{"id":2045,"date":"2026-09-22T07:22:33","date_gmt":"2026-09-22T00:22:33","guid":{"rendered":"https:\/\/vncybers.vn\/ho-so-jade-sleet-backdoor-macos-may-devops-ha-tang-dam-may\/"},"modified":"2026-09-22T07:22:33","modified_gmt":"2026-09-22T00:22:33","slug":"jade-sleet-profile-macos-backdoors-turn-devops-mac-into-cloud-gateway","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/ho-so-jade-sleet-backdoor-macos-may-devops-ha-tang-dam-may\/","title":{"rendered":"Jade Sleet Profile: Backdoor macOS turns DevOps into gateway to cloud infrastructure"},"content":{"rendered":"

Jade Sleet<\/strong>, nh\u00f3m \u0111e d\u1ecda c\u00f3 li\u00ean h\u1ec7 v\u1edbi Tri\u1ec1u Ti\u00ean c\u00f2n \u0111\u01b0\u1ee3c theo d\u00f5i d\u01b0\u1edbi c\u00e1c t\u00ean TraderTraitor, UNC4899 v\u00e0 PUKCHONG, \u0111\u00e3 m\u1edf r\u1ed9ng ho\u1ea1t \u0111\u1ed9ng ra ngo\u00e0i l\u0129nh v\u1ef1c ti\u1ec1n m\u00e3 h\u00f3a. M\u1ed9t cu\u1ed9c \u0111i\u1ec1u tra m\u1edbi c\u1ee7a SentinelLABS cho th\u1ea5y hai backdoor macOS FLATROOF v\u00e0 ROOFDECK t\u1eebng xu\u1ea5t hi\u1ec7n trong v\u1ee5 t\u1ea5n c\u00f4ng LayerZero \u0111\u00e3 \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n tr\u00ean MacBook c\u1ee7a m\u1ed9t k\u1ef9 s\u01b0 DevOps t\u1ea1i nh\u00e0 cung c\u1ea5p d\u1ecbch v\u1ee5 CNTT \u1edf \u1ea4n \u0110\u1ed9. V\u1ee5 vi\u1ec7c l\u00e0m n\u1ed5i b\u1eadt r\u1ee7i ro \u0111\u1eb7c bi\u1ec7t c\u1ee7a m\u00e1y tr\u1ea1m l\u1eadp tr\u00ecnh vi\u00ean: ch\u1ec9 m\u1ed9t thi\u1ebft b\u1ecb b\u1ecb x\u00e2m nh\u1eadp c\u00f3 th\u1ec3 d\u1eabn t\u1edbi m\u00e3 ngu\u1ed3n, th\u00f4ng tin x\u00e1c th\u1ef1c \u0111\u00e1m m\u00e2y v\u00e0 chu\u1ed7i cung \u1ee9ng ph\u1ea7n m\u1ec1m.<\/p>\n

Jade Sleet l\u00e0 ai?<\/h2>\n

Jade Sleet \u0111\u01b0\u1ee3c Microsoft v\u00e0 c\u00e1c h\u00e3ng an ninh m\u1ea1ng m\u00f4 t\u1ea3 l\u00e0 m\u1ed9t nh\u00f3m ho\u1ea1t \u0111\u1ed9ng do nh\u00e0 n\u01b0\u1edbc Tri\u1ec1u Ti\u00ean h\u1eadu thu\u1eabn, thi\u00ean v\u1ec1 m\u1ee5c ti\u00eau t\u00e0i ch\u00ednh. Nh\u00f3m th\u01b0\u1eddng ti\u1ebfp c\u1eadn k\u1ef9 s\u01b0 ph\u1ea7n m\u1ec1m, nh\u00e2n s\u1ef1 blockchain v\u00e0 ng\u01b0\u1eddi t\u00ecm vi\u1ec7c b\u1eb1ng h\u1ed3 s\u01a1 tuy\u1ec3n d\u1ee5ng gi\u1ea3, b\u00e0i ki\u1ec3m tra l\u1eadp tr\u00ecnh ho\u1eb7c d\u1ef1 \u00e1n GitHub c\u00f3 v\u1ebb h\u1ee3p ph\u00e1p. M\u1ee5c ti\u00eau kh\u00f4ng ch\u1ec9 l\u00e0 v\u00ed ti\u1ec1n m\u00e3 h\u00f3a; quy\u1ec1n truy c\u1eadp c\u1ee7a m\u1ed9t k\u1ef9 s\u01b0 v\u00e0o kho m\u00e3, h\u1ec7 th\u1ed1ng CI\/CD, kh\u00f3a API v\u00e0 n\u1ec1n t\u1ea3ng \u0111\u00e1m m\u00e2y c\u00f3 th\u1ec3 \u0111em l\u1ea1i gi\u00e1 tr\u1ecb l\u1edbn h\u01a1n nhi\u1ec1u.<\/p>\n

