{"id":2136,"date":"2026-10-21T07:20:40","date_gmt":"2026-10-21T00:20:40","guid":{"rendered":"https:\/\/vncybers.vn\/ho-so-apt28-swallowtail-hookedge-duong-ham-ssh-nha-may-dong-tau-nato\/"},"modified":"2026-10-21T07:20:40","modified_gmt":"2026-10-21T00:20:40","slug":"apt28-swallowtail-hookedge-ssh-tunnel-nato-shipyard-2","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/ho-so-apt28-swallowtail-hookedge-duong-ham-ssh-nha-may-dong-tau-nato\/","title":{"rendered":"APT28 Swallowtail Profile: From a Word Document to an SSH Tunnel Inside a NATO Shipyard"},"content":{"rendered":"

APT28, nh\u00f3m gi\u00e1n \u0111i\u1ec7p m\u1ea1ng l\u00e2u n\u0103m \u0111\u01b0\u1ee3c li\u00ean h\u1ec7 v\u1edbi t\u00ecnh b\u00e1o qu\u00e2n s\u1ef1 Nga, v\u1eeba b\u1ecb quy tr\u00e1ch nhi\u1ec7m cho m\u1ed9t chi\u1ebfn d\u1ecbch nh\u1eafm v\u00e0o c\u01a1 quan th\u1ef1c thi ph\u00e1p lu\u1eadt, nh\u00e0 m\u00e1y \u0111\u00f3ng t\u00e0u h\u1ea3i qu\u00e2n v\u00e0 h\u00e3ng s\u1ea3n xu\u1ea5t \u0111\u1ed9ng c\u01a1 m\u00e1y bay qu\u00e2n s\u1ef1 t\u1ea1i hai qu\u1ed1c gia NATO. Cu\u1ed9c x\u00e2m nh\u1eadp n\u1ed5i b\u1eadt b\u1edfi chu\u1ed7i thao t\u00e1c th\u1ee7 c\u00f4ng k\u00e9o d\u00e0i, hai k\u1ef9 thu\u1eadt \u0111\u00e1nh c\u1eafp th\u00f4ng tin x\u00e1c th\u1ef1c, \u0111\u01b0\u1eddng h\u1ea7m SSH b\u1ec1n v\u1eefng v\u00e0 m\u1ed9t loader ph\u1ea3n chi\u1ebfu ch\u01b0a t\u1eebng \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1.<\/p>\n

\"S\u01a1
Chu\u1ed7i t\u1ea5n c\u00f4ng Swallowtail t\u1eeb t\u00e0i li\u1ec7u Word \u0111\u1ed9c h\u1ea1i \u0111\u1ebfn \u0111\u01b0\u1eddng h\u1ea7m SSH v\u00e0 loader ch\u1ea1y trong b\u1ed9 nh\u1edb. Ngu\u1ed3n: Symantec Threat Hunter Team\/Broadcom.<\/figcaption><\/figure>\n

APT28 v\u00e0 chi\u1ebfn d\u1ecbch Swallowtail<\/h2>\n

Symantec Threat Hunter Team theo d\u00f5i c\u1ee5m ho\u1ea1t \u0111\u1ed9ng d\u01b0\u1edbi t\u00ean Swallowtail; c\u00f9ng t\u00e1c nh\u00e2n n\u00e0y c\u00f2n \u0111\u01b0\u1ee3c g\u1ecdi l\u00e0 APT28, Fancy Bear, Forest Blizzard ho\u1eb7c BlueDelta. Ch\u00ednh ph\u1ee7 M\u1ef9 \u0111\u00e1nh gi\u00e1 nh\u00f3m l\u00e0 m\u1ed9t \u0111\u01a1n v\u1ecb thu\u1ed9c GRU, c\u01a1 quan t\u00ecnh b\u00e1o qu\u00e2n s\u1ef1 Nga. M\u1ee5c ti\u00eau truy\u1ec1n th\u1ed1ng c\u1ee7a nh\u00f3m l\u00e0 ch\u00ednh ph\u1ee7, qu\u00e2n \u0111\u1ed9i, ngo\u1ea1i giao v\u00e0 c\u00f4ng nghi\u1ec7p qu\u1ed1c ph\u00f2ng t\u1ea1i ch\u00e2u \u00c2u v\u00e0 B\u1eafc M\u1ef9.<\/p>\n

