{"id":2413,"date":"2023-01-03T12:53:03","date_gmt":"2023-01-03T12:53:03","guid":{"rendered":"https:\/\/chuyendoiso.haiphong.gov.vn\/?p=2413"},"modified":"2024-04-23T12:53:38","modified_gmt":"2024-04-23T12:53:38","slug":"tin-tac-loi-dung-telegram-nham-muc-tieu-vao-cac-cong-ty-tien-dien-tu","status":"publish","type":"post","link":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/2023\/01\/03\/tin-tac-loi-dung-telegram-nham-muc-tieu-vao-cac-cong-ty-tien-dien-tu\/","title":{"rendered":"Tin t\u1eb7c l\u1ee3i d\u1ee5ng Telegram nh\u1eafm m\u1ee5c ti\u00eau v\u00e0o c\u00e1c c\u00f4ng ty ti\u1ec1n \u0111i\u1ec7n t\u1eed"},"content":{"rendered":"
<\/p>\n
\"Tin<\/a><\/div>\n

<\/p>\n

\n

Microsoft g\u1ea7n \u0111\u00e2y \u0111\u00e3 ph\u00e1t hi\u1ec7n m\u1ed9t cu\u1ed9c t\u1ea5n c\u00f4ng, trong \u0111\u00f3 tin t\u1eb7c l\u1ee3i d\u1ee5ng c\u00e1c nh\u00f3m tr\u00f2 chuy\u1ec7n Telegram \u0111\u1ec3 nh\u1eafm m\u1ee5c ti\u00eau v\u00e0o c\u00e1c c\u00f4ng ty \u0111\u1ea7u t\u01b0 ti\u1ec1n \u0111i\u1ec7n t\u1eed. H\u00e3ng x\u00e1c \u0111\u1ecbnh nh\u00f3m tin t\u1eb7c \u0111\u1ee9ng sau chi\u1ebfn d\u1ecbch l\u1ea7n n\u00e0y l\u00e0 DEV-0139.
\n<\/strong><\/p>\n

\n
\"Tin<\/a><\/div>\n<\/div>\n

Nh\u00f3m nghi\u00ean c\u1ee9u Security Threat Intelligence c\u1ee7a Microsoft cho bi\u1ebft, DEV-0139 tham gia c\u00e1c nh\u00f3m Telegram gi\u1eefa kh\u00e1ch h\u00e0ng VIP v\u00e0 c\u00e1c s\u00e0n giao d\u1ecbch ti\u1ec1n \u0111i\u1ec7n t\u1eed, t\u1eeb \u0111\u00f3 t\u00ecm ki\u1ebfm m\u1ee5c ti\u00eau trong s\u1ed1 c\u00e1c th\u00e0nh vi\u00ean. V\u00e0o ng\u00e0y 19\/10, tin t\u1eb7c \u0111\u00e3 gi\u1ea3 l\u00e0m \u0111\u1ea1i di\u1ec7n c\u1ee7a m\u1ed9t c\u00f4ng ty qu\u1ea3n l\u00fd t\u00e0i s\u1ea3n \u0111i\u1ec7n t\u1eed v\u00e0 m\u1eddi \u00edt nh\u1ea5t m\u1ed9t m\u1ee5c ti\u00eau tham gia m\u1ed9t nh\u00f3m Telegram, n\u01a1i cung c\u1ea5p c\u00e1c th\u00f4ng tin v\u1ec1 c\u1ea5u tr\u00fac ph\u00ed c\u1ee7a c\u00e1c s\u00e0n giao d\u1ecbch ti\u1ec1n \u0111i\u1ec7n t\u1eed. Sau khi l\u1ea5y \u0111\u01b0\u1ee3c l\u00f2ng tin c\u1ee7a n\u1ea1n nh\u00e2n, tin t\u1eb7c g\u1eedi b\u1ea3ng t\u00ednh Excel \u0111\u1ed9c h\u1ea1i c\u00f3 t\u00ean \u201cOKX Binance & Huobi VIP fee comparision.xls\u201d c\u00f9ng v\u1edbi d\u1eef li\u1ec7u so s\u00e1nh c\u1ea5u tr\u00fac ph\u00ed VIP c\u1ee7a c\u00e1c s\u00e0n giao d\u1ecbch ti\u1ec1n \u0111i\u1ec7n t\u1eed.<\/p>\n

