{"id":1991,"date":"2026-09-01T07:26:07","date_gmt":"2026-09-01T00:26:07","guid":{"rendered":"https:\/\/vncybers.vn\/canh-bao-fire-ant-router-cisco-ios-xr-tacacs-do-tham\/"},"modified":"2026-09-01T07:26:07","modified_gmt":"2026-09-01T00:26:07","slug":"canh-bao-fire-ant-router-cisco-ios-xr-tacacs-do-tham","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/canh-bao-fire-ant-router-cisco-ios-xr-tacacs-do-tham\/","title":{"rendered":"Fire Ant warning: Chinese hacker group turns Cisco routers into spying platform"},"content":{"rendered":"

M\u1ed9t chi\u1ebfn d\u1ecbch gi\u00e1n \u0111i\u1ec7p m\u1ea1ng li\u00ean h\u1ec7 Trung Qu\u1ed1c \u0111\u01b0\u1ee3c theo d\u00f5i v\u1edbi t\u00ean Fire Ant \u0111\u00e3 m\u1edf r\u1ed9ng t\u1eeb m\u00f4i tr\u01b0\u1eddng VMware sang c\u00e1c l\u1edbp h\u1ea1 t\u1ea7ng \u0111\u01b0\u1ee3c tin c\u1eady h\u01a1n, g\u1ed3m router Cisco IOS XR, m\u00e1y ch\u1ee7 TACACS v\u00e0 m\u00e1y ch\u1ee7 Linux qu\u1ea3n tr\u1ecb m\u1ea1ng. Theo ph\u00e2n t\u00edch c\u1ee7a Sygnia, c\u00e1c thi\u1ebft b\u1ecb n\u00e0y b\u1ecb l\u1ee3i d\u1ee5ng \u0111\u1ec3 thu th\u1eadp l\u01b0u l\u01b0\u1ee3ng, \u0111\u00e1nh c\u1eafp th\u00f4ng tin \u0111\u0103ng nh\u1eadp v\u00e0 l\u00e0m suy y\u1ebfu kh\u1ea3 n\u0103ng ghi log c\u1ee7a \u0111\u1ed9i ph\u00f2ng th\u1ee7.<\/p>\n

V\u1ee5 vi\u1ec7c \u0111\u00e1ng ch\u00fa \u00fd v\u00ec router, m\u00e1y ch\u1ee7 x\u00e1c th\u1ef1c v\u00e0 m\u00e1y ch\u1ee7 nh\u1ea3y th\u01b0\u1eddng n\u1eb1m \u1edf v\u1ecb tr\u00ed trung t\u00e2m trong m\u1ea1ng doanh nghi\u1ec7p. Khi nh\u1eefng th\u00e0nh ph\u1ea7n n\u00e0y b\u1ecb ki\u1ec3m so\u00e1t, k\u1ebb t\u1ea5n c\u00f4ng kh\u00f4ng ch\u1ec9 c\u00f3 th\u00eam \u0111\u01b0\u1eddng \u0111i ngang trong h\u1ec7 th\u1ed1ng m\u00e0 c\u00f2n c\u00f3 g\u00f3c nh\u00ecn tr\u1ef1c ti\u1ebfp v\u00e0o lu\u1ed3ng d\u1eef li\u1ec7u, phi\u00ean qu\u1ea3n tr\u1ecb v\u00e0 b\u1eb1ng ch\u1ee9ng \u0111i\u1ec1u tra.<\/p>\n

\"Thi\u1ebft<\/p>\n

Chi\u1ebfn d\u1ecbch b\u1eaft \u0111\u1ea7u t\u1eeb m\u1ed9t d\u1ea5u hi\u1ec7u b\u1ea5t th\u01b0\u1eddng tr\u00ean router Cisco<\/h2>\n

