{"id":46197,"date":"2025-06-02T17:12:41","date_gmt":"2025-06-02T10:12:41","guid":{"rendered":"https:\/\/antoanthongtinhaiphong.gov.vn\/?p=46197"},"modified":"2025-06-10T17:14:41","modified_gmt":"2025-06-10T10:14:41","slug":"tin-tac-interlock-phat-tan-phan-mem-doc-hai-nodesnake-moi-nham-muc-tieu-vao-cac-truong-dai-hoc","status":"publish","type":"post","link":"https:\/\/antoanthongtinhaiphong.gov.vn\/tin-tac-interlock-phat-tan-phan-mem-doc-hai-nodesnake-moi-nham-muc-tieu-vao-cac-truong-dai-hoc\/","title":{"rendered":"Tin t\u1eb7c Interlock ph\u00e1t t\u00e1n ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i NodeSnake m\u1edbi nh\u1eafm m\u1ee5c ti\u00eau v\u00e0o c\u00e1c tr\u01b0\u1eddng \u0111\u1ea1i h\u1ecdc"},"content":{"rendered":"<p class=\"mt-3 excerpt\">Nh\u00f3m tin t\u1eb7c Interlock \u0111ang tri\u1ec3n khai m\u1ed9t trojan truy c\u1eadp t\u1eeb xa (RAT) ch\u01b0a t\u1eebng \u0111\u01b0\u1ee3c ghi nh\u1eadn tr\u01b0\u1edbc \u0111\u00e2y c\u00f3 t\u00ean l\u00e0 NodeSnake, \u0111\u1ec3 x\u00e2m nh\u1eadp v\u00e0o m\u1ea1ng l\u01b0\u1edbi c\u00e1c t\u1ed5 ch\u1ee9c gi\u00e1o d\u1ee5c, trong \u0111\u00f3 c\u00f3 c\u00e1c tr\u01b0\u1eddng \u0111\u1ea1i h\u1ecdc<\/p>\n<div id=\"relatedPost\" class=\"mt-3 mb-3\">\n<div class=\"\">\n<ul class=\"ms-2\">\n<li class=\"d-flex\">\n<ul class=\"d-flex flex-column gap-2\">\n<li class=\"title bullet\" title=\"Gi\u1ea3i m\u00e3 chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng SyncHole c\u1ee7a nh\u00f3m tin t\u1eb7c APT Lazarus\">Gi\u1ea3i m\u00e3 chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng SyncHole c\u1ee7a nh\u00f3m tin t\u1eb7c APT Lazarus<\/li>\n<\/ul>\n<\/li>\n<li class=\"d-flex\">\n<ul class=\"d-flex flex-column gap-2\">\n<li class=\"title bullet\" title=\"Tin t\u1eb7c APT28 khai th\u00e1c l\u1ed7 h\u1ed5ng zero-day MDaemon \u0111\u1ec3 t\u1ea5n c\u00f4ng m\u00e1y ch\u1ee7 Webmail\">Tin t\u1eb7c APT28 khai th\u00e1c l\u1ed7 h\u1ed5ng zero-day MDaemon \u0111\u1ec3 t\u1ea5n c\u00f4ng m\u00e1y ch\u1ee7 Webmail<\/li>\n<\/ul>\n<\/li>\n<li class=\"d-flex\">\n<ul class=\"d-flex flex-column gap-2\">\n<li class=\"title bullet\" title=\"Tin t\u1eb7c Tri\u1ec1u Ti\u00ean t\u0103ng c\u01b0\u1eddng ho\u1ea1t \u0111\u1ed9ng do th\u00e1m m\u1ea1ng \u1edf Ukraine \">Tin t\u1eb7c Tri\u1ec1u Ti\u00ean t\u0103ng c\u01b0\u1eddng ho\u1ea1t \u0111\u1ed9ng do th\u00e1m m\u1ea1ng \u1edf Ukraine<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<article id=\"content\" class=\"content gradient\"><img