Sau khi n\u1ea1n nh\u00e2n m\u1edf t\u00e0i li\u1ec7u v\u00e0 k\u00edch ho\u1ea1t macro, m\u1ed9t b\u1ea3ng t\u00ednh th\u1ee9 hai \u0111\u01b0\u1ee3c nh\u00fang trong t\u1ec7p s\u1ebd t\u1ea3i xu\u1ed1ng v\u00e0 ph\u00e2n t\u00edch t\u1ec7p PNG \u0111\u1ec3 tr\u00edch xu\u1ea5t m\u1ed9t t\u1ec7p DLL \u0111\u1ed9c h\u1ea1i, m\u1ed9t backdoor \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a XOR v\u00e0 m\u1ed9t t\u1ec7p th\u1ef1c thi Windows h\u1ee3p ph\u00e1p sau \u0111\u00f3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 t\u1ea3i t\u1ec7p DLL. DLL n\u00e0y s\u1ebd gi\u1ea3i m\u00e3 v\u00e0 t\u1ea3i backdoor, t\u1eeb \u0111\u00f3 gi\u00fap tin t\u1eb7c gi\u00e0nh \u0111\u01b0\u1ee3c quy\u1ec1n truy c\u1eadp t\u1eeb xa v\u00e0o h\u1ec7 th\u1ed1ng n\u1ea1n nh\u00e2n.<\/p>\n

B\u1ea3ng\u00a0t\u00ednh Excel sau \u0111\u00f3 s\u1ebd kh\u00f4ng \u0111\u01b0\u1ee3c b\u1ea3o v\u1ec7 n\u1ebfu t\u1ec7p Excel th\u1ee9 hai \u0111\u01b0\u1ee3c l\u01b0u tr\u1eef trong Base64 \u0111\u00e3 \u0111\u01b0\u1ee3c c\u00e0i \u0111\u1eb7t v\u00e0 k\u00edch ho\u1ea1t. \u0110i\u1ec1u n\u00e0y gi\u00fap \u0111\u00e1nh l\u1eeba ng\u01b0\u1eddi d\u00f9ng b\u1eadt macro v\u00e0 kh\u00f4ng g\u00e2y nghi ng\u1edd. M\u1ed9t payload th\u1ee9 hai c\u0169ng \u0111\u01b0\u1ee3c DEV-0139 s\u1eed d\u1ee5ng trong chi\u1ebfn d\u1ecbch n\u00e0y. \u0110\u00f3 l\u00e0 g\u00f3i MSI cho \u1ee9ng d\u1ee5ng CryptoDashboardV2, cho th\u1ea5y nh\u00f3m c\u0169ng \u0111\u1ee9ng sau c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng kh\u00e1c s\u1eed d\u1ee5ng k\u1ef9 thu\u1eadt t\u01b0\u01a1ng t\u1ef1 \u0111\u1ec3 ph\u00e1t t\u00e1n c\u00e1c payload t\u00f9y ch\u1ec9nh.<\/p>\n

H\u00e3ng Volexity cu\u1ed1i tu\u1ea7n tr\u01b0\u1edbc cho r\u1eb1ng nh\u00f3m tin t\u1eb7c Lazarus (Tri\u1ec1u Ti\u00ean) c\u00f3 li\u00ean quan \u0111\u1ebfn chi\u1ebfn d\u1ecbch l\u1ea7n n\u00e0y. Theo Volexity, c\u00e1c tin t\u1eb7c Tri\u1ec1u Ti\u00ean \u0111\u00e3 s\u1eed d\u1ee5ng b\u1ea3ng t\u00ednh \u0111\u1ed9c h\u1ea1i \u0111\u1ec3 th\u1ea3 AppleJeus, m\u00e3 \u0111\u1ed9c t\u1eebng \u0111\u01b0\u1ee3c Lazarus s\u1eed d\u1ee5ng \u0111\u1ec3 \u0111\u00e1nh c\u1eafp ti\u1ec1n \u0111i\u1ec7n t\u1eed v\u00e0 c\u00e1c t\u00e0i s\u1ea3n k\u1ef9 thu\u1eadt s\u1ed1 kh\u00e1c. Volexity c\u0169ng quan s\u00e1t th\u1ea5y Lazarus s\u1eed d\u1ee5ng b\u1ea3n sao trang web s\u00e0n giao d\u1ecbch ti\u1ec1n \u0111i\u1ec7n t\u1eed t\u1ef1 \u0111\u1ed9ng HaasOnline \u0111\u1ec3 ph\u00e2n ph\u1ed1i phi\u00ean b\u1ea3n \u0111\u00e3 b\u1ecb trojan h\u00f3a c\u1ee7a \u1ee9ng d\u1ee5ng BloxHolder. Phi\u00ean b\u1ea3n n\u00e0y c\u00f3 nhi\u1ec7m v\u1ee5 tri\u1ec3n khai ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i AppleJeus \u0111i k\u00e8m trong \u1ee9ng d\u1ee5ng QTBitcoinTrader.<\/p>\n

