{"id":1934,"date":"2026-08-16T07:23:01","date_gmt":"2026-08-16T00:23:01","guid":{"rendered":"https:\/\/vncybers.vn\/ho-so-jewelbug-xg-web-gian-diep-lua-dao-tien-ma-hoa\/"},"modified":"2026-08-16T16:55:56","modified_gmt":"2026-08-16T09:55:56","slug":"ho-so-jewelbug-xg-web-gian-diep-lua-dao-tien-ma-hoa","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/ho-so-jewelbug-xg-web-gian-diep-lua-dao-tien-ma-hoa\/","title":{"rendered":"H\u1ed3 s\u01a1 Jewelbug: XG-Web v\u00e0 chi\u1ebfn d\u1ecbch gi\u00e1n \u0111i\u1ec7p ki\u00eam l\u1eeba \u0111\u1ea3o ti\u1ec1n m\u00e3 h\u00f3a"},"content":{"rendered":"

Nh\u00f3m \u0111e d\u1ecda li\u00ean k\u1ebft v\u1edbi Trung Qu\u1ed1c \u0111\u01b0\u1ee3c theo d\u00f5i d\u01b0\u1edbi t\u00ean Jewelbug \u0111ang cho th\u1ea5y m\u1ed9t m\u00f4 h\u00ecnh v\u1eadn h\u00e0nh \u0111\u00e1ng ch\u00fa \u00fd: c\u00f9ng m\u1ed9t n\u1ec1n t\u1ea3ng \u0111i\u1ec1u khi\u1ec3n c\u00f3 th\u1ec3 ph\u1ee5c v\u1ee5 c\u1ea3 gi\u00e1n \u0111i\u1ec7p m\u1ea1ng nh\u1eb1m v\u00e0o ch\u00ednh ph\u1ee7, qu\u00e2n \u0111\u1ed9i v\u00e0 ho\u1ea1t \u0111\u1ed9ng l\u1eeba \u0111\u1ea3o ti\u1ec1n m\u00e3 h\u00f3a v\u00ec l\u1ee3i nhu\u1eadn. Theo ph\u00e2n t\u00edch c\u1ee7a Symantec v\u00e0 Carbon Black thu\u1ed9c Broadcom, trung t\u00e2m c\u1ee7a h\u1ec7 sinh th\u00e1i n\u00e0y l\u00e0 XG-Web, m\u1ed9t khung truy c\u1eadp t\u1eeb xa v\u00e0 \u0111\u00e1nh c\u1eafp th\u00f4ng tin \u0111\u1eb7t tr\u1ecdng t\u00e2m v\u00e0o tr\u00ecnh duy\u1ec7t.<\/p>\n

\u0110i\u1ec3m \u0111\u00e1ng lo kh\u00f4ng ch\u1ec9 n\u1eb1m \u1edf m\u1ed9t ti\u1ec7n \u00edch m\u1edf r\u1ed9ng \u0111\u1ed9c h\u1ea1i hay m\u1ed9t backdoor \u0111\u01a1n l\u1ebb. Jewelbug \u0111\u01b0\u1ee3c m\u00f4 t\u1ea3 l\u00e0 nh\u00f3m hacker-for-hire c\u00f3 nhi\u1ec1u th\u1ebf h\u1ec7 m\u00e3 \u0111i\u1ec1u khi\u1ec3n, implant cho tr\u00ecnh duy\u1ec7t, Windows, Linux, m\u00e1y ch\u1ee7 v\u00e0 thi\u1ebft b\u1ecb m\u1ea1ng. T\u1ea5t c\u1ea3 d\u1eef li\u1ec7u n\u1ea1n nh\u00e2n \u0111\u01b0\u1ee3c \u0111\u01b0a v\u1ec1 m\u1ed9t c\u01a1 s\u1edf d\u1eef li\u1ec7u chung, gi\u00fap nh\u00f3m v\u1eadn h\u00e0nh nhi\u1ec1u m\u1ee5c ti\u00eau song song m\u00e0 v\u1eabn duy tr\u00ec kh\u1ea3 n\u0103ng theo d\u00f5i t\u1eadp trung.<\/p>\n

XG-Web bi\u1ebfn tr\u00ecnh duy\u1ec7t th\u00e0nh k\u00eanh \u0111i\u1ec1u khi\u1ec3n<\/h2>\n