decoding=\"async\" src=\"https:\/\/dulieu.antoanthongtin.gov.vn\/tapchiantoanthongtin\/889bb757-ffbd-4dbe-91cf-cc217957b4f6\/Malware-que-es-que-tipos-existen-y-como-se-detecta.png\" \/>C\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u \u0111\u1ebfn t\u1eeb c\u00f4ng ty b\u1ea3o m\u1eadt QuorumCyber \u200b(V\u01b0\u01a1ng qu\u1ed1c Anh) \u200bcho bi\u1ebft, h\u1ecd \u0111\u00e3 ph\u00e1t hi\u1ec7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng ph\u00e1t t\u00e1n ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i NodeSnake m\u1edbi \u0111\u01b0\u1ee3c c\u00e1c tin t\u1eb7c Interlock ph\u00e1t \u0111\u1ed9ng nh\u1eafm v\u00e0o c\u00e1c tr\u01b0\u1eddng \u0111\u1ea1i h\u1ecdc \u1edf Anh v\u00e0o th\u00e1ng 1 v\u00e0 th\u00e1ng 3\/2025.<\/p>\n<p>Theo b\u00e1o c\u00e1o \u0111\u1ea7u ti\u00ean c\u1ee7a trang tin BleepingComputer, Interlock l\u00e0 m\u1ed9t nh\u00f3m tin t\u1eb7c\u00a0<a href=\"https:\/\/antoanthongtin.vn\/tin\/tin-tac-loi-dung-hinh-anh-jpg-de-trien-khai-ma-doc-tong-tien\">m\u00e3 \u0111\u1ed9c t\u1ed1ng ti\u1ec1n<\/a>\u00a0\u0111\u01b0\u1ee3c bi\u1ebft \u0111\u1ebfn v\u00e0o th\u00e1ng 9\/2024. Tr\u01b0\u1edbc \u0111\u00e2y, nh\u00f3m n\u00e0y \u0111\u00e3 nh\u1eafm m\u1ee5c ti\u00eau t\u1ea5n c\u00f4ng v\u00e0o \u0110\u1ea1i h\u1ecdc Texas Tech, c\u00f4ng ty DaVita v\u00e0 m\u1ea1ng l\u01b0\u1edbi y t\u1ebf Kettering Health \u1edf Ohio, M\u1ef9. Interlock c\u0169ng \u0111\u00e3 l\u1ee3i d\u1ee5ng c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng ClickFix m\u1ea1o danh c\u00e1c \u1ee9ng d\u1ee5ng c\u00f4ng ngh\u1ec7 th\u00f4ng tin \u0111\u1ec3 th\u1ef1c hi\u1ec7n l\u00e2y nhi\u1ec5m ban \u0111\u1ea7u v\u00e0 x\u00e2m nh\u1eadp m\u1ea1ng.<\/p>\n<p><strong>Ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i NodeSnake RAT m\u1edbi<\/strong><\/p>\n<p>C\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng m\u1edbi nh\u1ea5t c\u1ee7a Interlock b\u1eaft \u0111\u1ea7u b\u1eb1ng c\u00e1c email l\u1eeba \u0111\u1ea3o c\u00f3 ch\u1ee9a li\u00ean k\u1ebft, ho\u1eb7c t\u1ec7p \u0111\u00ednh k\u00e8m \u0111\u1ed9c h\u1ea1i d\u1eabn \u0111\u1ebfn l\u00e2y nhi\u1ec5m NodeSnake RAT. Ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i d\u1ef1a tr\u00ean JavaScript, th\u1ef1c thi b\u1eb1ng NodeJS, s\u1ebd t\u1ed3n t\u1ea1i v\u00e0 duy tr\u00ec t\u00ednh b\u1ec1n b\u1ec9 sau khi l\u00e2y nhi\u1ec5m b\u1eb1ng c\u00e1ch s\u1eed d\u1ee5ng c\u00e1c t\u1eadp l\u1ec7nh PowerShell ho\u1eb7c CMD, \u0111\u1ec3 t\u1ea1o Registry l\u1eeba \u0111\u1ea3o c\u00f3 t\u00ean ChromeUpdater nh\u1eb1m m\u1ea1o danh tr\u00ecnh c\u1eadp nh\u1eadt c\u1ee7a\u00a0<a href=\"https:\/\/antoanthongtin.vn\/tin\/canh-bao-bao-mat-nghiem-trong-cho-hang-trieu-nguoi-dung-google-chrome\">Google Chrome.