Sygnia cho bi\u1ebft cu\u1ed9c \u0111i\u1ec1u tra b\u1eaft \u0111\u1ea7u khi ph\u00e1t hi\u1ec7n m\u1ed9t giao di\u1ec7n GRE tunnel \u0111ang ho\u1ea1t \u0111\u1ed9ng tr\u00ean router Cisco IOS XR nh\u01b0ng kh\u00f4ng c\u00f3 c\u1ea5u h\u00ecnh \u0111ang ch\u1ea1y ho\u1eb7c l\u1ecbch s\u1eed commit n\u00e0o gi\u1ea3i th\u00edch vi\u1ec7c t\u1ea1o tunnel \u0111\u00f3. T\u1eeb \u0111i\u1ec3m b\u1ea5t th\u01b0\u1eddng n\u00e0y, nh\u00f3m \u0111i\u1ec1u tra l\u1ea7n ra m\u1ed9t m\u00e1y ch\u1ee7 Linux c\u0169 \u0111\u01b0\u1ee3c d\u00f9ng \u0111\u1ec3 d\u00f2 qu\u00e9t c\u1ed5ng v\u00e0 th\u1eed k\u1ebft n\u1ed1i t\u1edbi c\u00e1c d\u1ecbch v\u1ee5 qu\u1ea3n tr\u1ecb nh\u01b0 SSH, HTTP, SMB v\u00e0 RDP trong c\u00e1c m\u1ea1ng li\u00ean quan.<\/p>\n

The Hacker News d\u1eabn ph\u00e2n t\u00edch c\u1ee7a Sygnia cho bi\u1ebft m\u00e3 \u0111\u1ed9c tr\u00ean router \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf ri\u00eang cho control plane c\u1ee7a IOS XR, thay v\u00ec ch\u1ec9 l\u00e0 c\u00f4ng c\u1ee5 Linux th\u00f4ng th\u01b0\u1eddng. M\u1ed9t th\u00e0nh ph\u1ea7n s\u1eeda \u0111\u1ed5i th\u01b0 vi\u1ec7n h\u1ec7 th\u1ed1ng \u0111\u1ec3 ch\u1ec9 chuy\u1ec3n ti\u1ebfp m\u1ed9t s\u1ed1 th\u00f4ng \u0111i\u1ec7p log nh\u1ea5t \u0111\u1ecbnh, trong khi th\u00e0nh ph\u1ea7n kh\u00e1c can thi\u1ec7p \u0111\u01b0\u1eddng th\u1ef1c thi l\u1ec7nh nh\u1eb1m th\u00eam b\u1ed9 l\u1ecdc v\u00e0o c\u00e1c l\u1ec7nh show<\/strong>, qua \u0111\u00f3 che gi\u1ea5u c\u1ea5u h\u00ecnh tunnel kh\u1ecfi qu\u1ea3n tr\u1ecb vi\u00ean.<\/p>\n

TACACS tr\u1edf th\u00e0nh \u0111i\u1ec3m thu th\u1eadp th\u00f4ng tin \u0111\u0103ng nh\u1eadp<\/h2>\n

Tr\u00ean m\u00e1y ch\u1ee7 TACACS, Sygnia ph\u00e1t hi\u1ec7n b\u1ed9 c\u00f4ng c\u1ee5 thu th\u1eadp th\u00f4ng tin \u0111\u0103ng nh\u1eadp \u0111\u01b0\u1ee3c \u0111\u1eb7t t\u00ean l\u00e0 TacTap. D\u1eef li\u1ec7u b\u1ecb ghi v\u00e0o t\u1ec7p \/var\/log\/.tacplus.acct<\/strong> v\u00e0 \u0111\u01b0\u1ee3c l\u00e0m r\u1ed1i nh\u1eb9 b\u1eb1ng kh\u00f3a XOR m\u1ed9t byte 0xEF<\/strong>. K\u1ef9 thu\u1eadt ch\u00e8n th\u01b0 vi\u1ec7n v\u00e0o tac_plus n\u00e0y \u0111\u01b0\u1ee3c Sygnia \u0111\u00e1nh gi\u00e1 l\u00e0 m\u1ed9t b\u01b0\u1edbc ti\u1ebfn \u0111\u00e1ng ch\u00fa \u00fd trong c\u00e1ch Fire Ant nh\u1eafm v\u00e0o h\u1ec7 th\u1ed1ng x\u00e1c th\u1ef1c qu\u1ea3n tr\u1ecb.<\/p>\n

