{"id":46106,"date":"2025-05-21T08:46:53","date_gmt":"2025-05-21T01:46:53","guid":{"rendered":"https:\/\/antoanthongtinhaiphong.gov.vn\/?p=46106"},"modified":"2025-05-21T08:46:53","modified_gmt":"2025-05-21T01:46:53","slug":"phat-hien-cuoc-tan-cong-chuoi-cung-ung-moi-xam-pham-den-goi-npm-pho-bien-voi-nguoi-dung","status":"publish","type":"post","link":"https:\/\/antoanthongtinhaiphong.gov.vn\/phat-hien-cuoc-tan-cong-chuoi-cung-ung-moi-xam-pham-den-goi-npm-pho-bien-voi-nguoi-dung\/","title":{"rendered":"Ph\u00e1t hi\u1ec7n cu\u1ed9c t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng m\u1edbi x\u00e2m ph\u1ea1m \u0111\u1ebfn g\u00f3i npm ph\u1ed5 bi\u1ebfn v\u1edbi ng\u01b0\u1eddi d\u00f9ng"},"content":{"rendered":"<p class=\"mt-3 excerpt\">M\u1ed9t g\u00f3i npm c\u00f3 t\u00ean l\u00e0 rand-user-agent \u0111\u00e3 b\u1ecb x\u00e2m ph\u1ea1m trong m\u1ed9t cu\u1ed9c t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng, nh\u1eb1m k\u00edch ho\u1ea1t Trojan truy c\u1eadp t\u1eeb xa (RAT) v\u00e0o h\u1ec7 th\u1ed1ng c\u1ee7a ng\u01b0\u1eddi d\u00f9ng.<\/p>\n<div id=\"relatedPost\" class=\"mt-3 mb-3\">\n<div class=\"\">\n<ul class=\"ms-2\">\n<li class=\"d-flex\">\n<ul class=\"d-flex flex-column gap-2\">\n<li class=\"title bullet\" title=\"Th\u01b0 m\u1eddi vi\u1ebft b\u00e0i H\u1ed9i th\u1ea3o Qu\u1ed1c gia VNICT 2025 \u201cC\u00f4ng ngh\u1ec7 v\u00e0 \u1ee9ng d\u1ee5ng d\u1ef1a tr\u00ean d\u1eef li\u1ec7u\u201d\">Th\u01b0 m\u1eddi vi\u1ebft b\u00e0i H\u1ed9i th\u1ea3o Qu\u1ed1c gia VNICT 2025 \u201cC\u00f4ng ngh\u1ec7 v\u00e0 \u1ee9ng d\u1ee5ng d\u1ef1a tr\u00ean d\u1eef li\u1ec7u\u201d<\/li>\n<\/ul>\n<\/li>\n<li class=\"d-flex\">\n<ul class=\"d-flex flex-column gap-2\">\n<li class=\"title bullet\" title=\"C\u1ea3nh b\u00e1o l\u1eeba \u0111\u1ea3o li\u00ean quan \u0111\u1ebfn c\u1eadp nh\u1eadt \u0111\u0103ng k\u00fd thi t\u1ed1t nghi\u1ec7p\">C\u1ea3nh b\u00e1o l\u1eeba \u0111\u1ea3o li\u00ean quan \u0111\u1ebfn c\u1eadp nh\u1eadt \u0111\u0103ng k\u00fd thi t\u1ed1t nghi\u1ec7p<\/li>\n<\/ul>\n<\/li>\n<li class=\"d-flex\">\n<ul class=\"d-flex flex-column gap-2\">\n<li class=\"title bullet\" title=\"H\u00e0n Qu\u1ed1c lo ng\u1ea1i v\u1ec1 nguy c\u01a1 r\u00f2 r\u1ec9 th\u00f4ng tin sau v\u1ee5 t\u1ea5n c\u00f4ng m\u1ea1ng v\u00e0o SK Telecom\">H\u00e0n Qu\u1ed1c lo ng\u1ea1i v\u1ec1 nguy c\u01a1 r\u00f2 r\u1ec9 th\u00f4ng tin sau v\u1ee5 t\u1ea5n c\u00f4ng m\u1ea1ng v\u00e0o SK Telecom<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<article id=\"content\" class=\"content gradient\">\u0110\u01b0\u1ee3c bi\u1ebft, rand-user-agent l\u00e0 m\u1ed9t c\u00f4ng c\u1ee5 t\u1ea1o chu\u1ed7i user-agent ng\u1eabu nhi\u00ean, h\u1eefu \u00edch trong vi\u1ec7c thu th\u1eadp d\u1eef li\u1ec7u web, th\u1eed nghi\u1ec7m t\u1ef1 \u0111\u1ed9ng v\u00e0 nghi\u00ean c\u1ee9u b\u1ea3o m\u1eadt. M\u1eb7c d\u00f9 g\u00f3i n\u00e0y \u0111\u00e3 kh\u00f4ng c\u00f2n \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng n\u1eefa nh\u01b0ng n\u00f3 v\u1eabn kh\u00e1 ph\u1ed5 bi\u1ebfn, \u0111\u1ea1t trung b\u00ecnh 45.000 l\u01b0\u1ee3t t\u1ea3i xu\u1ed1ng m\u1ed7i tu\u1ea7n.