Trong n\u0103m 2026, TraderTraitor b\u1ecb li\u00ean h\u1ec7 v\u1edbi v\u1ee5 x\u00e2m nh\u1eadp LayerZero Labs, s\u1ef1 ki\u1ec7n sau \u0111\u00f3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 h\u1ed7 tr\u1ee3 m\u1ed9t giao d\u1ecbch \u0111\u00fac ti\u1ec1n m\u00e3 h\u00f3a gi\u1ea3 v\u00e0 g\u00e2y thi\u1ec7t h\u1ea1i kho\u1ea3ng 292 tri\u1ec7u USD cho KelpDAO, theo b\u00e1o c\u00e1o c\u1ee7a SentinelOne. Ph\u00e2n t\u00edch v\u1ee5 vi\u1ec7c \u0111\u00e3 h\u00e9 l\u1ed9 FLATROOF v\u00e0 ROOFDECK, hai backdoor vi\u1ebft b\u1eb1ng Rust d\u00e0nh cho m\u00e1y Mac d\u00f9ng ki\u1ebfn tr\u00fac ARM64.<\/p>\n

M\u1ed3i ph\u1ecfng v\u1ea5n gi\u1ea3 v\u00e0 t\u1ec7p Terraform b\u1ecb v\u0169 kh\u00ed h\u00f3a<\/h2>\n

Chu\u1ed7i t\u1ea5n c\u00f4ng b\u1eaft \u0111\u1ea7u b\u1eb1ng k\u1ef9 thu\u1eadt x\u00e3 h\u1ed9i ki\u1ec3u \u201cContagious Interview\u201d. K\u1ebb t\u1ea5n c\u00f4ng gi\u1ea3 danh nh\u00e0 tuy\u1ec3n d\u1ee5ng, g\u1eedi cho \u1ee9ng vi\u00ean m\u1ed9t b\u00e0i t\u1eadp h\u1ea1 t\u1ea7ng d\u01b0\u1edbi d\u1ea1ng kho GitHub. C\u00e1c t\u00ean kho \u0111\u01b0\u1ee3c ghi nh\u1eadn g\u1ed3m Northwind-IAC<\/code>, novacart-interview<\/code> v\u00e0 terraform-candidate-repo<\/code>, \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 ph\u00f9 h\u1ee3p v\u1edbi c\u00f4ng vi\u1ec7c DevOps ho\u1eb7c FinTech c\u1ee7a n\u1ea1n nh\u00e2n.<\/p>\n