Ngo\u00e0i TACACS, nh\u00f3m t\u1ea5n c\u00f4ng c\u00f2n tri\u1ec3n khai backdoor Linux BridgeAgent, ng\u1ee5y trang nh\u01b0 t\u00e1c nh\u00e2n gi\u00e1m s\u00e1t Zabbix, c\u00f9ng c\u00e1c rootkit ngu\u1ed3n m\u1edf nh\u01b0 Medusa v\u00e0 REPTILE. M\u1ed9t s\u1ed1 th\u00e0nh ph\u1ea7n \u0111\u01b0\u1ee3c \u0111\u1eb7t t\u00ean v\u00e0 ch\u1ec9nh d\u1ea5u th\u1eddi gian \u0111\u1ec3 tr\u00f4ng gi\u1ed1ng t\u00e1c nh\u00e2n b\u1ea3o m\u1eadt SentinelOne ho\u1eb7c Cybereason, nh\u1eb1m gi\u1ea3m kh\u1ea3 n\u0103ng b\u1ecb ch\u00fa \u00fd trong qu\u00e1 tr\u00ecnh r\u00e0 so\u00e1t th\u1ee7 c\u00f4ng.<\/p>\n

\u00dd ngh\u0129a v\u1edbi \u0111\u1ed9i v\u1eadn h\u00e0nh an ninh<\/h2>\n

\u0110i\u1ec3m nguy hi\u1ec3m c\u1ee7a chi\u1ebfn d\u1ecbch kh\u00f4ng n\u1eb1m ri\u00eang \u1edf m\u1ed9t thi\u1ebft b\u1ecb b\u1ecb x\u00e2m nh\u1eadp, m\u00e0 \u1edf vi\u1ec7c k\u1ebb t\u1ea5n c\u00f4ng ki\u1ec3m so\u00e1t ch\u00ednh l\u1edbp h\u1ea1 t\u1ea7ng d\u00f9ng \u0111\u1ec3 \u0111\u1ecbnh tuy\u1ebfn, x\u00e1c th\u1ef1c v\u00e0 ghi nh\u1eadn ho\u1ea1t \u0111\u1ed9ng qu\u1ea3n tr\u1ecb. N\u1ebfu log tr\u00ean router, trap SNMP ho\u1eb7c l\u1ecbch s\u1eed \u0111\u0103ng nh\u1eadp \u0111\u00e3 b\u1ecb ch\u1ec9nh s\u1eeda, vi\u1ec7c ch\u1ec9 d\u1ef1a v\u00e0o m\u1ed9t ngu\u1ed3n telemetry c\u00f3 th\u1ec3 khi\u1ebfn \u0111i\u1ec1u tra vi\u00ean b\u1ecf s\u00f3t d\u1ea5u v\u1ebft quan tr\u1ecdng.<\/p>\n

Sygnia khuy\u1ebfn ngh\u1ecb xem router, TACACS server, hypervisor v\u00e0 jump host l\u00e0 t\u00e0i s\u1ea3n ph\u00e1p ch\u1ee9ng c\u1ea5p m\u1ed9t. C\u00e1c t\u1ed5 ch\u1ee9c n\u00ean \u0111\u1ed1i chi\u1ebfu b\u1eb1ng ch\u1ee9ng t\u1eeb b\u1ed9 nh\u1edb, \u1ed5 \u0111\u0129a, l\u01b0u l\u01b0\u1ee3ng m\u1ea1ng, c\u1ea5u h\u00ecnh thi\u1ebft b\u1ecb v\u00e0 h\u1ec7 th\u1ed1ng x\u00e1c th\u1ef1c, thay v\u00ec m\u1eb7c \u0111\u1ecbnh r\u1eb1ng log c\u1ee7a thi\u1ebft b\u1ecb m\u1ea1ng lu\u00f4n ph\u1ea3n \u00e1nh \u0111\u1ea7y \u0111\u1ee7 s\u1ef1 th\u1eadt.<\/p>\n