<\/p>\n<p>Tuy nhi\u00ean, theo c\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u t\u1ea1i c\u00f4ng ty an ninh m\u1ea1ng Aikido (B\u1ec9) cho bi\u1ebft, m\u00e3 \u0111\u1ed9c \u0111\u01b0\u1ee3c nh\u00fang trong m\u1ed9t s\u1ed1 b\u1ea3n ph\u00e1t h\u00e0nh m\u1edbi nh\u1ea5t c\u1ee7a rand-user-agent, t\u1eeb \u0111\u00f3 k\u00edch ho\u1ea1t RAT \u0111\u1ec3 x\u00e2m ph\u1ea1m h\u1ec7 th\u1ed1ng v\u00e0\u00a0<a href=\"https:\/\/antoanthongtin.vn\/tin\/thanh-toan-nfc-qua-dien-thoai-co-the-bi-tin-tac-danh-cap-du-lieu-the\">\u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u<\/a>\u00a0nh\u1ea1y c\u1ea3m.<\/p>\n<p>Aikido ph\u00e1t hi\u1ec7n ra s\u1ef1 x\u00e2m ph\u1ea1m v\u00e0o ng\u00e0y 5\/5\/2025, khi h\u1ec7 th\u1ed1ng ph\u00e2n t\u00edch ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i c\u1ee7a h\u1ecd ki\u1ec3m tra phi\u00ean b\u1ea3n m\u1edbi c\u1ee7a rand-user-agent (1.0.110). Trong qu\u00e1 tr\u00ecnh \u0111i\u1ec1u tra, c\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u \u0111\u00e3 t\u00ecm th\u1ea5y m\u00e3 \u0111\u1ed9c \u1ea9n trong t\u1ec7p \u201cdist\/index[.]js\u201d, ch\u1ec9 hi\u1ec3n th\u1ecb khi ng\u01b0\u1eddi d\u00f9ng cu\u1ed9n theo chi\u1ec1u ngang trong ch\u1ebf \u0111\u1ed9 xem m\u00e3 ngu\u1ed3n tr\u00ean trang web npm.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/dulieu.antoanthongtin.gov.vn\/tapchiantoanthongtin\/690c6550-6df3-4305-a06d-5d6fd7c58f8f\/hidden.png\" \/><\/p>\n<p><em>M\u00e3 \u0111\u1ed9c b\u1ecb che gi\u1ea5u th\u00f4ng qua thanh cu\u1ed9n c\u1ee7a rand-user-agent<\/em><\/p>\n<p>Cu\u1ed9c \u0111i\u1ec1u tra cho th\u1ea5y phi\u00ean b\u1ea3n h\u1ee3p l\u1ec7 cu\u1ed1i c\u00f9ng c\u1ee7a rand-user-agent l\u00e0 2.0.82, \u0111\u01b0\u1ee3c ph\u00e1t h\u00e0nh c\u00e1ch \u0111\u00e2y 7 th\u00e1ng. C\u00e1c phi\u00ean b\u1ea3n 2.0.83, 2.0.84 v\u00e0 c\u1ea3 1.0.110 \u0111\u01b0\u1ee3c ph\u00e1t h\u00e0nh sau \u0111\u00f3 \u0111\u1ec1u b\u1ecb l\u00e2y nhi\u1ec5m ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i v\u00e0 kh\u00f4ng c\u00f3 b\u1ea3n ph\u00e1t h\u00e0nh t\u01b0\u01a1ng \u1ee9ng tr\u00ean kho l\u01b0u tr\u1eef\u00a0<a href=\"https:\/\/antoanthongtin.vn\/tin\/poc-lua-dao-cua-lo-hong-ldapnightmware-tren-github-phat-tan-phan-mem-doc-hai-danh-cap-thong-tin\">GitHub<\/a>\u00a0c\u1ee7a project n\u00e0y.