\u0110i\u1ec3m nguy hi\u1ec3m n\u1eb1m trong t\u1ec7p kh\u00f3a ph\u1ee5 thu\u1ed9c .terraform.lock.hcl<\/code>. T\u1ec7p n\u00e0y tr\u1ecf Terraform t\u1edbi c\u00e1c t\u00ean mi\u1ec1n nh\u00e0 cung c\u1ea5p gi\u1ea3 m\u1ea1o nh\u01b0 registry.hashicorp-aws[.]com<\/code> thay v\u00ec ngu\u1ed3n h\u1ee3p ph\u00e1p. Khi \u1ee9ng vi\u00ean ch\u1ea1y terraform init<\/code>, Terraform tin ngu\u1ed3n \u0111\u01b0\u1ee3c khai b\u00e1o trong t\u1ec7p kh\u00f3a, t\u1ea3i m\u00f4-\u0111un do k\u1ebb t\u1ea5n c\u00f4ng ki\u1ec3m so\u00e1t v\u00e0 th\u1ef1c thi n\u00f3 tr\u00ean m\u00e1y ph\u00e1t tri\u1ec3n. M\u1ed9t thao t\u00e1c v\u1ed1n \u0111\u01b0\u1ee3c xem l\u00e0 b\u00ecnh th\u01b0\u1eddng trong b\u00e0i ki\u1ec3m tra tuy\u1ec3n d\u1ee5ng v\u00ec th\u1ebf tr\u1edf th\u00e0nh b\u01b0\u1edbc c\u00e0i m\u00e3 \u0111\u1ed9c.<\/p>\n

\"Kho
B\u00e0i ki\u1ec3m tra tuy\u1ec3n d\u1ee5ng tr\u00ean GitHub ch\u1ee9a t\u1ec7p Terraform tr\u1ecf t\u1edbi nh\u00e0 cung c\u1ea5p gi\u1ea3 m\u1ea1o. \u1ea2nh: SentinelLABS<\/figcaption><\/figure>\n

D\u00f2ng th\u1eddi gian x\u00e2m nh\u1eadp m\u00e1y Mac c\u1ee7a k\u1ef9 s\u01b0 DevOps<\/h2>\n

SentinelLABS cho bi\u1ebft n\u1ea1n nh\u00e2n b\u1ed5 sung l\u00e0 m\u1ed9t c\u00f4ng ty d\u1ecbch v\u1ee5 CNTT quy m\u00f4 nh\u1ecf t\u1ea1i \u1ea4n \u0110\u1ed9, kh\u00f4ng c\u00f3 quan h\u1ec7 tr\u1ef1c ti\u1ebfp v\u1edbi ti\u1ec1n m\u00e3 h\u00f3a. Thi\u1ebft b\u1ecb b\u1ecb \u1ea3nh h\u01b0\u1edfng l\u00e0 MacBook Apple Silicon c\u1ee7a m\u1ed9t k\u1ef9 s\u01b0 DevOps, th\u01b0\u1eddng xuy\u00ean d\u00f9ng Terraform v\u00e0 Ansible \u0111\u1ec3 qu\u1ea3n tr\u1ecb AWS, OVH v\u00e0 OpenStack. M\u00e1y c\u0169ng l\u01b0u th\u00f4ng tin x\u00e1c th\u1ef1c \u0111\u00e1m m\u00e2y v\u00e0 quy\u1ec1n truy c\u1eadp kho m\u00e3 ngu\u1ed3n.<\/p>\n