Ba n\u1ea1n nh\u00e2n \u0111\u01b0\u1ee3c b\u00e1o c\u00e1o \u0111\u1ec1u n\u1eafm gi\u1eef th\u00f4ng tin c\u00f3 gi\u00e1 tr\u1ecb t\u00ecnh b\u00e1o tr\u1ef1c ti\u1ebfp: m\u1ed9t c\u01a1 quan th\u1ef1c thi ph\u00e1p lu\u1eadt, m\u1ed9t nh\u00e0 m\u00e1y \u0111\u00f3ng t\u00e0u h\u1ea3i qu\u00e2n v\u00e0 m\u1ed9t nh\u00e0 s\u1ea3n xu\u1ea5t \u0111\u1ed9ng c\u01a1 m\u00e1y bay qu\u00e2n s\u1ef1. Danh t\u00ednh v\u00e0 qu\u1ed1c gia c\u1ee5 th\u1ec3 kh\u00f4ng \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1, v\u00ec v\u1eady kh\u00f4ng n\u00ean suy \u0111o\u00e1n t\u1ed5 ch\u1ee9c b\u1ecb \u1ea3nh h\u01b0\u1edfng.<\/p>\n

\u0110i\u1ec3m kh\u1edfi \u0111\u1ea7u: t\u1ec7p Word \u0111\u1ebfn t\u1eeb email<\/h2>\n

T\u1ea1i nh\u00e0 m\u00e1y \u0111\u00f3ng t\u00e0u, d\u1ea5u v\u1ebft \u0111\u1ea7u ti\u00ean xu\u1ea5t hi\u1ec7n chi\u1ec1u 24\/7\/2026 khi m\u1ed9t t\u00e0i li\u1ec7u Word c\u00f3 macro \u0111\u01b0\u1ee3c m\u1edf tr\u1ef1c ti\u1ebfp t\u1eeb b\u1ed9 nh\u1edb \u0111\u1ec7m t\u1ec7p \u0111\u00ednh k\u00e8m Outlook. Chi ti\u1ebft n\u00e0y x\u00e1c nh\u1eadn t\u00e0i li\u1ec7u \u0111\u1ebfn qua email. Macro b\u1ecb l\u00e0m r\u1ed1i, chia m\u00e3 VBA v\u00e0 chu\u1ed7i th\u00e0nh nhi\u1ec1u m\u1ea3nh ng\u1eafn r\u1ed3i gh\u00e9p l\u1ea1i khi ch\u1ea1y \u0111\u1ec3 gi\u1ea3m kh\u1ea3 n\u0103ng b\u1ecb c\u00f4ng c\u1ee5 qu\u00e9t t\u0129nh ph\u00e1t hi\u1ec7n.<\/p>\n

Routine AutoOpen th\u1ea3 b\u1ed1n t\u1ec7p v\u00e0o h\u1ed3 s\u01a1 ng\u01b0\u1eddi d\u00f9ng, g\u1ed3m tr\u00ecnh kh\u1edfi ch\u1ea1y VBScript, m\u1ed9t c\u1eb7p HTML\/XHTML v\u00e0 t\u1eadp l\u1ec7nh batch. \u0110\u00e2y l\u00e0 \u0111i\u1ec3m kh\u1edfi \u0111\u1ea7u cho HOOKEDGE, c\u1eeda h\u1eadu d\u1ea1ng t\u1eadp l\u1ec7nh Windows g\u1ecdn nh\u1eb9 c\u00f3 nhi\u1ec7m v\u1ee5 nh\u1eadn l\u1ec7nh v\u00e0 g\u1eedi k\u1ebft qu\u1ea3 v\u1ec1 m\u00e1y ch\u1ee7 \u0111i\u1ec1u khi\u1ec3n.<\/p>\n