Recommended defenses<\/h2>\n

Doanh nghi\u1ec7p v\u1eadn h\u00e0nh Cisco IOS XR ho\u1eb7c c\u00e1c h\u1ec7 th\u1ed1ng x\u00e1c th\u1ef1c qu\u1ea3n tr\u1ecb t\u1eadp trung n\u00ean r\u00e0 so\u00e1t c\u00e1c tunnel kh\u00f4ng c\u00f3 l\u1ecbch s\u1eed c\u1ea5u h\u00ecnh r\u00f5 r\u00e0ng, ki\u1ec3m tra thay \u0111\u1ed5i b\u1ea5t th\u01b0\u1eddng trong th\u01b0 vi\u1ec7n h\u1ec7 th\u1ed1ng, ti\u1ebfn tr\u00ecnh n\u1ec1n v\u00e0 t\u1ec7p log nh\u1ea1y c\u1ea3m. C\u00e1c t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb d\u00f9ng qua TACACS c\u1ea7n \u0111\u01b0\u1ee3c \u0111\u00e1nh gi\u00e1 l\u1ea1i ph\u1ea1m vi quy\u1ec1n, bu\u1ed9c xoay v\u00f2ng m\u1eadt kh\u1ea9u n\u1ebfu c\u00f3 d\u1ea5u hi\u1ec7u l\u1ed9 l\u1ecdt v\u00e0 b\u1ed5 sung x\u00e1c th\u1ef1c \u0111a y\u1ebfu t\u1ed1 \u1edf nh\u1eefng \u0111i\u1ec3m h\u1ed7 tr\u1ee3.<\/p>\n

\u0110\u1ed9i SOC c\u0169ng n\u00ean \u0111\u01b0a thi\u1ebft b\u1ecb m\u1ea1ng v\u00e0 m\u00e1y ch\u1ee7 qu\u1ea3n tr\u1ecb v\u00e0o k\u1ebf ho\u1ea1ch s\u0103n t\u00ecm m\u1ed1i \u0111e d\u1ecda \u0111\u1ecbnh k\u1ef3. V\u1edbi c\u00e1c m\u00f4i tr\u01b0\u1eddng c\u00f3 gi\u00e1 tr\u1ecb cao, vi\u1ec7c thu th\u1eadp c\u1ea5u h\u00ecnh, snapshot b\u1ed9 nh\u1edb, d\u1ea5u v\u1ebft PCAP v\u00e0 log t\u1eeb ngu\u1ed3n \u0111\u1ed9c l\u1eadp s\u1ebd gi\u00fap gi\u1ea3m r\u1ee7i ro b\u1ecb \u0111\u00e1nh l\u1eeba khi k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 ki\u1ec3m so\u00e1t l\u1edbp h\u1ea1 t\u1ea7ng tin c\u1eady.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb Sygnia, The Hacker News v\u00e0 BleepingComputer<\/em><\/p>","protected":false},"excerpt":{"rendered":"

M\u1ed9t chi\u1ebfn d\u1ecbch gi\u00e1n \u0111i\u1ec7p m\u1ea1ng li\u00ean h\u1ec7 Trung Qu\u1ed1c \u0111\u01b0\u1ee3c theo d\u00f5i v\u1edbi t\u00ean Fire Ant \u0111\u00e3 m\u1edf r\u1ed9ng t\u1eeb m\u00f4i tr\u01b0\u1eddng VMware sang c\u00e1c l\u1edbp h\u1ea1 t\u1ea7ng \u0111\u01b0\u1ee3c tin c\u1eady h\u01a1n, g\u1ed3m router Cisco IOS XR, m\u00e1y ch\u1ee7 TACACS v\u00e0 m\u00e1y ch\u1ee7 Linux qu\u1ea3n tr\u1ecb m\u1ea1ng. Theo ph\u00e2n t\u00edch c\u1ee7a Sygnia, c\u00e1c thi\u1ebft […]<\/p>\n","protected":false},"author":2,"featured_media":1990,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[749,744,743,201,750,751,746,747,745,748],"class_list":["post-1991","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-bridgeagent","tag-cisco-ios-xr","tag-fire-ant","tag-gian-diep-mang","tag-medusa-rootkit","tag-reptile-rootkit","tag-router-cisco","tag-sygnia","tag-tacacs","tag-trung-quoc"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1991","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1991"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1991\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1990"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1991"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1991"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1991"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}