{"id":2035,"date":"2026-09-19T07:20:24","date_gmt":"2026-09-19T00:20:24","guid":{"rendered":"https:\/\/vncybers.vn\/ho-so-apt36-operation-rapidrust-ma-doc-rust-github-c2\/"},"modified":"2026-09-19T07:20:24","modified_gmt":"2026-09-19T00:20:24","slug":"apt36-operation-rapidrust-rust-malware-github-c2","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/ho-so-apt36-operation-rapidrust-ma-doc-rust-github-c2\/","title":{"rendered":"APT36: Operation RapidRust injects Rust malware into government and defense networks"},"content":{"rendered":"

Chi\u1ebfn d\u1ecbch Operation RapidRust cho th\u1ea5y Transparent Tribe, c\u00f2n \u0111\u01b0\u1ee3c theo d\u00f5i d\u01b0\u1edbi t\u00ean APT36 ho\u1eb7c Earth Karkaddan, ti\u1ebfp t\u1ee5c n\u00e2ng c\u1ea5p n\u0103ng l\u1ef1c gi\u00e1n \u0111i\u1ec7p m\u1ea1ng nh\u1eb1m v\u00e0o c\u01a1 quan ch\u00ednh ph\u1ee7 v\u00e0 qu\u1ed1c ph\u00f2ng t\u1ea1i \u1ea4n \u0110\u1ed9 v\u00e0 Afghanistan. B\u00e1o c\u00e1o c\u1ee7a Zscaler ThreatLabz c\u00f4ng b\u1ed1 ng\u00e0y 16\/9\/2026 m\u00f4 t\u1ea3 b\u1ed1n c\u00f4ng c\u1ee5 ch\u01b0a t\u1eebng \u0111\u01b0\u1ee3c ghi nh\u1eadn tr\u01b0\u1edbc \u0111\u00f3: c\u1eeda h\u1eadu RUSTYSHADE, c\u00f4ng c\u1ee5 l\u00e2y lan qua thi\u1ebft b\u1ecb r\u1eddi RUSTYMOVE v\u00e0 hai tr\u00ecnh \u0111\u00e1nh c\u1eafp t\u1ec7p PSNATCH, BASHNATCH.<\/p>\n

\"Operation
Operation RapidRust s\u1eed d\u1ee5ng nhi\u1ec1u c\u00f4ng c\u1ee5 m\u1edbi \u0111\u1ec3 do th\u00e1m, \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u v\u00e0 m\u1edf r\u1ed9ng ph\u1ea1m vi x\u00e2m nh\u1eadp. \u1ea2nh: Zscaler ThreatLabz<\/figcaption><\/figure>\n

APT36 v\u00e0 b\u1ed1i c\u1ea3nh c\u1ee7a Operation RapidRust<\/h2>\n

APT36 l\u00e0 nh\u00f3m \u0111e d\u1ecda c\u00f3 li\u00ean h\u1ec7 v\u1edbi Pakistan, ho\u1ea1t \u0111\u1ed9ng l\u00e2u n\u0103m v\u1edbi tr\u1ecdng t\u00e2m gi\u00e1n \u0111i\u1ec7p t\u1ea1i Nam \u00c1. Trong th\u00e1ng 8\/2026, ThreatLabz quan s\u00e1t nh\u00f3m nh\u1eafm t\u1edbi c\u00e1c t\u1ed5 ch\u1ee9c ch\u00ednh ph\u1ee7 v\u00e0 qu\u1ed1c ph\u00f2ng \u1edf \u1ea4n \u0110\u1ed9 v\u00e0 Afghanistan. Ph\u00e1t hi\u1ec7n n\u00e0y n\u1ed1i ti\u1ebfp nh\u1eefng chi\u1ebfn d\u1ecbch tr\u01b0\u1edbc \u0111\u00f3 s\u1eed d\u1ee5ng GITSHELLPAD v\u00e0 PATCHCORD, cho th\u1ea5y nh\u00f3m duy tr\u00ec nh\u1ecbp \u0111\u1ed9 ho\u1ea1t \u0111\u1ed9ng cao \u0111\u1ed3ng th\u1eddi thay \u0111\u1ed5i c\u00f4ng c\u1ee5 \u0111\u1ec3 gi\u1ea3m kh\u1ea3 n\u0103ng b\u1ecb ph\u00e1t hi\u1ec7n.<\/p>\n