HOOKEDGE bi\u1ebfn Edge th\u00e0nh k\u00eanh \u0111i\u1ec1u khi\u1ec3n<\/h2>\n

Thay v\u00ec t\u1ea3i m\u00e3 b\u1eb1ng c\u00f4ng c\u1ee5 ri\u00eang, HOOKEDGE \u0111\u00f3ng m\u1ecdi ti\u1ebfn tr\u00ecnh Microsoft Edge \u0111ang ch\u1ea1y r\u1ed3i m\u1edf m\u1ed9t c\u1eeda s\u1ed5 Edge k\u00edch th\u01b0\u1edbc m\u1ed9t pixel \u1edf ngo\u00e0i m\u00e0n h\u00ecnh. JavaScript nh\u00fang trong URL d\u1eef li\u1ec7u y\u00eau c\u1ea7u t\u00e0i nguy\u00ean t\u1eeb webhook.site v\u00e0 bu\u1ed9c tr\u00ecnh duy\u1ec7t l\u01b0u ph\u1ea3n h\u1ed3i xu\u1ed1ng \u0111\u0129a. T\u1eadp l\u1ec7nh batch sau \u0111\u00f3 \u0111\u1ed5i t\u1ec7p v\u1eeba t\u1ea3i th\u00e0nh l\u1ec7nh, th\u1ef1c thi, g\u1eedi k\u1ebft qu\u1ea3 tr\u1edf l\u1ea1i v\u00e0 x\u00f3a t\u1ec7p t\u1ea1m.<\/p>\n

C\u00e1ch l\u00e0m n\u00e0y t\u1eadn d\u1ee5ng tr\u00ecnh duy\u1ec7t h\u1ee3p ph\u00e1p l\u00e0m HTTP client, khi\u1ebfn l\u01b0u l\u01b0\u1ee3ng d\u1ec5 h\u00f2a l\u1eabn v\u00e0o ho\u1ea1t \u0111\u1ed9ng th\u00f4ng th\u01b0\u1eddng h\u01a1n. T\u00e1c nh\u00e2n tr\u01b0\u1edbc h\u1ebft ki\u1ec3m tra kh\u1ea3 n\u0103ng truy c\u1eadp Dropbox, Google, Microsoft, Mega v\u00e0 m\u1ed9t \u0111\u1ecba ch\u1ec9 IP, r\u1ed3i thu th\u1eadp c\u1ea5u h\u00ecnh proxy, phi\u00ean \u0111\u0103ng nh\u1eadp, ti\u1ebfn tr\u00ecnh, th\u00f4ng tin h\u1ec7 th\u1ed1ng v\u00e0 danh s\u00e1ch th\u01b0 m\u1ee5c \u0111\u1ec3 \u0111\u00e1nh gi\u00e1 m\u00e1y b\u1ecb x\u00e2m nh\u1eadp.<\/p>\n

T\u1eeb d\u1ecbch v\u1ee5 c\u00f4ng c\u1ed9ng sang h\u1ea1 t\u1ea7ng ri\u00eang<\/h2>\n

Ng\u00e0y 27\/7, m\u1ed9t bi\u1ebfn th\u1ec3 HOOKEDGE m\u1edbi chuy\u1ec3n kh\u1ecfi webhook.site sang \u0111\u1ecba ch\u1ec9 chuy\u00ean d\u1ee5ng 185.82.218[.]119:443<\/code> \u0111\u1ec3 nh\u1eadn nhi\u1ec7m v\u1ee5 v\u00e0 l\u1ea5y d\u1eef li\u1ec7u. B\u1ea3y t\u00e1c v\u1ee5 \u0111\u01b0\u1ee3c th\u1ef1c hi\u1ec7n trong kho\u1ea3ng 30 gi\u00e2y, m\u1ed7i l\u1ec7nh c\u00e1ch nhau hai \u0111\u1ebfn t\u00e1m gi\u00e2y. Nh\u1ecbp \u0111\u1ed9 v\u00e0 n\u1ed9i dung cho th\u1ea5y ng\u01b0\u1eddi v\u1eadn h\u00e0nh \u0111ang t\u01b0\u01a1ng t\u00e1c tr\u1ef1c ti\u1ebfp thay v\u00ec ch\u1ec9 d\u1ef1a v\u00e0o l\u1ecbch t\u1ef1 \u0111\u1ed9ng.<\/p>\n