    \n
  • 18\/3\/2026:<\/strong> d\u1eef li\u1ec7u gi\u00e1m s\u00e1t cho th\u1ea5y FLATROOF v\u00e0 ROOFDECK \u0111\u00e3 t\u1ed3n t\u1ea1i tr\u00ean m\u00e1y, nh\u01b0ng ch\u01b0a \u0111\u1ee7 b\u1eb1ng ch\u1ee9ng x\u00e1c \u0111\u1ecbnh c\u00e1ch ch\u00fang \u0111\u01b0\u1ee3c chuy\u1ec3n t\u1edbi.<\/li>\n
  • 29\/3\/2026:<\/strong> v\u00e0i gi\u00e2y sau khi workspace cloudshield<\/code> \u0111\u01b0\u1ee3c m\u1edf trong Cursor, hai implant \u0111\u01b0\u1ee3c k\u00edch ho\u1ea1t, k\u1ebft n\u1ed1i t\u1edbi h\u1ea1 t\u1ea7ng \u0111i\u1ec1u khi\u1ec3n v\u00e0 g\u1ee1 thu\u1ed9c t\u00ednh c\u00e1ch ly c\u1ee7a macOS.<\/li>\n
  • 30\/3\u201319\/4\/2026:<\/strong> backdoor ph\u00e1t t\u00edn hi\u1ec7u \u0111\u1ec1u \u0111\u1eb7n khi Cursor ho\u1ea1t \u0111\u1ed9ng v\u00e0 im l\u1eb7ng khi \u1ee9ng d\u1ee5ng \u0111\u00f3ng, gi\u00fap l\u01b0u l\u01b0\u1ee3ng \u0111\u1ed9c h\u1ea1i h\u00f2a v\u00e0o nh\u1ecbp l\u00e0m vi\u1ec7c b\u00ecnh th\u01b0\u1eddng.<\/li>\n
  • 13\/4\/2026:<\/strong> k\u1ef9 s\u01b0 sao ch\u00e9p kho terraform-candidate-repo<\/code> b\u1eb1ng GitHub Desktop.<\/li>\n
  • 20\/4\/2026:<\/strong> ROOFDECK t\u1ea3i m\u1ed9t payload giai \u0111o\u1ea1n ba mang t\u00ean loginwindow<\/code>, r\u1ed3i payload m\u1edbi x\u00f3a hai implant ban \u0111\u1ea7u nh\u1eb1m gi\u1ea3m d\u1ea5u v\u1ebft.<\/li>\n
  • 1\/6\/2026:<\/strong> SentinelLABS ghi nh\u1eadn t\u00edn hi\u1ec7u \u0111i\u1ec1u khi\u1ec3n cu\u1ed1i c\u00f9ng trong t\u1eadp d\u1eef li\u1ec7u thu th\u1eadp \u0111\u01b0\u1ee3c.<\/li>\n<\/ul>\n

    Tr\u00ecnh t\u1ef1 tr\u00ean ch\u01b0a ch\u1ee9ng minh Cursor l\u00e0 ngu\u1ed3n l\u00e2y nhi\u1ec5m. C\u00f4ng c\u1ee5 n\u00e0y xu\u1ea5t hi\u1ec7n nh\u01b0 ti\u1ebfn tr\u00ecnh cha khi workspace m\u1edf v\u00e0 k\u00edch ho\u1ea1t m\u00f4i tr\u01b0\u1eddng terminal t\u00edch h\u1ee3p; m\u00e3 \u0111\u1ed9c c\u00f3 th\u1ec3 \u0111\u00e3 c\u00e0i s\u1eb5n th\u00f4ng qua m\u1ed9t d\u1ef1 \u00e1n ho\u1eb7c c\u1ea5u h\u00ecnh shell b\u1ecb thao t\u00fang. \u0110\u00e2y l\u00e0 kh\u00e1c bi\u1ec7t quan tr\u1ecdng \u0111\u1ec3 tr\u00e1nh quy k\u1ebft sai cho ph\u1ea7n m\u1ec1m h\u1ee3p ph\u00e1p.<\/p>\n

    FLATROOF: thu th\u1eadp d\u1eef li\u1ec7u v\u00e0 m\u1edf \u0111\u01b0\u1eddng<\/h2>\n

    FLATROOF, c\u00f2n \u0111\u01b0\u1ee3c g\u1ecdi l\u00e0 macOS.Gaslight, \u0111\u01b0\u1ee3c c\u00e0i d\u01b0\u1edbi t\u00ean SystemUpdate<\/code> trong th\u01b0 m\u1ee5c ng\u01b0\u1eddi d\u00f9ng nh\u1eb1m t\u1ea1o c\u1ea3m gi\u00e1c h\u1ee3p ph\u00e1p. Backdoor c\u00f3 th\u1ec3 ch\u1ea1y l\u1ec7nh, d\u1eebng ti\u1ebfn tr\u00ecnh, t\u1ea3i t\u1ec7p l\u00ean ho\u1eb7c xu\u1ed1ng v\u00e0 tri\u1ec3n khai payload ti\u1ebfp theo. N\u00f3 c\u00f2n mang theo m\u00f4-\u0111un Python \u0111\u1ec3 thu th\u1eadp d\u1eef li\u1ec7u tr\u00ecnh duy\u1ec7t Chrome, Brave, Firefox v\u00e0 Safari, l\u1ecbch s\u1eed l\u1ec7nh terminal, danh s\u00e1ch \u1ee9ng d\u1ee5ng, ti\u1ebfn tr\u00ecnh \u0111ang ch\u1ea1y, th\u00f4ng tin ph\u1ea7n c\u1ee9ng v\u00e0 ph\u1ea7n m\u1ec1m, c\u00f9ng b\u1ea3n sao c\u01a1 s\u1edf d\u1eef li\u1ec7u login.keychain-db<\/code>.<\/p>\n