<\/a><\/p>\n<p>\u0110\u1ec3 tr\u00e1nh b\u1ecb ph\u00e1t hi\u1ec7n, ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i ch\u1ea1y nh\u01b0 m\u1ed9t ti\u1ebfn tr\u00ecnh n\u1ec1n t\u00e1ch bi\u1ec7t, t\u00ean t\u1ec7p v\u00e0 d\u1eef li\u1ec7u \u0111\u01b0\u1ee3c g\u00e1n t\u00ean b\u1ea5t k\u1ef3, \u0111\u1ed3ng th\u1eddi \u0111\u1ecba ch\u1ec9 IP c\u1ee7a m\u00e1y ch\u1ee7 \u0111i\u1ec1u khi\u1ec3n v\u00e0 ra l\u1ec7nh (C2) li\u00ean t\u1ee5c \u0111\u01b0\u1ee3c thay \u0111\u1ed5i v\u1edbi \u0111\u1ed9 tr\u1ec5 ng\u1eabu nhi\u00ean. H\u01a1n n\u1eefa, ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i n\u00e0y c\u00f2n c\u00f3 t\u00ednh n\u0103ng code obfuscation, m\u00e3 h\u00f3a XOR b\u1eb1ng rolling key v\u00e0 random seeds.<\/p>\n<p>M\u1eb7c d\u00f9 \u0111\u1ecba ch\u1ec9 IP C2 \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a c\u1ee9ng, k\u1ebft n\u1ed1i v\u1eabn \u0111\u01b0\u1ee3c \u0111\u1ecbnh tuy\u1ebfn qua c\u00e1c t\u00ean mi\u1ec1n \u0111\u01b0\u1ee3c Cloudflare proxy \u0111\u1ec3 che gi\u1ea5u h\u00e0nh vi. Khi thi\u1ebft b\u1ecb b\u1ecb l\u00e2y nhi\u1ec5m, NodeSnake s\u1ebd thu th\u1eadp metadata quan tr\u1ecdng v\u1ec1 ng\u01b0\u1eddi d\u00f9ng, c\u00e1c ti\u1ebfn tr\u00ecnh \u0111ang ch\u1ea1y, d\u1ecbch v\u1ee5 v\u00e0 c\u1ea5u h\u00ecnh m\u1ea1ng r\u1ed3i truy\u1ec1n d\u1eef li\u1ec7u \u0111\u00f3 \u0111\u1ebfn m\u00e1y ch\u1ee7 C2 do k\u1ebb t\u1ea5n c\u00f4ng ki\u1ec3m so\u00e1t.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/dulieu.antoanthongtin.gov.vn\/tapchiantoanthongtin\/ce8591d0-0fdb-42ed-a1c0-2c44bb2ec355\/gatherdata.png\" \/><\/p>\n<p><em>H\u00ecnh 1. Thu th\u1eadp d\u1eef li\u1ec7u h\u1ec7 th\u1ed1ng<\/em><\/p>\n<p>NodeSnake c\u00f3 th\u1ec3 kill c\u00e1c ti\u1ebfn tr\u00ecnh \u0111ang ho\u1ea1t \u0111\u1ed9ng ho\u1eb7c t\u1ea3i th\u00eam c\u00e1c t\u1ec7p EXE, DLL ho\u1eb7c JavaScript v\u00e0o thi\u1ebft b\u1ecb. Ngo\u00e0i ra, c\u00e1c tin t\u1eb7c Interlock c\u0169ng \u0111\u00e3 ph\u00e1t tri\u1ec3n m\u1ed9t phi\u00ean b\u1ea3n c\u1eadp nh\u1eadt c\u1ee7a NodeSnake, bi\u1ebfn th\u1ec3 m\u1edbi n\u00e0y c\u0169ng c\u00f3 th\u1ec3 th\u1ef1c thi c\u00e1c l\u1ec7nh CMD v\u00e0 s\u1eed d\u1ee5ng c\u00e1c m\u00f4-\u0111un b\u1ed5 sung \u0111\u1ec3 thay \u0111\u1ed5i h\u00e0nh vi th\u0103m d\u00f2 C2 \u0111\u1ed9ng. K\u1ebft qu\u1ea3 l\u1ec7nh \u0111\u01b0\u1ee3c \u0111\u00f3ng g\u00f3i trong c\u00e1c g\u00f3i d\u1eef li\u1ec7u \u0111\u00e3 l\u1ecdc, cho ph\u00e9p t\u01b0\u01a1ng t\u00e1c shell theo th\u1eddi gian th\u1ef1c.