C\u00e1c l\u1ec7nh ban \u0111\u1ea7u x\u00e1c \u0111\u1ecbnh danh t\u00ednh ng\u01b0\u1eddi d\u00f9ng, ki\u1ec3m tra quy\u1ec1n r\u1ed3i nhanh ch\u00f3ng chu\u1ea9n b\u1ecb v\u1eadt li\u1ec7u x\u00e1c th\u1ef1c. Trong tu\u1ea7n ti\u1ebfp theo, ng\u01b0\u1eddi v\u1eadn h\u00e0nh nhi\u1ec1u l\u1ea7n quay l\u1ea1i m\u00e1y ch\u1ee7, d\u00f2 t\u00ean m\u00e1y n\u1ed9i b\u1ed9 v\u00e0 ki\u1ec3m k\u00ea b\u1ea3n v\u00e1, cho th\u1ea5y m\u1ee5c ti\u00eau kh\u00f4ng ch\u1ec9 l\u00e0 c\u00e0i \u0111\u01b0\u1ee3c c\u1eeda h\u1eadu m\u00e0 c\u00f2n m\u1edf r\u1ed9ng hi\u1ec7n di\u1ec7n trong m\u1ea1ng.<\/p>\n

\u0110\u01b0\u1eddng h\u1ea7m SSH t\u1ea1o l\u1ed1i quay l\u1ea1i m\u1ea1ng n\u1ed9i b\u1ed9<\/h2>\n

K\u1ebb t\u1ea5n c\u00f4ng \u0111\u1ea9y m\u1ed9t kh\u00f3a ri\u00eang SSH xu\u1ed1ng th\u01b0 m\u1ee5c ProgramData, \u0111i\u1ec1u ch\u1ec9nh quy\u1ec1n s\u1edf h\u1eefu r\u1ed3i d\u00f9ng OpenSSH c\u00f3 s\u1eb5n tr\u00ean Windows \u0111\u1ec3 k\u1ebft n\u1ed1i ng\u01b0\u1ee3c t\u1edbi m\u00e1y ch\u1ee7 c\u1ee7a m\u00ecnh. T\u00f9y ch\u1ecdn chuy\u1ec3n ti\u1ebfp c\u1ed5ng t\u1eeb xa, ch\u1ea1y n\u1ec1n v\u00e0 kh\u00f4ng m\u1edf shell \u0111\u00e3 t\u1ea1o m\u1ed9t \u0111\u01b0\u1eddng h\u1ea7m b\u1ec1n v\u1eefng, cho ph\u00e9p h\u1ea1 t\u1ea7ng c\u1ee7a \u0111\u1ed1i ph\u01b0\u01a1ng \u0111i qua m\u00e1y \u0111\u00e3 nhi\u1ec5m \u0111\u1ec3 ti\u1ebfp c\u1eadn m\u1ea1ng n\u1ed9i b\u1ed9.<\/p>\n

Ngay sau khi \u0111\u01b0\u1eddng h\u1ea7m ho\u1ea1t \u0111\u1ed9ng, t\u00e1c nh\u00e2n ph\u00e2n gi\u1ea3i t\u00ean v\u00e0 th\u0103m d\u00f2 th\u00eam nhi\u1ec1u m\u00e1y b\u00ean trong. \u0110\u00e2y l\u00e0 d\u1ea5u hi\u1ec7u quan tr\u1ecdng cho \u0111\u1ed9i ph\u00f2ng th\u1ee7: k\u1ebft n\u1ed1i SSH \u0111i ra ngo\u00e0i, \u0111\u1eb7c bi\u1ec7t tr\u00ean c\u1ed5ng kh\u00f4ng th\u00f4ng th\u01b0\u1eddng ho\u1eb7c k\u00e8m kh\u00f3a m\u1edbi xu\u1ea5t hi\u1ec7n trong ProgramData, c\u00f3 th\u1ec3 l\u00e0 ph\u01b0\u01a1ng ti\u1ec7n b\u00e1m tr\u1ee5 ch\u1ee9 kh\u00f4ng ph\u1ea3i t\u00e1c v\u1ee5 qu\u1ea3n tr\u1ecb.<\/p>\n