    D\u1eef li\u1ec7u c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c \u0111\u01b0a ra ngo\u00e0i qua Telegram b\u1eb1ng token bot nh\u00fang s\u1eb5n. FLATROOF c\u0169ng g\u1ee1 thu\u1ed9c t\u00ednh com.apple.quarantine<\/code> kh\u1ecfi ROOFDECK v\u00e0 c\u1ea5p quy\u1ec1n th\u1ef1c thi, l\u00e0m suy y\u1ebfu m\u1ed9t l\u1edbp b\u1ea3o v\u1ec7 quan tr\u1ecdng c\u1ee7a Gatekeeper m\u00e0 kh\u00f4ng c\u1ea7n hi\u1ec3n th\u1ecb c\u1ea3nh b\u00e1o quen thu\u1ed9c cho ng\u01b0\u1eddi d\u00f9ng.<\/p>\n

    ROOFDECK: \u0111i\u1ec1u khi\u1ec3n b\u1ec1n v\u1eefng v\u00e0 di chuy\u1ec3n ngang<\/h2>\n

    ROOFDECK l\u00e0 c\u00f4ng c\u1ee5 giai \u0111o\u1ea1n sau, c\u00f3 ph\u1ea1m vi ch\u1ee9c n\u0103ng r\u1ed9ng h\u01a1n. N\u00f3 h\u1ed7 tr\u1ee3 trinh s\u00e1t h\u1ec7 th\u1ed1ng, shell t\u01b0\u01a1ng t\u00e1c, t\u1ea3i v\u00e0 r\u00fat d\u1eef li\u1ec7u, thao t\u00e1c t\u1ec7p, t\u1ea1o kho l\u01b0u tr\u1eef m\u00e3 h\u00f3a, c\u1eadp nh\u1eadt ch\u00ednh n\u00f3 v\u00e0 duy tr\u00ec hi\u1ec7n di\u1ec7n b\u1eb1ng Launch Agent. L\u1ec7nh \u0111i\u1ec1u khi\u1ec3n \u0111\u01b0\u1ee3c k\u00fd b\u1eb1ng kh\u00f3a ri\u00eang c\u1ee7a k\u1ebb v\u1eadn h\u00e0nh v\u00e0 \u0111\u01b0\u1ee3c ki\u1ec3m tra b\u1eb1ng kh\u00f3a c\u00f4ng khai nh\u00fang trong implant tr\u01b0\u1edbc khi th\u1ef1c thi.<\/p>\n

    Thay v\u00ec ph\u1ee5 thu\u1ed9c v\u00e0o m\u1ed9t m\u00e1y ch\u1ee7 c\u1ed1 \u0111\u1ecbnh, ROOFDECK c\u00f3 th\u1ec3 d\u00f9ng m\u1ea1ng Nostr nh\u01b0 m\u1ed9t c\u01a1 ch\u1ebf \u201c\u0111i\u1ec3m ch\u1ebft\u201d \u0111\u1ec3 t\u00ecm \u0111\u1ecba ch\u1ec9 C2 hi\u1ec7n h\u00e0nh. Implant truy v\u1ea5n h\u1ed3 s\u01a1 Nostr do k\u1ebb t\u1ea5n c\u00f4ng ki\u1ec3m so\u00e1t, \u0111\u1ecdc tr\u01b0\u1eddng website r\u1ed3i d\u00f9ng gi\u00e1 tr\u1ecb \u0111\u00f3 l\u00e0m m\u00e1y ch\u1ee7 \u0111i\u1ec1u khi\u1ec3n. C\u00e1ch thi\u1ebft k\u1ebf n\u00e0y gi\u00fap nh\u00e0 v\u1eadn h\u00e0nh thay \u0111\u1ed5i h\u1ea1 t\u1ea7ng linh ho\u1ea1t v\u00e0 l\u00e0m kh\u00f3 ho\u1ea1t \u0111\u1ed9ng ch\u1eb7n theo t\u00ean mi\u1ec1n \u0111\u01a1n l\u1ebb.<\/p>\n