Microsoft cho bi\u1ebft h\u00e3ng \u0111\u00e3 th\u00f4ng b\u00e1o cho nh\u1eefng kh\u00e1ch h\u00e0ng b\u1ecb x\u00e2m ph\u1ea1m ho\u1eb7c b\u1ecb nh\u1eafm m\u1ee5c ti\u00eau trong cu\u1ed9c t\u1ea5n c\u00f4ng n\u00e0y, \u0111\u1ed3ng th\u1eddi chia s\u1ebb th\u00f4ng tin c\u1ea7n thi\u1ebft \u0111\u1ec3 b\u1ea3o m\u1eadt t\u00e0i kho\u1ea3n.<\/p>\n

Lazarus l\u00e0 m\u1ed9t nh\u00f3m hacker B\u1eafc Tri\u1ec1u Ti\u00ean \u0111\u00e3 ho\u1ea1t \u0111\u1ed9ng h\u01a1n m\u1ed9t th\u1eadp k\u1ef7, \u00edt nh\u1ea5t l\u00e0 k\u1ec3 t\u1eeb n\u0103m 2009. Nh\u00f3m n\u00e0y \u0111\u01b0\u1ee3c bi\u1ebft \u0111\u1ebfn v\u1edbi c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng v\u00e0o c\u00e1c m\u1ee5c ti\u00eau cao c\u1ea5p tr\u00ean to\u00e0n th\u1ebf gi\u1edbi, bao g\u1ed3m ng\u00e2n h\u00e0ng, t\u1ed5 ch\u1ee9c truy\u1ec1n th\u00f4ng v\u00e0 c\u01a1 quan ch\u00ednh ph\u1ee7. Nh\u00f3m \u0111\u01b0\u1ee3c cho l\u00e0 ch\u1ecbu tr\u00e1ch nhi\u1ec7m cho c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng m\u1ea1ng l\u1edbn, bao g\u1ed3m v\u1ee5 hack Sony Pictures n\u0103m 2014 v\u00e0 cu\u1ed9c t\u1ea5n c\u00f4ng m\u00e3 \u0111\u1ed9c t\u1ed1ng ti\u1ec1n\u00a0WannaCry n\u0103m 2017.<\/p>\n

Ngu\u1ed3n: https:\/\/antoanthongtin.vn\/hacker-malware\/tin-tac-loi-dung-telegram-nham-muc-tieu-vao-cac-cong-ty-tien-dien-tu-108579<\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Microsoft g\u1ea7n \u0111\u00e2y \u0111\u00e3 ph\u00e1t hi\u1ec7n m\u1ed9t cu\u1ed9c t\u1ea5n c\u00f4ng, trong \u0111\u00f3 tin t\u1eb7c l\u1ee3i d\u1ee5ng c\u00e1c nh\u00f3m tr\u00f2 chuy\u1ec7n Telegram \u0111\u1ec3 nh\u1eafm m\u1ee5c ti\u00eau v\u00e0o c\u00e1c c\u00f4ng ty \u0111\u1ea7u t\u01b0 ti\u1ec1n \u0111i\u1ec7n t\u1eed. H\u00e3ng x\u00e1c \u0111\u1ecbnh nh\u00f3m tin t\u1eb7c \u0111\u1ee9ng sau chi\u1ebfn d\u1ecbch l\u1ea7n n\u00e0y l\u00e0 DEV-0139. Nh\u00f3m nghi\u00ean c\u1ee9u Security Threat Intelligence c\u1ee7a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[13],"tags":[],"class_list":{"0":"post-2413","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-tin-tuc"},"_links":{"self":[{"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/posts\/2413","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/comments?post=2413"}],"version-history":[{"count":1,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/posts\/2413\/revisions"}],"predecessor-version":[{"id":2692,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/posts\/2413\/revisions\/2692"}],"wp:attachment":[{"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/media?parent=2413"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/categories?post=2413"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/tags?post=2413"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}