{"id":3892,"date":"2024-11-29T09:00:02","date_gmt":"2024-11-29T09:00:02","guid":{"rendered":"https:\/\/chuyendoiso.haiphong.gov.vn\/?p=3892"},"modified":"2025-04-21T01:41:01","modified_gmt":"2025-04-21T01:41:01","slug":"cuc-an-toan-thong-tin-canh-bao-chien-dich-tan-cong-co-chu-dich-cua-nhom-apt-earth-estries","status":"publish","type":"post","link":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/2024\/11\/29\/cuc-an-toan-thong-tin-canh-bao-chien-dich-tan-cong-co-chu-dich-cua-nhom-apt-earth-estries\/","title":{"rendered":"C\u1ee5c An to\u00e0n th\u00f4ng tin c\u1ea3nh b\u00e1o chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng c\u00f3 ch\u1ee7 \u0111\u00edch c\u1ee7a nh\u00f3m APT Earth Estries"},"content":{"rendered":"
\n
\n

C\u1ee5c An to\u00e0n th\u00f4ng tin ph\u00e1t \u0111i c\u00f4ng v\u0103n c\u1ea3nh b\u00e1o \u0111\u1ebfn c\u00e1c c\u01a1 quan nh\u00e0 n\u01b0\u1edbc; t\u1eadp \u0111o\u00e0n, t\u1ed5ng c\u00f4ng ty nh\u00e0 n\u01b0\u1edbc, c\u00e1c doanh nghi\u1ec7p cung c\u1ea5p d\u1ecbch v\u1ee5 vi\u1ec5n th\u00f4ng, Internet v\u00e0 n\u1ec1n t\u1ea3ng s\u1ed1, t\u1ed5 ch\u1ee9c t\u00e0i ch\u00ednh, ng\u00e2n h\u00e0ng th\u01b0\u01a1ng m\u1ea1i c\u1ea3nh b\u00e1o chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng c\u00f3 ch\u1ee7 \u0111\u00edch c\u1ee7a nh\u00f3m APT Earth Estries.<\/strong><\/h1>\n<\/div>\n<\/div>\n
\n
\n

 <\/p>\n

\n
\"C\u1ee5c<\/a><\/div>\n<\/div>\n

Theo \u0111\u00f3, Trung t\u00e2m Gi\u00e1m s\u00e1t an to\u00e0n\u00a0kh\u00f4ng gian m\u1ea1ng qu\u1ed1c gia<\/a>\u00a0(NCSC) thu\u1ed9c C\u1ee5c An to\u00e0n th\u00f4ng tin (B\u1ed9 Th\u00f4ng tin v\u00e0 Truy\u1ec1n th\u00f4ng) \u0111\u00e3 ph\u00e1t hi\u1ec7n v\u00e0 ghi nh\u1eadn th\u00f4ng tin li\u00ean quan \u0111\u1ebfn chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng c\u00f3 ch\u1ee7 \u0111\u00edch c\u1ee7a nh\u00f3m APT Earth Estries.<\/p>\n

Nh\u00f3m Earth Estries th\u1ef1c hi\u1ec7n c\u00e1c chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng tinh vi b\u1eb1ng c\u00e1ch khai th\u00e1c l\u1ed7 h\u1ed5ng tr\u00ean c\u00e1c h\u1ec7 th\u1ed1ng nh\u01b0 Microsoft Exchange v\u00e0 c\u00f4ng c\u1ee5 qu\u1ea3n l\u00fd adapter m\u1ea1ng. Nh\u00f3m s\u1eed d\u1ee5ng c\u00e1c m\u00e3 \u0111\u1ed9c nh\u01b0\u00a0Cobalt Strike<\/a>, Crowdoor, Zingdoor v\u00e0 SnappyBee \u0111\u1ec3 l\u00e2y lan, duy tr\u00ec k\u1ebft n\u1ed1i, thu th\u1eadp d\u1eef li\u1ec7u v\u00e0 che gi\u1ea5u l\u01b0u l\u01b0\u1ee3ng m\u1ea1ng th\u00f4ng qua proxy n\u1ed9i b\u1ed9, \u0111\u1ed3ng th\u1eddi li\u00ean t\u1ee5c c\u1eadp nh\u1eadt c\u00f4ng c\u1ee5 \u0111\u1ec3 n\u00e9 tr\u00e1nh ph\u00e1t hi\u1ec7n. C\u00e1c d\u1eef li\u1ec7u \u0111\u00e1nh c\u1eafp \u0111\u01b0\u1ee3c tr\u00edch xu\u1ea5t t\u1edbi c\u00e1c d\u1ecbch v\u1ee5 chia s\u1ebb file \u1ea9n danh ho\u1eb7c m\u00e1y ch\u1ee7 C&C.<\/p>\n