XG-Web \u0111\u01b0\u1ee3c x\u00e2y d\u1ef1ng nh\u01b0 m\u1ed9t b\u1ea3ng \u0111i\u1ec1u khi\u1ec3n React, backend Node.js v\u00e0 c\u01a1 s\u1edf d\u1eef li\u1ec7u MySQL. N\u1ec1n t\u1ea3ng n\u00e0y cho ph\u00e9p to\u00e1n t\u1eed ki\u1ec3m so\u00e1t tr\u00ecnh duy\u1ec7t n\u1ea1n nh\u00e2n, thu th\u1eadp cookie, l\u1ecbch s\u1eed duy\u1ec7t web, bookmark, \u1ea3nh ch\u1ee5p m\u00e0n h\u00ecnh, clipboard, th\u00f4ng tin \u0111\u0103ng nh\u1eadp v\u00e0 l\u01b0u l\u01b0\u1ee3ng web. C\u00e1c payload \u0111\u01b0\u1ee3c l\u00e0m r\u1ed1i v\u00e0 l\u01b0u qua Google Docs c\u00f4ng khai, trong khi t\u00ean mi\u1ec1n \u0111i\u1ec1u khi\u1ec3n \u0111\u01b0\u1ee3c ng\u1ee5y trang gi\u1ed1ng t\u00e0i nguy\u00ean quen thu\u1ed9c nh\u01b0 Google Fonts.<\/p>\n

Implant n\u1ed5i b\u1eadt nh\u1ea5t l\u00e0 ti\u1ec7n \u00edch m\u1edf r\u1ed9ng \u0111\u1ed9c h\u1ea1i mang t\u00ean PDF Viewer, c\u00f3 th\u1ec3 ho\u1ea1t \u0111\u1ed9ng tr\u00ean Chrome v\u00e0 Firefox. Sau khi \u0111\u01b0\u1ee3c c\u00e0i, ti\u1ec7n \u00edch xin c\u00e1c quy\u1ec1n nguy hi\u1ec3m nh\u01b0 truy c\u1eadp cookie, debugger, native messaging, ch\u1eb7n web request v\u00e0 ch\u1ea1y script tr\u00ean m\u1ecdi trang. \u0110\u1ec3 tho\u00e1t kh\u1ecfi gi\u1edbi h\u1ea1n sandbox c\u1ee7a tr\u00ecnh duy\u1ec7t, ti\u1ec7n \u00edch giao ti\u1ebfp v\u1edbi m\u1ed9t helper Windows c\u00f3 t\u00ean \u0111\u00e1nh l\u1eeba l\u00e0 com.microsoft.runedge, t\u1eeb \u0111\u00f3 ch\u1ea1y l\u1ec7nh qua Windows command interpreter.<\/p>\n

\"S\u01a1<\/p>\n

M\u1ed9t nh\u00f3m, hai \u0111\u1ed9ng c\u01a1<\/h2>\n

Jewelbug \u0111\u01b0\u1ee3c cho l\u00e0 nh\u1eafm v\u00e0o t\u1ed5 ch\u1ee9c ch\u00ednh ph\u1ee7 v\u00e0 qu\u00e2n s\u1ef1 \u1edf Trung \u0110\u00f4ng, \u0110\u00f4ng Nam \u00c1 v\u00e0 Nam \u00c1. Trong m\u1ed9t chi\u1ebfn d\u1ecbch l\u1edbn, nh\u00f3m \u0111\u00e3 x\u00e2m nh\u1eadp nh\u00e0 cung c\u1ea5p hosting \u0111\u1ec3 ch\u00e8n m\u00e3 JavaScript v\u00e0o h\u1ec7 th\u1ed1ng webmail d\u00f9ng b\u1edfi nhi\u1ec1u b\u1ed9 ng\u00e0nh c\u1ee7a m\u1ed9t ch\u00ednh ph\u1ee7 Trung \u0110\u00f4ng. M\u00e3 \u0111\u1ed9c k\u00edch ho\u1ea1t \u1edf trang \u0111\u0103ng nh\u1eadp v\u00e0 giao di\u1ec7n h\u1ed9p th\u01b0, \u0111\u00e1nh c\u1eafp cookie qua WebSocket r\u1ed3i ch\u1ec9 tri\u1ec3n khai b\u01b0\u1edbc ti\u1ebfp theo n\u1ebfu n\u1ea1n nh\u00e2n kh\u1edbp \u0111i\u1ec1u ki\u1ec7n m\u1ee5c ti\u00eau.<\/p>\n

