u1eadt k\u1ecbp th\u1eddi kh\u00f4ng ch\u1ec9 b\u1ea3o v\u1ec7 d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m m\u00e0 c\u00f2n ng\u0103n ch\u1eb7n nguy c\u01a1 b\u1ecb chi\u1ebfm quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n to\u00e0n b\u1ed9 m\u00e1y ch\u1ee7 doanh nghi\u1ec7p.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb The Hacker News v\u00e0 Microsoft Security<\/em><\/p>","protected":false},"excerpt":{"rendered":"

C\u01a1 quan An ninh C\u01a1 s\u1edf h\u1ea1 t\u1ea7ng v\u00e0 An ninh m\u1ea1ng Hoa K\u1ef3 (CISA) v\u1eeba b\u1ed5 sung m\u1ed9t l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn Microsoft SharePoint Server v\u00e0o danh m\u1ee5c c\u00e1c l\u1ed7 h\u1ed5ng b\u1ecb khai th\u00e1c c\u00f4ng khai (KEV), sau khi x\u00e1c nh\u1eadn c\u00f3 b\u1eb1ng ch\u1ee9ng v\u1ec1 c\u00e1c ho\u1ea1t \u0111\u1ed9ng t\u1ea5n c\u00f4ng th\u1ef1c […]<\/p>\n","protected":false},"author":2,"featured_media":1729,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[10,20],"class_list":["post-1731","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kien-thuc","tag-facebook","tag-vercel"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1731","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1731"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1731\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1729"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1731"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1731"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1731"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}