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/dulieu.antoanthongtin.gov.vn\/tapchiantoanthongtin\/2a909179-30f9-40e6-8396-d11732a8ff2c\/cmd.png\" \/><\/p>\n<p><em>H\u00ecnh 2. Th\u1ef1c thi l\u1ec7nh CMD<\/em><\/p>\n<p>\u0110\u1ec3 theo d\u00f5i danh s\u00e1ch \u0111\u1ea7y \u0111\u1ee7 c\u00e1c ch\u1ec9 s\u1ed1 b\u1ecb x\u00e2m ph\u1ea1m, qu\u00fd \u0111\u1ed9c gi\u1ea3 vui l\u00f2ng truy c\u1eadp\u00a0<a href=\"https:\/\/www.quorumcyber.com\/wp-content\/uploads\/2025\/04\/20250416-Higher-Education-Sector-RAT-MP.pdf\"><strong>t\u1ea1i \u0111\u00e2y.<\/strong><\/a><\/p>\n<\/article>\n","protected":false},"excerpt":{"rendered":"<p>Nh\u00f3m tin t\u1eb7c Interlock \u0111ang tri\u1ec3n khai m\u1ed9t trojan truy c\u1eadp t\u1eeb xa (RAT) ch\u01b0a t\u1eebng \u0111\u01b0\u1ee3c ghi nh\u1eadn tr\u01b0\u1edbc \u0111\u00e2y c\u00f3 t\u00ean l\u00e0 NodeSnake, \u0111\u1ec3 x\u00e2m nh\u1eadp v\u00e0o m\u1ea1ng l\u01b0\u1edbi c\u00e1c t\u1ed5 ch\u1ee9c gi\u00e1o d\u1ee5c, trong \u0111\u00f3 c\u00f3 c\u00e1c tr\u01b0\u1eddng \u0111\u1ea1i h\u1ecdc Gi\u1ea3i m\u00e3 chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng SyncHole c\u1ee7a nh\u00f3m tin t\u1eb7c APT [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":46199,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[3,185,24,35],"tags":[],"class_list":["post-46197","post","type-post","status-publish","format-standard","has-post-thumbnail","category-canh-bao-khuyen-nghi","category-thu-thuat-tien-ich","category-tin-noi-bat","category-tin-tuc-su-kien"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/46197","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/comments?post=46197"}],"version-history":[{"count":1,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/46197\/revisions"}],"predecessor-version":[{"id":46201,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/46197\/revisions\/46201"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media\/46199"}],"wp:attachment":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media?parent=46197"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/categories?post=46197"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/tags?post=46197"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}