H\u1ea1 t\u1ea7ng c\u1ee7a chi\u1ebfn d\u1ecbch k\u1ebft h\u1ee3p d\u1ecbch v\u1ee5 h\u1ee3p ph\u00e1p v\u1edbi t\u00ean mi\u1ec1n do k\u1ebb t\u1ea5n c\u00f4ng ki\u1ec3m so\u00e1t. APT36 \u0111\u0103ng k\u00fd theprints[.]org v\u00e0 indiatodays[.]org, b\u1eaft ch\u01b0\u1edbc c\u00e1c b\u00e1o \u0111i\u1ec7n t\u1eed The Print v\u00e0 India Today, \u0111\u1ec3 l\u01b0u m\u00e3 PowerShell c\u00f9ng t\u1ea3i tr\u1ecdng \u0111\u1ed9c h\u1ea1i. Backblaze \u0111\u01b0\u1ee3c d\u00f9ng \u0111\u1ec3 ph\u00e2n ph\u1ed1i c\u00f4ng c\u1ee5, c\u00f2n kho GitHub ri\u00eang tr\u1edf th\u00e0nh k\u00eanh \u0111i\u1ec1u khi\u1ec3n v\u00e0 n\u01a1i nh\u1eadn d\u1eef li\u1ec7u b\u1ecb \u0111\u00e1nh c\u1eafp.<\/p>\n

RUSTYSHADE bi\u1ebfn GitHub ri\u00eang th\u00e0nh m\u00e1y ch\u1ee7 \u0111i\u1ec1u khi\u1ec3n<\/h2>\n

RUSTYSHADE l\u00e0 c\u1eeda h\u1eadu Windows 64-bit vi\u1ebft b\u1eb1ng Rust. M\u00e3 \u0111\u1ed9c g\u1ecdi GitHub REST API, x\u00e1c th\u1ef1c b\u1eb1ng personal access token \u0111\u01b0\u1ee3c nh\u00fang trong t\u1ec7p th\u1ef1c thi v\u00e0 trao \u0111\u1ed5i d\u1eef li\u1ec7u v\u1edbi kho ri\u00eang c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng. L\u1ec7nh v\u00e0 k\u1ebft qu\u1ea3 \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a AES-256-GCM; kh\u00f3a 32 byte \u0111\u01b0\u1ee3c d\u1eabn xu\u1ea5t t\u1eeb h\u00e0m b\u0103m SHA-256 c\u1ee7a token, gi\u00fap l\u01b0u l\u01b0\u1ee3ng tr\u00f4ng gi\u1ed1ng t\u01b0\u01a1ng t\u00e1c GitHub th\u00f4ng th\u01b0\u1eddng nh\u01b0ng v\u1eabn gi\u1eef b\u00ed m\u1eadt n\u1ed9i dung.<\/p>\n

C\u00e1c t\u1ec7p command.txt, results.txt, info.txt v\u00e0 heartbeat.txt l\u1ea7n l\u01b0\u1ee3t ph\u1ee5c v\u1ee5 ph\u00e1t l\u1ec7nh, nh\u1eadn k\u1ebft qu\u1ea3, l\u01b0u th\u00f4ng tin trinh s\u00e1t v\u00e0 duy tr\u00ec t\u00edn hi\u1ec7u ho\u1ea1t \u0111\u1ed9ng. RUSTYSHADE c\u00f2n c\u00f3 th\u1ec3 ch\u1ee5p m\u00e0n h\u00ecnh, ch\u1ee5p \u1ea3nh webcam, li\u1ec7t k\u00ea \u1ed5 \u0111\u0129a, t\u1ea3i t\u1ec7p v\u00e0 th\u1ef1c thi l\u1ec7nh n\u1ec1n. Vi\u1ec7c l\u1ea1m d\u1ee5ng n\u1ec1n t\u1ea3ng ph\u1ed5 bi\u1ebfn l\u00e0m C2 khi\u1ebfn t\u1ed5 ch\u1ee9c kh\u00f3 ch\u1eb7n to\u00e0n b\u1ed9 t\u00ean mi\u1ec1n m\u00e0 kh\u00f4ng \u1ea3nh h\u01b0\u1edfng ho\u1ea1t \u0111\u1ed9ng ph\u00e1t tri\u1ec3n h\u1ee3p ph\u00e1p.<\/p>\n

B\u1ed9 c\u00f4ng c\u1ee5 \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u tr\u00ean Windows v\u00e0 Linux<\/h2>\n