<\/p>\n<p>M\u00e3 \u0111\u1ed9c \u0111\u01b0\u1ee3c nh\u00fang trong c\u00e1c phi\u00ean b\u1ea3n m\u1edbi nh\u1ea5t s\u1ebd t\u1ea1o m\u1ed9t th\u01b0 m\u1ee5c \u1ea9n trong th\u01b0 m\u1ee5c g\u1ed1c c\u1ee7a ng\u01b0\u1eddi d\u00f9ng (~\/.node_modules) v\u00e0 th\u01b0 m\u1ee5c m\u1edf r\u1ed9ng module[.]paths, \u0111\u1ec3 c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng \u0111\u01b0\u1eddng d\u1eabn t\u00f9y ch\u1ec9nh n\u00e0y \u0111\u1ec3 t\u1ea3i c\u00e1c ph\u1ea7n ph\u1ee5 thu\u1ed9c, c\u1ee5 th\u1ec3 l\u00e0 \u201caxios\u201d v\u00e0 \u201csocket[.]io-client\u201d.<\/p>\n<p>Ti\u1ebfp theo, m\u00e3 \u0111\u1ed9c m\u1edf m\u1ed9t k\u1ebft n\u1ed1i socket li\u00ean t\u1ee5c t\u1edbi m\u00e1y ch\u1ee7 \u0111i\u1ec1u khi\u1ec3n v\u00e0 ra l\u1ec7nh (C2) c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng t\u1ea1i \u0111\u1ecba ch\u1ec9 http:\/\/85[.]239[.]62[.]36:3306 v\u00e0 g\u1eedi th\u00f4ng tin ID m\u00e1y bao g\u1ed3m t\u00ean m\u00e1y ch\u1ee7, t\u00ean ng\u01b0\u1eddi d\u00f9ng, th\u00f4ng tin h\u1ec7 \u0111i\u1ec1u h\u00e0nh v\u00e0 UUID \u0111\u00e3 t\u1ea1o.<\/p>\n<p>Theo c\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u, m\u00e3 \u0111\u1ed9c h\u1ed7 tr\u1ee3 m\u1ed9t lo\u1ea1t c\u00e1c l\u1ec7nh, cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng thay \u0111\u1ed5i th\u01b0 m\u1ee5c, th\u1ef1c thi c\u00e1c l\u1ec7nh shell t\u00f9y \u00fd v\u00e0 t\u1ea3i t\u1eebng t\u1ec7p ri\u00eang l\u1ebb ho\u1eb7c to\u00e0n b\u1ed9 th\u01b0 m\u1ee5c l\u00ean \u0111i\u1ec3m cu\u1ed1i \u0111\u01b0\u1ee3c ch\u1ec9 \u0111\u1ecbnh. C\u1ee5 th\u1ec3, khi\u00a0<a href=\"https:\/\/antoanthongtin.vn\/tin\/trojan-goldpickaxe-moi-danh-cap-du-lieu-nhan-dang-khuon-mat-de-lua-dao\">RAT<\/a>\u00a0ho\u1ea1t \u0111\u1ed9ng s\u1ebd th\u1ef1c thi m\u1ed9t s\u1ed1 l\u1ec7nh d\u01b0\u1edbi \u0111\u00e2y:<\/p>\n<p>&#8211; cd &lt;\u0111\u01b0\u1eddng d\u1eabn&gt;: Thay \u0111\u1ed5i th\u01b0 m\u1ee5c l\u00e0m vi\u1ec7c hi\u1ec7n t\u1ea1i<\/p>\n<p>&#8211; ss_dir: \u0110\u1eb7t l\u1ea1i t\u00ean th\u01b0 m\u1ee5c th\u00e0nh \u0111\u01b0\u1eddng d\u1eabn t\u1eadp l\u1ec7nh<\/p>\n<p>&#8211; ss_upd:d,dest: T\u1ea3i t\u1ea5t c\u1ea3 c\u00e1c t\u1ec7p tin trong th\u01b0 m\u1ee5c d l\u00ean dest<\/p>\n<p>&#8211; ss_stop: Ng\u1eaft b\u1ea5t k\u1ef3 t\u1ec7p tin n\u00e0o \u0111ang t\u1ea3i l\u00ean<\/p>\n<p>&#8211; (any other): Th\u1ef1c thi n\u00f3 nh\u01b0 m\u1ed9t l\u1ec7nh shell b\u1eb1ng c\u00e1ch s\u1eed d\u1ee5ng ti\u1ebfn tr\u00ecnh child_process[.]exec()<\/p>\n<p>M\u1ed9t t\u00ednh n\u0103ng \u0111\u1eb7c bi\u1ec7t nguy hi\u1ec3m nh\u1eafm v\u00e0o h\u1ec7 th\u1ed1ng Windows b\u1eb1ng c\u00e1ch th\u00eam m\u1ed9t \u0111\u01b0\u1eddng d\u1eabn \u0111\u01b0\u1ee3c t\u1ea1o s\u1eb5n %LOCALAPPDATA%\\Programs\\Python\\Python3127 v\u00e0o bi\u1ebfn m\u00f4i tr\u01b0\u1eddng PATH. Ph\u01b0\u01a1ng ph\u00e1p t\u1ea5n c\u00f4ng tinh vi n\u00e0y c\u00f3 th\u1ec3 cho ph\u00e9p c\u00e1c t\u1ec7p nh\u1ecb ph\u00e2n \u0111\u1ed9c h\u1ea1i ng\u1ee5y trang th\u00e0nh c\u00e1c c\u00f4ng c\u1ee5 Python h\u1ee3p ph\u00e1p, khai th\u00e1c c\u00e1c m\u00f4i tr\u01b0\u1eddng th\u01b0\u1eddng s\u1eed d\u1ee5ng\u00a0<a href=\"https:\/\/antoanthongtin.vn\/tin\/tin-tac-trien-khai-cong-cu-danh-cap-thong-tin-dua-tren-python-qua-facebook-messenger\">Python<\/a>.