Song song v\u1edbi ho\u1ea1t \u0111\u1ed9ng gi\u00e1n \u0111i\u1ec7p, nh\u00f3m c\u00f2n v\u1eadn h\u00e0nh chi\u1ebfn d\u1ecbch t\u00e0i ch\u00ednh nh\u1eafm v\u00e0o ng\u01b0\u1eddi d\u00f9ng ti\u1ec1n m\u00e3 h\u00f3a n\u00f3i ti\u1ebfng Trung th\u00f4ng qua c\u00e1c c\u1ed5ng t\u1ea3i gi\u1ea3 m\u1ea1o s\u00e0n giao d\u1ecbch. Module clipboard c\u00f3 kh\u1ea3 n\u0103ng thay th\u1ebf \u0111\u1ecba ch\u1ec9 v\u00ed ti\u1ec1n m\u00e3 h\u00f3a \u0111\u01b0\u1ee3c sao ch\u00e9p b\u1eb1ng \u0111\u1ecba ch\u1ec9 c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng, d\u00f9 b\u00e1o c\u00e1o cho bi\u1ebft ch\u1ee9c n\u0103ng n\u00e0y ch\u01b0a ghi nh\u1eadn k\u00edch ho\u1ea1t quy t\u1eafc thay th\u1ebf trong giai \u0111o\u1ea1n theo d\u00f5i.<\/p>\n

Quy m\u00f4 d\u1eef li\u1ec7u b\u1ecb thu th\u1eadp<\/h2>\n

Theo Broadcom, h\u1ea1 t\u1ea7ng c\u1ee7a chi\u1ebfn d\u1ecbch \u0111\u00e3 ghi nh\u1eadn h\u01a1n m\u1ed9t tri\u1ec7u d\u00f2ng check-in t\u1eeb implant, h\u01a1n 580.000 cookie tr\u00ecnh duy\u1ec7t b\u1ecb \u0111\u00e1nh c\u1eafp, h\u00e0ng ngh\u00ecn th\u00f4ng tin \u0111\u0103ng nh\u1eadp v\u00e0 \u00edt nh\u1ea5t 2.300 n\u1ed9i dung email b\u1ecb tr\u00edch xu\u1ea5t. Log m\u00e1y ch\u1ee7 c\u0169ng ghi nh\u1eadn kho\u1ea3ng 1,1 tri\u1ec7u s\u1ef1 ki\u1ec7n \u0111\u1ecbnh v\u1ecb \u0111\u1ecba l\u00fd t\u1eeb kho\u1ea3ng 4.300 \u0111\u1ecba ch\u1ec9 IP ngu\u1ed3n kh\u00e1c nhau.<\/p>\n

Nh\u1eefng con s\u1ed1 n\u00e0y cho th\u1ea5y Jewelbug kh\u00f4ng ch\u1ec9 l\u00e0 m\u1ed9t chi\u1ebfn d\u1ecbch l\u1ebb, m\u00e0 l\u00e0 m\u1ed9t h\u1ec7 sinh th\u00e1i t\u1ea5n c\u00f4ng \u0111\u01b0\u1ee3c v\u1eadn h\u00e0nh c\u00f3 t\u1ed5 ch\u1ee9c. Vi\u1ec7c c\u00f9ng l\u00fac ki\u1ec3m so\u00e1t tr\u00ecnh duy\u1ec7t, endpoint, m\u00e1y ch\u1ee7 Linux v\u00e0 thi\u1ebft b\u1ecb m\u1ea1ng gi\u00fap nh\u00f3m m\u1edf r\u1ed9ng t\u1eeb m\u1ed9t t\u00e0i kho\u1ea3n ho\u1eb7c m\u1ed9t ti\u1ec7n \u00edch \u0111\u1ed9c h\u1ea1i th\u00e0nh quy\u1ec1n quan s\u00e1t s\u00e2u h\u01a1n trong m\u00f4i tr\u01b0\u1eddng n\u1ed9i b\u1ed9.<\/p>\n

Defensive Lessons<\/h2>\n

V\u1edbi t\u1ed5 ch\u1ee9c, h\u1ed3 s\u01a1 Jewelbug nh\u1ea5n m\u1ea1nh t\u1ea7m quan tr\u1ecdng c\u1ee7a vi\u1ec7c gi\u00e1m s\u00e1t ti\u1ec7n \u00edch tr\u00ecnh duy\u1ec7t, native messaging host, h\u00e0nh vi truy c\u1eadp cookie v\u00e0 c\u00e1c k\u1ebft n\u1ed1i WebSocket b\u1ea5t th\u01b0\u1eddng trong webmail. C\u00e1c \u0111\u1ed9i b\u1ea3o m\u1eadt c\u1ea7n xem tr\u00ecnh duy\u1ec7t l\u00e0 m\u1ed9t b\u1ec1 m\u1eb7t t\u1ea5n c\u00f4ng tr\u1ecdng y\u1ebfu, kh\u00f4ng ch\u1ec9 l\u00e0 \u1ee9ng d\u1ee5ng ng\u01b0\u1eddi d\u00f9ng cu\u1ed1i.<\/p>\n