PSNATCH l\u00e0 script PowerShell qu\u00e9t Desktop, Downloads, Documents, OneDrive v\u00e0 nhi\u1ec1u \u1ed5 \u0111\u0129a \u0111\u1ec3 t\u00ecm t\u00e0i li\u1ec7u Office, \u1ea3nh, t\u1ec7p n\u00e9n, c\u01a1 s\u1edf d\u1eef li\u1ec7u, m\u00e3 ngu\u1ed3n c\u00f9ng c\u00e1c lo\u1ea1i d\u1eef li\u1ec7u kh\u00e1c. C\u00f4ng c\u1ee5 \u01b0u ti\u00ean t\u1ec7p \u0111\u01b0\u1ee3c s\u1eeda g\u1ea7n \u0111\u00e2y, gi\u1edbi h\u1ea1n 1 GB m\u1ed7i t\u1ec7p v\u00e0 5 GB m\u1ed7i l\u1ea7n ch\u1ea1y, r\u1ed3i t\u1ea3i d\u1eef li\u1ec7u l\u00ean kho GitHub ri\u00eang mang t\u00ean m\u00e1y b\u1ecb nhi\u1ec5m.<\/p>\n

BASHNATCH \u00e1p d\u1ee5ng c\u00e1ch l\u00e0m t\u01b0\u01a1ng t\u1ef1 tr\u00ean Linux. C\u1ea3 hai duy tr\u00ec t\u1ec7p theo d\u00f5i c\u1ee5c b\u1ed9 \u0111\u1ec3 ch\u1ec9 g\u1eedi t\u1ec7p m\u1edbi ho\u1eb7c \u0111\u00e3 thay \u0111\u1ed5i trong c\u00e1c l\u1ea7n ch\u1ea1y sau. C\u01a1 ch\u1ebf t\u1ea3i l\u00ean t\u0103ng d\u1ea7n gi\u00fap gi\u1ea3m l\u01b0u l\u01b0\u1ee3ng \u0111\u1ed9t bi\u1ebfn v\u00e0 h\u1ed7 tr\u1ee3 ho\u1ea1t \u0111\u1ed9ng thu th\u1eadp k\u00e9o d\u00e0i.<\/p>\n

RUSTYMOVE \u0111\u01b0a m\u1ed1i \u0111e d\u1ecda t\u1edbi m\u1ea1ng c\u00e1ch ly<\/h2>\n

RUSTYMOVE l\u00e0 c\u00f4ng c\u1ee5 Windows 64-bit vi\u1ebft b\u1eb1ng Rust, li\u00ean t\u1ee5c ph\u00e1t hi\u1ec7n USB, th\u1ebb nh\u1edb v\u00e0 thi\u1ebft b\u1ecb l\u01b0u tr\u1eef ngo\u00e0i. Khi t\u00ecm th\u1ea5y thi\u1ebft b\u1ecb m\u1edbi, n\u00f3 sao ch\u00e9p DriverInstaller.zip ch\u1ee9a RUSTYSHADE c\u00f9ng m\u1ed9t t\u1ec7p LNK ng\u1ee5y trang t\u00e0i li\u1ec7u PDF v\u00e0o th\u01b0 m\u1ee5c g\u1ed1c. ThreatLabz \u0111\u00e1nh gi\u00e1 v\u1edbi \u0111\u1ed9 tin c\u1eady cao r\u1eb1ng t\u1ec7p LNK \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 k\u00edch ho\u1ea1t c\u1eeda h\u1eadu sau khi gi\u1ea3i n\u00e9n.<\/p>\n

C\u00e1ch ph\u00e1t t\u00e1n n\u00e0y \u0111\u1eb7c bi\u1ec7t \u0111\u00e1ng ch\u00fa \u00fd v\u1edbi m\u00f4i tr\u01b0\u1eddng ch\u00ednh ph\u1ee7 v\u00e0 qu\u1ed1c ph\u00f2ng, n\u01a1i m\u1ea1ng c\u00e1ch ly th\u01b0\u1eddng d\u00f9ng thi\u1ebft b\u1ecb r\u1eddi \u0111\u1ec3 chuy\u1ec3n d\u1eef li\u1ec7u. RUSTYMOVE \u0111\u01b0\u1ee3c duy tr\u00ec b\u1eb1ng scheduled task mang t\u00ean gi\u1ed1ng tr\u00ecnh c\u1eadp nh\u1eadt OneDrive, nh\u01b0ng ch\u1ee9c n\u0103ng c\u00f2n \u0111\u01a1n gi\u1ea3n v\u00e0 ph\u1ee5 thu\u1ed9c \u0111\u01b0\u1eddng d\u1eabn c\u1ed1 \u0111\u1ecbnh, d\u1ea5u hi\u1ec7u cho th\u1ea5y c\u00f4ng c\u1ee5 c\u00f3 th\u1ec3 \u0111ang \u1edf giai \u0111o\u1ea1n ph\u00e1t tri\u1ec3n s\u1edbm.<\/p>\n