K\u1ef9 thu\u1eadt th\u1ee9 hai: bu\u1ed9c m\u00e1y t\u1ef1 x\u00e1c th\u1ef1c b\u1eb1ng NTLM<\/h2>\n

APT28 c\u00f2n ch\u1ea1y m\u1ed9t \u0111o\u1ea1n PowerShell ng\u1eafn d\u1ef1ng HTTP listener tr\u00ean \u0111\u1ecba ch\u1ec9 loopback v\u00e0 bu\u1ed9c m\u00e1y x\u00e1c th\u1ef1c v\u1edbi ch\u00ednh n\u00f3. Listener tr\u1ea3 v\u1ec1 y\u00eau c\u1ea7u NTLM r\u1ed3i thu t\u1ed1i \u0111a b\u1ed1n c\u1eb7p challenge-response. D\u1eef li\u1ec7u n\u00e0y c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c d\u00f9ng \u0111\u1ec3 th\u1eed b\u1ebb kh\u00f3a ngo\u1ea1i tuy\u1ebfn ho\u1eb7c chuy\u1ec3n ti\u1ebfp x\u00e1c th\u1ef1c sang h\u1ec7 th\u1ed1ng kh\u00e1c n\u1ebfu \u0111i\u1ec1u ki\u1ec7n cho ph\u00e9p.<\/p>\n

Vi\u1ec7c s\u1eed d\u1ee5ng hai con \u0111\u01b0\u1eddng \u0111\u1ed9c l\u1eadp \u0111\u1ec3 l\u1ea5y th\u00f4ng tin x\u00e1c th\u1ef1c cho th\u1ea5y t\u00ednh ch\u1ee7 \u0111\u1ed9ng c\u1ee7a chi\u1ebfn d\u1ecbch. Ngay c\u1ea3 khi m\u1ed9t k\u1ef9 thu\u1eadt b\u1ecb ch\u1eb7n, t\u00e1c nh\u00e2n v\u1eabn c\u00f2n l\u1ef1a ch\u1ecdn kh\u00e1c \u0111\u1ec3 n\u00e2ng quy\u1ec1n ho\u1eb7c di chuy\u1ec3n ngang.<\/p>\n

Loader ph\u1ea3n chi\u1ebfu ld.exe ch\u01b0a t\u1eebng \u0111\u01b0\u1ee3c ghi nh\u1eadn<\/h2>\n

Ng\u00e0y 31\/7, t\u00e1c nh\u00e2n \u0111\u01b0a xu\u1ed1ng ld.exe<\/code> c\u00f9ng t\u1ec7p m\u00e3 h\u00f3a Events.dat<\/code>. C\u00f4ng c\u1ee5 nh\u1eadn kh\u00f3a gi\u1ea3i m\u00e3 qua tham s\u1ed1 d\u00f2ng l\u1ec7nh, gi\u1ea3i m\u00e3 payload trong b\u1ed9 nh\u1edb v\u00e0 g\u1ecdi h\u00e0m xu\u1ea5t c\u00f3 t\u00ean ExecuteLoader. C\u00e1ch th\u1ef1c thi ph\u1ea3n chi\u1ebfu h\u1ea1n ch\u1ebf vi\u1ec7c ghi payload r\u00f5 xu\u1ed1ng \u0111\u0129a v\u00e0 l\u00e0m ph\u00e2n t\u00edch d\u1ef1a tr\u00ean t\u1ec7p kh\u00f3 h\u01a1n.<\/p>\n