V\u1edbi c\u00e1 nh\u00e2n, \u0111\u1eb7c bi\u1ec7t l\u00e0 ng\u01b0\u1eddi d\u00f9ng ti\u1ec1n m\u00e3 h\u00f3a, r\u1ee7i ro \u0111\u1ebfn t\u1eeb c\u1ed5ng t\u1ea3i gi\u1ea3 m\u1ea1o v\u00e0 ti\u1ec7n \u00edch tr\u00ecnh duy\u1ec7t kh\u00f4ng r\u00f5 ngu\u1ed3n g\u1ed1c v\u1eabn r\u1ea5t l\u1edbn. C\u1ea7n t\u1ea3i ph\u1ea7n m\u1ec1m t\u1eeb ngu\u1ed3n ch\u00ednh th\u1ee9c, ki\u1ec3m tra quy\u1ec1n c\u1ee7a extension, h\u1ea1n ch\u1ebf \u0111\u0103ng nh\u1eadp v\u00ed ho\u1eb7c s\u00e0n giao d\u1ecbch tr\u00ean m\u00f4i tr\u01b0\u1eddng \u0111\u00e3 c\u00e0i nhi\u1ec1u ti\u1ec7n \u00edch, \u0111\u1ed3ng th\u1eddi x\u00e1c minh \u0111\u1ecba ch\u1ec9 v\u00ed tr\u01b0\u1edbc khi x\u00e1c nh\u1eadn giao d\u1ecbch.<\/p>\n

Tr\u01b0\u1eddng h\u1ee3p Jewelbug c\u0169ng cho th\u1ea5y ranh gi\u1edbi gi\u1eefa gi\u00e1n \u0111i\u1ec7p m\u1ea1ng v\u00e0 t\u1ed9i ph\u1ea1m t\u00e0i ch\u00ednh ng\u00e0y c\u00e0ng m\u1edd. M\u1ed9t h\u1ea1 t\u1ea7ng t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c d\u00f9ng \u0111\u1ec3 thu th\u1eadp t\u00ecnh b\u00e1o, ki\u1ebfm ti\u1ec1n v\u00e0 th\u1eed nghi\u1ec7m k\u1ef9 thu\u1eadt che gi\u1ea5u c\u00f9ng l\u00fac. \u0110\u00e2y l\u00e0 l\u00fd do c\u00e1c t\u1ed5 ch\u1ee9c c\u1ea7n k\u1ebft h\u1ee3p t\u00ecnh b\u00e1o m\u1ed1i \u0111e d\u1ecda, ki\u1ec3m so\u00e1t tr\u00ecnh duy\u1ec7t v\u00e0 s\u0103n t\u00ecm d\u1ea5u hi\u1ec7u h\u1eadu khai th\u00e1c trong m\u1ed9t quy tr\u00ecnh ph\u00f2ng th\u1ee7 th\u1ed1ng nh\u1ea5t.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb The Hacker News v\u00e0 Broadcom Symantec<\/em><\/p>","protected":false},"excerpt":{"rendered":"

H\u1ed3 s\u01a1 Jewelbug cho th\u1ea5y c\u00e1ch XG-Web bi\u1ebfn tr\u00ecnh duy\u1ec7t th\u00e0nh k\u00eanh \u0111i\u1ec1u khi\u1ec3n ph\u1ee5c v\u1ee5 c\u1ea3 gi\u00e1n \u0111i\u1ec7p m\u1ea1ng v\u00e0 l\u1eeba \u0111\u1ea3o ti\u1ec1n m\u00e3 h\u00f3a.<\/p>","protected":false},"author":2,"featured_media":1933,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[638,636,637,541,634,635],"class_list":["post-1934","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-broadcom-symantec","tag-browser-extension-malware","tag-cryptocurrency-fraud","tag-cyber-espionage","tag-jewelbug","tag-xg-web"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1934","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1934"}],"version-history":[{"count":2,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1934\/revisions"}],"predecessor-version":[{"id":1936,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1934\/revisions\/1936"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1933"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1934"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1934"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1934"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}