D\u00f2ng th\u1eddi gian v\u00e0 ho\u1ea1t \u0111\u1ed9ng sau x\u00e2m nh\u1eadp<\/h2>\n

Ph\u1ea7n l\u1edbn l\u1ec7nh \u0111i\u1ec1u khi\u1ec3n \u0111\u01b0\u1ee3c quan s\u00e1t t\u1eeb ng\u00e0y 20\/8 \u0111\u1ebfn 1\/9\/2026, ch\u1ec9 xu\u1ea5t hi\u1ec7n trong ng\u00e0y l\u00e0m vi\u1ec7c v\u00e0 t\u1eadp trung t\u1eeb 4 gi\u1edd \u0111\u1ebfn 11 gi\u1edd UTC. Sau khi c\u00f3 ch\u1ed7 \u0111\u1ee9ng, to\u00e1n t\u1eed ki\u1ec3m tra ng\u01b0\u1eddi d\u00f9ng, \u0111\u1eb7c quy\u1ec1n, ti\u1ebfn tr\u00ecnh, c\u1ea5u h\u00ecnh m\u1ea1ng v\u00e0 v\u1ecb tr\u00ed \u0111\u1ecba l\u00fd; qu\u00e9t d\u1ea3i m\u1ea1ng n\u1ed9i b\u1ed9, li\u1ec7t k\u00ea m\u00e1y c\u00f9ng chia s\u1ebb SMB, th\u1eed k\u1ebft n\u1ed1i IPC$ v\u00e0 d\u00f2 c\u00e1c c\u1ed5ng 445, 135 \u0111\u1ec3 chu\u1ea9n b\u1ecb di chuy\u1ec3n ngang.<\/p>\n

Nh\u00f3m c\u0169ng t\u1ea1o scheduled task gi\u1ea3 danh th\u00e0nh ph\u1ea7n c\u1eadp nh\u1eadt Microsoft Edge ho\u1eb7c OneDrive, tri\u1ec3n khai t\u1ea3i tr\u1ecdng k\u1ebf ti\u1ebfp v\u00e0 x\u00f3a t\u1ec7p c\u00f4ng c\u1ee5 c\u0169 nh\u1eb1m gi\u1ea3m d\u1ea5u v\u1ebft. M\u1eabu th\u1eddi gian kh\u00f4ng t\u1ef1 ch\u1ee9ng minh danh t\u00ednh c\u1ee7a to\u00e1n t\u1eed, nh\u01b0ng b\u1ed5 sung d\u1eef li\u1ec7u h\u00e0nh vi h\u1eefu \u00edch cho qu\u00e1 tr\u00ecnh s\u0103n t\u00ecm m\u1ed1i \u0111e d\u1ecda.<\/p>\n

T\u00e1c \u0111\u1ed9ng k\u1ef9 thu\u1eadt v\u00e0 r\u1ee7i ro \u0111\u1ed1i v\u1edbi t\u1ed5 ch\u1ee9c<\/h2>\n

Operation RapidRust k\u1ebft h\u1ee3p do th\u00e1m, duy tr\u00ec hi\u1ec7n di\u1ec7n, thu th\u1eadp d\u1eef li\u1ec7u \u0111a n\u1ec1n t\u1ea3ng v\u00e0 l\u00e2y lan qua thi\u1ebft b\u1ecb r\u1eddi. N\u1ebfu kh\u00f4ng \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n, chi\u1ebfn d\u1ecbch c\u00f3 th\u1ec3 l\u00e0m l\u1ed9 t\u00e0i li\u1ec7u nh\u1ea1y c\u1ea3m, \u1ea3nh ch\u1ee5p m\u00e0n h\u00ecnh, d\u1eef li\u1ec7u webcam v\u00e0 th\u00f4ng tin m\u1ea1ng n\u1ed9i b\u1ed9; \u0111\u1ed3ng th\u1eddi t\u1ea1o b\u00e0n \u0111\u1ea1p sang c\u00e1c m\u00e1y kh\u00e1c, k\u1ec3 c\u1ea3 h\u1ec7 th\u1ed1ng kh\u00f4ng k\u1ebft n\u1ed1i tr\u1ef1c ti\u1ebfp Internet.<\/p>\n