Nh\u00f3m nghi\u00ean c\u1ee9u thu \u0111\u01b0\u1ee3c loader, t\u00ean t\u1ec7p v\u00e0 kh\u00f3a d\u00f9ng trong m\u1ed9t l\u1ea7n ch\u1ea1y nh\u01b0ng kh\u00f4ng thu \u0111\u01b0\u1ee3c payload \u0111\u00e3 m\u00e3 h\u00f3a, v\u00ec v\u1eady ch\u1ee9c n\u0103ng cu\u1ed1i c\u00f9ng v\u1eabn ch\u01b0a r\u00f5. \u0110\u00e2y l\u00e0 gi\u1edbi h\u1ea1n b\u1eb1ng ch\u1ee9ng quan tr\u1ecdng: c\u00f3 th\u1ec3 x\u00e1c nh\u1eadn c\u00f4ng c\u1ee5 th\u1ef1c thi giai \u0111o\u1ea1n ti\u1ebfp theo, nh\u01b0ng ch\u01b0a th\u1ec3 k\u1ebft lu\u1eadn m\u00e3 n\u00e0o \u0111\u00e3 ch\u1ea1y ho\u1eb7c d\u1eef li\u1ec7u n\u00e0o \u0111\u00e3 b\u1ecb l\u1ea5y.<\/p>\n

Chi\u1ebfn d\u1ecbch k\u00e9o d\u00e0i \u00edt nh\u1ea5t hai th\u00e1ng<\/h2>\n

Ho\u1ea1t \u0111\u1ed9ng ph\u00e2n bi\u1ec7t cu\u1ed1i c\u00f9ng c\u1ee7a ng\u01b0\u1eddi v\u1eadn h\u00e0nh \u0111\u01b0\u1ee3c ghi nh\u1eadn v\u00e0o cu\u1ed1i th\u00e1ng 7, nh\u01b0ng c\u00f9ng loader v\u00e0 tr\u00ecnh kh\u1edfi ch\u1ea1y VBS v\u1eabn t\u1ed3n t\u1ea1i tr\u00ean m\u00e1y kho\u1ea3ng b\u1ed1n tu\u1ea7n sau. Tr\u00ecnh kh\u1edfi ch\u1ea1y l\u1ea1i xu\u1ea5t hi\u1ec7n ng\u00e0y 24\/9\/2026. Symantec v\u00ec th\u1ebf \u0111\u00e1nh gi\u00e1 cu\u1ed9c x\u00e2m nh\u1eadp nh\u00e0 m\u00e1y \u0111\u00f3ng t\u00e0u k\u00e9o d\u00e0i \u00edt nh\u1ea5t hai th\u00e1ng.<\/p>\n

Ch\u01b0a c\u00f3 b\u1eb1ng ch\u1ee9ng c\u00f4ng khai x\u00e1c nh\u1eadn d\u1eef li\u1ec7u b\u1ecb \u0111\u00e1nh c\u1eafp. Tuy nhi\u00ean, \u0111\u01b0\u1eddng h\u1ea7m m\u1ea1ng, ho\u1ea1t \u0111\u1ed9ng thu th\u1eadp th\u00f4ng tin x\u00e1c th\u1ef1c v\u00e0 th\u1eddi gian b\u00e1m tr\u1ee5 d\u00e0i khi\u1ebfn s\u1ef1 c\u1ed1 c\u1ea7n \u0111\u01b0\u1ee3c x\u1eed l\u00fd nh\u01b0 m\u1ed9t cu\u1ed9c x\u00e2m nh\u1eadp \u0111ang ti\u1ebfp di\u1ec5n, kh\u00f4ng ch\u1ec9 l\u00e0 m\u1ed9t email l\u1eeba \u0111\u1ea3o \u0111\u00e3 b\u1ecb ch\u1eb7n.<\/p>\n