    V\u00ec sao m\u00e1y DevOps l\u00e0 m\u1ee5c ti\u00eau chi\u1ebfn l\u01b0\u1ee3c?<\/h2>\n

    M\u1ed9t m\u00e1y tr\u1ea1m DevOps th\u01b0\u1eddng k\u1ebft n\u1ed1i \u0111\u1ed3ng th\u1eddi v\u1edbi nhi\u1ec1u v\u00f9ng nh\u1ea1y c\u1ea3m: kho Git, pipeline CI\/CD, registry ph\u1ea7n m\u1ec1m, h\u1ec7 th\u1ed1ng qu\u1ea3n l\u00fd b\u00ed m\u1eadt, t\u00e0i kho\u1ea3n \u0111\u00e1m m\u00e2y v\u00e0 m\u00f4i tr\u01b0\u1eddng s\u1ea3n xu\u1ea5t. Do \u0111\u00f3, gi\u00e1 tr\u1ecb c\u1ee7a m\u1ee5c ti\u00eau kh\u00f4ng ph\u1ee5 thu\u1ed9c v\u00e0o quy m\u00f4 c\u00f4ng ty m\u00e0 ph\u1ee5 thu\u1ed9c v\u00e0o nh\u1eefng g\u00ec chi\u1ebfc laptop c\u00f3 th\u1ec3 truy c\u1eadp. Nh\u00e0 cung c\u1ea5p d\u1ecbch v\u1ee5 CNTT nh\u1ecf c\u00f2n c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh b\u00e0n \u0111\u1ea1p \u0111\u1ec3 t\u1ea5n c\u00f4ng nhi\u1ec1u kh\u00e1ch h\u00e0ng.<\/p>\n

    V\u1ee5 vi\u1ec7c c\u0169ng cho th\u1ea5y ranh gi\u1edbi gi\u1eefa l\u1eeba \u0111\u1ea3o tuy\u1ec3n d\u1ee5ng v\u00e0 t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng \u0111ang m\u1edd d\u1ea7n. Thay v\u00ec khai th\u00e1c m\u1ed9t l\u1ed7 h\u1ed5ng ph\u1ea7n m\u1ec1m ph\u1ed5 bi\u1ebfn, k\u1ebb t\u1ea5n c\u00f4ng \u0111\u01b0a m\u00e3 \u0111\u1ed9c v\u00e0o ch\u00ednh quy tr\u00ecnh l\u00e0m vi\u1ec7c m\u00e0 k\u1ef9 s\u01b0 \u0111\u01b0\u1ee3c y\u00eau c\u1ea7u th\u1ef1c hi\u1ec7n. D\u1ef1 \u00e1n \u0111\u01b0\u1ee3c c\u00e1 nh\u00e2n h\u00f3a cho t\u1eebng n\u1ea1n nh\u00e2n khi\u1ebfn ch\u1eef k\u00fd ph\u00e1t hi\u1ec7n truy\u1ec1n th\u1ed1ng v\u00e0 chi\u1ebfn d\u1ecbch \u0111\u00e0o t\u1ea1o chung chung k\u00e9m hi\u1ec7u qu\u1ea3 h\u01a1n.<\/p>\n