Vi\u1ec7c s\u1eed d\u1ee5ng GitHub v\u00e0 Backblaze c\u0169ng \u0111\u1eb7t ra b\u00e0i to\u00e1n c\u00e2n b\u1eb1ng gi\u1eefa an ninh v\u00e0 v\u1eadn h\u00e0nh. Ch\u1eb7n tuy\u1ec7t \u0111\u1ed1i c\u00f3 th\u1ec3 g\u00e2y gi\u00e1n \u0111o\u1ea1n, trong khi ch\u1ec9 d\u1ef1a v\u00e0o danh ti\u1ebfng t\u00ean mi\u1ec1n s\u1ebd b\u1ecf s\u00f3t l\u01b0u l\u01b0\u1ee3ng \u0111\u1ed9c h\u1ea1i. T\u1ed5 ch\u1ee9c c\u1ea7n k\u1ebft h\u1ee3p ki\u1ec3m so\u00e1t danh t\u00ednh, quan s\u00e1t API, gi\u00e1m s\u00e1t h\u00e0nh vi ti\u1ebfn tr\u00ecnh v\u00e0 quy t\u1eafc ng\u0103n r\u00f2 r\u1ec9 d\u1eef li\u1ec7u.<\/p>\n

Khuy\u1ebfn ngh\u1ecb ph\u00f2ng th\u1ee7<\/h2>\n
    \n
  • R\u00e0 so\u00e1t truy c\u1eadp GitHub Contents API t\u1eeb m\u00e1y kh\u00f4ng ph\u1ee5c v\u1ee5 ph\u00e1t tri\u1ec3n, \u0111\u1eb7c bi\u1ec7t ti\u1ebfn tr\u00ecnh l\u1ea1 d\u00f9ng token nh\u00fang v\u00e0 t\u1ea1o kho ri\u00eang theo t\u00ean m\u00e1y.<\/li>\n
  • S\u0103n t\u00ecm scheduled task gi\u1ea3 danh OneDrive ho\u1eb7c Edge, t\u1ec7p DriverInstaller.zip, chu\u1ed7i SmartUploader v\u00e0 ho\u1ea1t \u0111\u1ed9ng PowerShell t\u1ea3i m\u00e3 t\u1eeb t\u00ean mi\u1ec1n g\u1ea7n gi\u1ed1ng b\u00e1o ch\u00ed.<\/li>\n
  • H\u1ea1n ch\u1ebf PowerShell kh\u00f4ng c\u1ea7n thi\u1ebft, b\u1eadt ghi nh\u1eadt k\u00fd Script Block, AMSI v\u00e0 chuy\u1ec3n log v\u1ec1 h\u1ec7 th\u1ed1ng gi\u00e1m s\u00e1t t\u1eadp trung.<\/li>\n
  • \u00c1p d\u1ee5ng ki\u1ec3m so\u00e1t thi\u1ebft b\u1ecb USB theo vai tr\u00f2, qu\u00e9t t\u1ec7p LNK v\u00e0 t\u1ec7p n\u00e9n tr\u01b0\u1edbc khi cho ph\u00e9p chuy\u1ec3n v\u00e0o m\u1ea1ng c\u00e1ch ly.<\/li>\n
  • Gi\u00e1m s\u00e1t h\u00e0nh vi qu\u00e9t m\u1ea1ng, truy v\u1ea5n SMB\/RPC b\u1ea5t th\u01b0\u1eddng v\u00e0 l\u01b0\u1ee3ng l\u1edbn t\u1ec7p \u0111\u01b0\u1ee3c \u0111\u1ecdc r\u1ed3i g\u1eedi t\u1edbi d\u1ecbch v\u1ee5 l\u01b0u tr\u1eef m\u00e3 ngu\u1ed3n.<\/li>\n
  • \u0110\u1ed5i ho\u1eb7c thu h\u1ed3i th\u00f4ng tin x\u00e1c th\u1ef1c li\u00ean quan khi ph\u00e1t hi\u1ec7n x\u00e2m nh\u1eadp, c\u00f4 l\u1eadp m\u00e1y b\u1ecb \u1ea3nh h\u01b0\u1edfng v\u00e0 ki\u1ec3m tra c\u1ea3 Windows l\u1eabn Linux.<\/li>\n<\/ul>\n