<\/p>\n<p>T\u00ednh \u0111\u1ebfn th\u1eddi \u0111i\u1ec3m hi\u1ec7n t\u1ea1i, c\u00e1c phi\u00ean b\u1ea3n b\u1ecb l\u00e2y nhi\u1ec5m \u0111\u1ed9c h\u1ea1i \u0111\u00e3 b\u1ecb x\u00f3a kh\u1ecfi kho l\u01b0u tr\u1eef c\u1ee7a g\u00f3i tr\u00ean npm, do \u0111\u00f3 phi\u00ean b\u1ea3n m\u1edbi nh\u1ea5t hi\u1ec7n c\u00f3 l\u00e0 an to\u00e0n v\u00e0 ng\u01b0\u1eddi d\u00f9ng n\u00ean quay l\u1ea1i phi\u00ean b\u1ea3n \u0111\u00f3.<\/p>\n<p>Tuy nhi\u00ean, n\u1ebfu ng\u01b0\u1eddi d\u00f9ng \u0111\u00e3 n\u00e2ng c\u1ea5p l\u00ean phi\u00ean b\u1ea3n 2.0.83, 2.0.84 ho\u1eb7c 1.0.110, \u0111i\u1ec1u quan tr\u1ecdng l\u00e0 ph\u1ea3i th\u1ef1c hi\u1ec7n qu\u00e9t to\u00e0n b\u1ed9 h\u1ec7 th\u1ed1ng \u0111\u1ec3 t\u00ecm d\u1ea5u hi\u1ec7u x\u00e2m ph\u1ea1m. L\u01b0u \u00fd r\u1eb1ng vi\u1ec7c h\u1ea1 c\u1ea5p xu\u1ed1ng phi\u00ean b\u1ea3n h\u1ee3p l\u1ec7 kh\u00f4ng th\u1ec3 x\u00f3a ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i kh\u1ecfi h\u1ec7 th\u1ed1ng.<\/p>\n<\/article>\n","protected":false},"excerpt":{"rendered":"<p>M\u1ed9t g\u00f3i npm c\u00f3 t\u00ean l\u00e0 rand-user-agent \u0111\u00e3 b\u1ecb x\u00e2m ph\u1ea1m trong m\u1ed9t cu\u1ed9c t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng, nh\u1eb1m k\u00edch ho\u1ea1t Trojan truy c\u1eadp t\u1eeb xa (RAT) v\u00e0o h\u1ec7 th\u1ed1ng c\u1ee7a ng\u01b0\u1eddi d\u00f9ng. Th\u01b0 m\u1eddi vi\u1ebft b\u00e0i H\u1ed9i th\u1ea3o Qu\u1ed1c gia VNICT 2025 \u201cC\u00f4ng ngh\u1ec7 v\u00e0 \u1ee9ng d\u1ee5ng d\u1ef1a tr\u00ean d\u1eef li\u1ec7u\u201d C\u1ea3nh b\u00e1o [&hellip;]<\/p>\n","protected":false},"author":20,"featured_media":46107,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[3,24,35],"tags":[],"class_list":["post-46106","post","type-post","status-publish","format-standard","has-post-thumbnail","category-canh-bao-khuyen-nghi","category-tin-noi-bat","category-tin-tuc-su-kien"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/46106","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/comments?post=46106"}],"version-history":[{"count":1,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/46106\/revisions"}],"predecessor-version":[{"id":46108,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/46106\/revisions\/46108"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media\/46107"}],"wp:attachment":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media?parent=46106"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/categories?post=46106"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/tags?post=46106"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}