Nh\u1eefng d\u1ea5u hi\u1ec7u ph\u00f2ng th\u1ee7 c\u1ea7n \u01b0u ti\u00ean<\/h2>\n
    \n
  • T\u00ecm t\u00e0i li\u1ec7u Word c\u00f3 macro m\u1edf t\u1eeb b\u1ed9 nh\u1edb \u0111\u1ec7m Outlook v\u00e0 chu\u1ed7i AutoOpen t\u1ea1o VBS, HTML ho\u1eb7c batch trong h\u1ed3 s\u01a1 ng\u01b0\u1eddi d\u00f9ng.<\/li>\n
  • Gi\u00e1m s\u00e1t Edge ch\u1ea1y \u1edf v\u1ecb tr\u00ed ngo\u00e0i m\u00e0n h\u00ecnh, k\u00edch th\u01b0\u1edbc b\u1ea5t th\u01b0\u1eddng ho\u1eb7c m\u1edf URL data:text\/html;base64<\/code>.<\/li>\n
  • R\u00e0 so\u00e1t k\u1ebft n\u1ed1i t\u1edbi 185.82.218[.]119<\/code>, c\u00e1c webhook \u0111\u01b0\u1ee3c Symantec c\u00f4ng b\u1ed1 v\u00e0 ti\u1ebfn tr\u00ecnh SSH thi\u1ebft l\u1eadp remote forwarding.<\/li>\n
  • T\u00ecm kh\u00f3a id_rsa<\/code> b\u1ea5t th\u01b0\u1eddng trong ProgramData, thay \u0111\u1ed5i ACL li\u00ean quan v\u00e0 l\u1ec7nh SSH b\u1eadt thu\u1eadt to\u00e1n RSA c\u0169.<\/li>\n
  • Ph\u00e1t hi\u1ec7n PowerShell d\u1ef1ng HttpListener c\u1ee5c b\u1ed9, ph\u1ea3n h\u1ed3i WWW-Authenticate: NTLM<\/code> ho\u1eb7c bu\u1ed9c k\u1ebft n\u1ed1i t\u1edbi loopback.<\/li>\n
  • S\u0103n t\u1ec7p ld.exe<\/code> theo hash do h\u00e3ng c\u00f4ng b\u1ed1, \u0111\u1ed3ng th\u1eddi ph\u00e2n t\u00edch b\u1ed9 nh\u1edb v\u00ec payload cu\u1ed1i c\u00f3 th\u1ec3 kh\u00f4ng t\u1ed3n t\u1ea1i \u1edf d\u1ea1ng r\u00f5 tr\u00ean \u0111\u0129a.<\/li>\n<\/ul>\n

    B\u00e0i h\u1ecdc cho t\u1ed5 ch\u1ee9c qu\u1ed1c ph\u00f2ng v\u00e0 h\u1ea1 t\u1ea7ng tr\u1ecdng y\u1ebfu<\/h2>\n

    Chi\u1ebfn d\u1ecbch cho th\u1ea5y c\u00f4ng c\u1ee5 h\u1ee3p ph\u00e1p nh\u01b0 Edge, curl, PowerShell v\u00e0 OpenSSH c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c gh\u00e9p th\u00e0nh chu\u1ed7i x\u00e2m nh\u1eadp ho\u00e0n ch\u1ec9nh. Gi\u00e1m s\u00e1t ch\u1ec9 d\u1ef1a tr\u00ean t\u00ean ti\u1ebfn tr\u00ecnh s\u1ebd kh\u00f4ng \u0111\u1ee7; \u0111\u1ed9i ph\u00f2ng th\u1ee7 c\u1ea7n k\u1ebft h\u1ee3p d\u00f2ng l\u1ec7nh, quan h\u1ec7 ti\u1ebfn tr\u00ecnh, v\u1ecb tr\u00ed t\u1ec7p, \u0111\u00edch m\u1ea1ng v\u00e0 h\u00e0nh vi x\u00e1c th\u1ef1c.<\/p>\n