Ngo\u00e0i c\u00e1c m\u00e3 \u0111\u1ed9c k\u1ec3 tr\u00ean, h\u1ec7 th\u1ed1ng m\u1ee5c ti\u00eau c\u00f2n ch\u1ee9a\u00a0m\u00e3 \u0111\u1ed9c<\/a>\u00a0Cryptmerlin c\u00f3 ch\u1ee9c n\u0103ng th\u1ef1c thi l\u1ec7nh g\u1eedi t\u1edbi t\u1eeb m\u00e1y ch\u1ee7 C&C v\u00e0 FuxosDoor m\u00e3 \u0111\u1ed9c c\u00e0i v\u00e0o IIS tr\u00ean m\u00e1y ch\u1ee7 Exchange, th\u1ef1c thi l\u1ec7nh s\u1eed d\u1ee5ng cmd[.]exe.<\/p>\n

Nh\u1eb1m b\u1ea3o \u0111\u1ea3m an to\u00e0n cho h\u1ec7 th\u1ed1ng th\u00f4ng tin c\u1ee7a c\u00e1c c\u01a1 quan, t\u1ed5 ch\u1ee9c, doanh nghi\u1ec7p, C\u1ee5c An to\u00e0n th\u00f4ng tin \u0111\u1ec1 ngh\u1ecb c\u00e1c \u0111\u01a1n v\u1ecb ki\u1ec3m tra, r\u00e0 so\u00e1t h\u1ec7 th\u1ed1ng th\u00f4ng tin \u0111ang s\u1eed d\u1ee5ng c\u00f3 kh\u1ea3 n\u0103ng b\u1ecb \u1ea3nh h\u01b0\u1edfng b\u1edfi c\u00e1c chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng tr\u00ean; ch\u1ee7 \u0111\u1ed9ng theo d\u00f5i th\u00f4ng tin li\u00ean quan \u0111\u1ebfn c\u00e1c chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng m\u1ea1ng nh\u1eb1m th\u1ef1c hi\u1ec7n ng\u0103n ch\u1eb7n s\u1edbm.<\/p>\n

C\u00e1c \u0111\u01a1n v\u1ecb t\u0103ng c\u01b0\u1eddng gi\u00e1m s\u00e1t, s\u1eb5n s\u00e0ng ph\u01b0\u01a1ng \u00e1n x\u1eed l\u00fd khi ph\u00e1t hi\u1ec7n c\u00f3 d\u1ea5u hi\u1ec7u b\u1ecb khai th\u00e1c, t\u1ea5n c\u00f4ng m\u1ea1ng; \u0111\u1ed3ng th\u1eddi th\u01b0\u1eddng xuy\u00ean theo d\u00f5i k\u00eanh c\u1ea3nh b\u00e1o c\u1ee7a c\u00e1c c\u01a1 quan ch\u1ee9c n\u0103ng v\u00e0 c\u00e1c t\u1ed5 ch\u1ee9c l\u1edbn v\u1ec1 an to\u00e0n th\u00f4ng tin \u0111\u1ec3 ph\u00e1t hi\u1ec7n k\u1ecbp th\u1eddi c\u00e1c nguy c\u01a1 t\u1ea5n c\u00f4ng m\u1ea1ng\u2026<\/p>\n

\n
Ngu\u1ed3n: https:\/\/antoanthongtin.vn\/<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

C\u1ee5c An to\u00e0n th\u00f4ng tin ph\u00e1t \u0111i c\u00f4ng v\u0103n c\u1ea3nh b\u00e1o \u0111\u1ebfn c\u00e1c c\u01a1 quan nh\u00e0 n\u01b0\u1edbc; t\u1eadp \u0111o\u00e0n, t\u1ed5ng c\u00f4ng ty nh\u00e0 n\u01b0\u1edbc, c\u00e1c doanh nghi\u1ec7p cung c\u1ea5p d\u1ecbch v\u1ee5 vi\u1ec5n th\u00f4ng, Internet v\u00e0 n\u1ec1n t\u1ea3ng s\u1ed1, t\u1ed5 ch\u1ee9c t\u00e0i ch\u00ednh, ng\u00e2n h\u00e0ng th\u01b0\u01a1ng m\u1ea1i c\u1ea3nh b\u00e1o chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng c\u00f3 ch\u1ee7 \u0111\u00edch […]<\/p>\n","protected":false},"author":6,"featured_media":3901,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[13],"tags":[],"class_list":{"0":"post-3892","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-tin-tuc"},"_links":{"self":[{"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/posts\/3892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/comments?post=3892"}],"version-history":[{"count":1,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/posts\/3892\/revisions"}],"predecessor-version":[{"id":3903,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/posts\/3892\/revisions\/3903"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/media\/3901"}],"wp:attachment":[{"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/media?parent=3892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/categories?post=3892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/chuyendoiso.haiphong.gov.vn\/index.php\/wp-json\/wp\/v2\/tags?post=3892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}