    B\u00e0i h\u1ecdc t\u1eeb chi\u1ebfn d\u1ecbch<\/h2>\n

    APT36 kh\u00f4ng d\u1ef1a v\u00e0o m\u1ed9t k\u1ef9 thu\u1eadt duy nh\u1ea5t m\u00e0 gh\u00e9p d\u1ecbch v\u1ee5 \u0111\u00e1m m\u00e2y h\u1ee3p ph\u00e1p, t\u00ean mi\u1ec1n gi\u1ea3 m\u1ea1o, m\u00e3 \u0111\u1ed9c Rust v\u00e0 thi\u1ebft b\u1ecb r\u1eddi th\u00e0nh chu\u1ed7i ho\u1ea1t \u0111\u1ed9ng th\u1ed1ng nh\u1ea5t. \u0110i\u1ec1u n\u00e0y cho th\u1ea5y ph\u00f2ng th\u1ee7 hi\u1ec7u qu\u1ea3 c\u1ea7n theo d\u00f5i h\u00e0nh vi xuy\u00ean su\u1ed1t v\u00f2ng \u0111\u1eddi t\u1ea5n c\u00f4ng, thay v\u00ec ch\u1ec9 ch\u1eb7n m\u1ed9t \u0111\u1ecba ch\u1ec9 ho\u1eb7c ch\u1eef k\u00fd.<\/p>\n

    V\u1edbi m\u00f4i tr\u01b0\u1eddng nh\u1ea1y c\u1ea3m, ch\u00ednh s\u00e1ch thi\u1ebft b\u1ecb r\u1eddi v\u00e0 kh\u1ea3 n\u0103ng quan s\u00e1t d\u1ecbch v\u1ee5 ph\u00e1t tri\u1ec3n \u0111\u00e1m m\u00e2y ph\u1ea3i \u0111\u01b0\u1ee3c xem l\u00e0 m\u1ed9t ph\u1ea7n c\u1ee7a ki\u1ec3m so\u00e1t an ninh c\u1ed1t l\u00f5i. Ph\u00e2n \u0111o\u1ea1n m\u1ea1ng, \u0111\u1eb7c quy\u1ec1n t\u1ed1i thi\u1ec3u, x\u00e1c th\u1ef1c m\u1ea1nh v\u00e0 di\u1ec5n t\u1eadp \u1ee9ng ph\u00f3 \u0111\u1ecbnh k\u1ef3 gi\u00fap gi\u1ea3m ph\u1ea1m vi thi\u1ec7t h\u1ea1i n\u1ebfu m\u1ed9t \u0111i\u1ec3m cu\u1ed1i b\u1ecb x\u00e2m nh\u1eadp.<\/p>\n

    VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb Zscaler ThreatLabz v\u00e0 The Hacker News<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

    Chi\u1ebfn d\u1ecbch Operation RapidRust cho th\u1ea5y Transparent Tribe, c\u00f2n \u0111\u01b0\u1ee3c theo d\u00f5i d\u01b0\u1edbi t\u00ean APT36 ho\u1eb7c Earth Karkaddan, ti\u1ebfp t\u1ee5c n\u00e2ng c\u1ea5p n\u0103ng l\u1ef1c gi\u00e1n \u0111i\u1ec7p m\u1ea1ng nh\u1eb1m v\u00e0o c\u01a1 quan ch\u00ednh ph\u1ee7 v\u00e0 qu\u1ed1c ph\u00f2ng t\u1ea1i \u1ea4n \u0110\u1ed9 v\u00e0 Afghanistan. B\u00e1o c\u00e1o c\u1ee7a Zscaler ThreatLabz c\u00f4ng b\u1ed1 ng\u00e0y 16\/9\/2026 m\u00f4 t\u1ea3 b\u1ed1n c\u00f4ng c\u1ee5 […]<\/p>\n","protected":false},"author":2,"featured_media":2034,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[836,842,201,843,838,841,840,839,837],"class_list":["post-2035","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-apt36","tag-bashnatch","tag-gian-diep-mang","tag-github-c2","tag-operation-rapidrust","tag-psnatch","tag-rustymove","tag-rustyshade","tag-transparent-tribe"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2035","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2035"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2035\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2034"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2035"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2035"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2035"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}