    T\u1ed5 ch\u1ee9c c\u0169ng n\u00ean h\u1ea1n ch\u1ebf macro t\u1eeb Internet, c\u00f4 l\u1eadp m\u00e1y tr\u1ea1m kh\u1ecfi ph\u00e2n \u0111o\u1ea1n nh\u1ea1y c\u1ea3m, ki\u1ec3m so\u00e1t SSH \u0111i ra ngo\u00e0i, gi\u1ea3m NTLM v\u00e0 l\u01b0u telemetry ti\u1ebfn tr\u00ecnh l\u1eabn m\u1ea1ng \u0111\u1ee7 l\u00e2u. Khi ph\u00e1t hi\u1ec7n HOOKEDGE, ph\u1ea1m vi \u0111i\u1ec1u tra ph\u1ea3i m\u1edf r\u1ed9ng sang kh\u00f3a SSH, \u0111\u01b0\u1eddng h\u1ea7m, credential material v\u00e0 loader trong b\u1ed9 nh\u1edb thay v\u00ec d\u1eebng \u1edf t\u00e0i li\u1ec7u ban \u0111\u1ea7u.<\/p>\n

    K\u1ebft lu\u1eadn<\/h2>\n

    Swallowtail ph\u1ea3n \u00e1nh phong c\u00e1ch ho\u1ea1t \u0111\u1ed9ng ki\u00ean tr\u00ec c\u1ee7a APT28: x\u00e2m nh\u1eadp b\u1eb1ng t\u00e0i li\u1ec7u quen thu\u1ed9c, t\u1eadn d\u1ee5ng c\u00f4ng c\u1ee5 c\u00f3 s\u1eb5n, chuy\u1ec3n sang h\u1ea1 t\u1ea7ng ri\u00eang r\u1ed3i ch\u1ee7 \u0111\u1ed9ng \u0111i\u1ec1u khi\u1ec3n trong m\u1ea1ng. Chu\u1ed7i t\u1eeb HOOKEDGE \u0111\u1ebfn \u0111\u01b0\u1eddng h\u1ea7m SSH, NTLM v\u00e0 loader ph\u1ea3n chi\u1ebfu cho th\u1ea5y gi\u00e1 tr\u1ecb c\u1ee7a \u0111i\u1ec1u tra theo h\u00e0nh vi v\u00e0 theo to\u00e0n b\u1ed9 v\u00f2ng \u0111\u1eddi t\u1ea5n c\u00f4ng, \u0111\u1eb7c bi\u1ec7t v\u1edbi c\u00e1c t\u1ed5 ch\u1ee9c n\u1eafm gi\u1eef d\u1eef li\u1ec7u qu\u1ed1c ph\u00f2ng.<\/p>\n

    VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb Symantec Threat Hunter Team\/Broadcom v\u00e0 The Hacker News<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

    APT28, nh\u00f3m gi\u00e1n \u0111i\u1ec7p m\u1ea1ng l\u00e2u n\u0103m \u0111\u01b0\u1ee3c li\u00ean h\u1ec7 v\u1edbi t\u00ecnh b\u00e1o qu\u00e2n s\u1ef1 Nga, v\u1eeba b\u1ecb quy tr\u00e1ch nhi\u1ec7m cho m\u1ed9t chi\u1ebfn d\u1ecbch nh\u1eafm v\u00e0o c\u01a1 quan th\u1ef1c thi ph\u00e1p lu\u1eadt, nh\u00e0 m\u00e1y \u0111\u00f3ng t\u00e0u h\u1ea3i qu\u00e2n v\u00e0 h\u00e3ng s\u1ea3n xu\u1ea5t \u0111\u1ed9ng c\u01a1 m\u00e1y bay qu\u00e2n s\u1ef1 t\u1ea1i hai qu\u1ed1c gia NATO. Cu\u1ed9c […]<\/p>\n","protected":false},"author":2,"featured_media":2135,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[984,986,987,201,988,989,991,992,990,985],"class_list":["post-2136","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-apt28","tag-fancy-bear","tag-forest-blizzard","tag-gian-diep-mang","tag-hookedge","tag-nato","tag-ntlm","tag-reflective-loader","tag-ssh-tunnel","tag-swallowtail"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2136","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2136"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2136\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2135"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2136"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2136"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}