    Khuy\u1ebfn ngh\u1ecb ph\u00f2ng v\u1ec7 cho c\u00e1 nh\u00e2n v\u00e0 t\u1ed5 ch\u1ee9c<\/h2>\n
      \n
    • Kh\u00f4ng ch\u1ea1y b\u00e0i ki\u1ec3m tra tuy\u1ec3n d\u1ee5ng ho\u1eb7c d\u1ef1 \u00e1n l\u1ea1 tr\u00ean m\u00e1y c\u00f4ng ty; s\u1eed d\u1ee5ng m\u00e1y \u1ea3o c\u00f4 l\u1eadp, t\u00e0i kho\u1ea3n kh\u00f4ng \u0111\u1eb7c quy\u1ec1n v\u00e0 m\u00f4i tr\u01b0\u1eddng kh\u00f4ng ch\u1ee9a kh\u00f3a th\u1eadt.<\/li>\n
    • Ki\u1ec3m tra .terraform.lock.hcl<\/code>, required_providers<\/code>, script c\u00e0i \u0111\u1eb7t v\u00e0 t\u00ean mi\u1ec1n registry tr\u01b0\u1edbc khi ch\u1ea1y terraform init<\/code>; c\u1ea3nh gi\u00e1c v\u1edbi t\u00ean mi\u1ec1n g\u1ea7n gi\u1ed1ng HashiCorp.<\/li>\n
    • T\u00e1ch th\u00f4ng tin x\u00e1c th\u1ef1c kh\u1ecfi m\u00e1y tr\u1ea1m, \u01b0u ti\u00ean token ng\u1eafn h\u1ea1n, MFA ch\u1ed1ng phishing v\u00e0 quy\u1ec1n truy c\u1eadp t\u1ed1i thi\u1ec3u cho Git, CI\/CD v\u00e0 n\u1ec1n t\u1ea3ng \u0111\u00e1m m\u00e2y.<\/li>\n
    • Gi\u00e1m s\u00e1t thay \u0111\u1ed5i thu\u1ed9c t\u00ednh c\u00e1ch ly, Launch Agents, ti\u1ebfn tr\u00ecnh gi\u1ea3 danh d\u1ecbch v\u1ee5 h\u1ec7 th\u1ed1ng v\u00e0 k\u1ebft n\u1ed1i b\u1ea5t th\u01b0\u1eddng t\u1edbi Telegram, Nostr ho\u1eb7c t\u00ean mi\u1ec1n m\u1edbi \u0111\u0103ng k\u00fd.<\/li>\n
    • Lu\u00e2n chuy\u1ec3n kh\u00f3a API v\u00e0 \u0111i\u1ec1u tra nh\u1eadt k\u00fd \u0111\u00e1m m\u00e2y ngay khi m\u00e1y ph\u00e1t tri\u1ec3n c\u00f3 d\u1ea5u hi\u1ec7u x\u00e2m nh\u1eadp; kh\u00f4ng gi\u1edbi h\u1ea1n x\u1eed l\u00fd \u1edf vi\u1ec7c x\u00f3a m\u00e3 \u0111\u1ed9c tr\u00ean endpoint.<\/li>\n
    • X\u00e2y d\u1ef1ng quy tr\u00ecnh x\u00e1c minh nh\u00e0 tuy\u1ec3n d\u1ee5ng v\u00e0 b\u00e1o c\u00e1o b\u00e0i ki\u1ec3m tra \u0111\u00e1ng ng\u1edd cho b\u1ed9 ph\u1eadn an ninh tr\u01b0\u1edbc khi m\u1edf ho\u1eb7c th\u1ef1c thi m\u00e3.<\/li>\n<\/ul>\n

      B\u00e0i h\u1ecdc t\u1eeb h\u1ed3 s\u01a1 Jade Sleet<\/h2>\n

      Jade Sleet \u0111ang khai th\u00e1c m\u1ed9t \u0111i\u1ec3m y\u1ebfu mang t\u00ednh t\u1ed5 ch\u1ee9c: \u00e1p l\u1ef1c ho\u00e0n th\u00e0nh b\u00e0i ki\u1ec3m tra k\u1ef9 thu\u1eadt v\u00e0 th\u00f3i quen tin t\u01b0\u1edfng c\u00f4ng c\u1ee5 ph\u00e1t tri\u1ec3n quen thu\u1ed9c. S\u1ef1 c\u1ed1 t\u1ea1i nh\u00e0 cung c\u1ea5p d\u1ecbch v\u1ee5 CNTT \u1ea4n \u0110\u1ed9 cho th\u1ea5y ngay c\u1ea3 t\u1ed5 ch\u1ee9c kh\u00f4ng s\u1edf h\u1eefu t\u00e0i s\u1ea3n ti\u1ec1n m\u00e3 h\u00f3a v\u1eabn c\u00f3 th\u1ec3 b\u1ecb nh\u1eafm t\u1edbi n\u1ebfu nh\u00e2n s\u1ef1 c\u1ee7a h\u1ecd n\u1eafm quy\u1ec1n truy c\u1eadp c\u00f3 gi\u00e1 tr\u1ecb.<\/p>\n

      Ph\u00f2ng v\u1ec7 hi\u1ec7u qu\u1ea3 \u0111\u00f2i h\u1ecfi k\u1ebft h\u1ee3p ki\u1ec3m so\u00e1t k\u1ef9 thu\u1eadt v\u1edbi thay \u0111\u1ed5i quy tr\u00ecnh tuy\u1ec3n d\u1ee5ng v\u00e0 ph\u00e1t tri\u1ec3n. M\u1ecdi m\u00e3 kh\u00f4ng r\u00f5 ngu\u1ed3n g\u1ed1c ph\u1ea3i \u0111\u01b0\u1ee3c xem nh\u01b0 kh\u00f4ng \u0111\u00e1ng tin c\u1eady, c\u00f2n m\u00e1y tr\u1ea1m k\u1ef9 s\u01b0 c\u1ea7n \u0111\u01b0\u1ee3c b\u1ea3o v\u1ec7 \u1edf m\u1ee9c t\u01b0\u01a1ng \u0111\u01b0\u01a1ng h\u1ec7 th\u1ed1ng \u0111\u1eb7c quy\u1ec1n. Khi endpoint ph\u00e1t tri\u1ec3n tr\u1edf th\u00e0nh trung t\u00e2m c\u1ee7a chu\u1ed7i t\u1ea5n c\u00f4ng, b\u1ea3o m\u1eadt m\u00e3 ngu\u1ed3n, danh t\u00ednh \u0111\u00e1m m\u00e2y v\u00e0 thi\u1ebft b\u1ecb \u0111\u1ea7u cu\u1ed1i kh\u00f4ng th\u1ec3 ti\u1ebfp t\u1ee5c \u0111\u01b0\u1ee3c qu\u1ea3n l\u00fd nh\u01b0 ba b\u00e0i to\u00e1n t\u00e1ch bi\u1ec7t.<\/p>\n

      VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb SentinelLABS v\u00e0 The Hacker News<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

      Jade Sleet, nh\u00f3m \u0111e d\u1ecda c\u00f3 li\u00ean h\u1ec7 v\u1edbi Tri\u1ec1u Ti\u00ean c\u00f2n \u0111\u01b0\u1ee3c theo d\u00f5i d\u01b0\u1edbi c\u00e1c t\u00ean TraderTraitor, UNC4899 v\u00e0 PUKCHONG, \u0111\u00e3 m\u1edf r\u1ed9ng ho\u1ea1t \u0111\u1ed9ng ra ngo\u00e0i l\u0129nh v\u1ef1c ti\u1ec1n m\u00e3 h\u00f3a. M\u1ed9t cu\u1ed9c \u0111i\u1ec1u tra m\u1edbi c\u1ee7a SentinelLABS cho th\u1ea5y hai backdoor macOS FLATROOF v\u00e0 ROOFDECK t\u1eebng xu\u1ea5t hi\u1ec7n trong v\u1ee5 t\u1ea5n […]<\/p>\n","protected":false},"author":2,"featured_media":2044,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[566,372,857,854,859,858,860,855,856],"class_list":["post-2045","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-chuoi-cung-ung-phan-mem","tag-devops-security","tag-flatroof","tag-jade-sleet","tag-macos-malware","tag-roofdeck","tag-terraform","tag-tradertraitor","tag-unc4899"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2045","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2045"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2045\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2044"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2045"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2045"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2045"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}