C\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u b\u1ea3o m\u1eadt c\u1ee7a Microsoft Threat Intelligence \u0111\u00e3 ph\u00e1t hi\u1ec7n ra c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng n\u00e0y, \u0111\u1ed3ng th\u1eddi cho bi\u1ebft c\u00e1c tin t\u1eb7c\u00a0Marbled Dust<\/a>\u00a0\u0111\u00e3 khai th\u00e1c l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt CVE-2025-27920 trong \u1ee9ng d\u1ee5ng Output Messenger (ph\u1ea7n m\u1ec1m tr\u00f2 chuy\u1ec7n \u0111a n\u1ec1n t\u1ea3ng), \u0111\u00e2y l\u00e0 lo\u1ea1i l\u1ed7 h\u1ed5ng Directory Traversal c\u00f3 th\u1ec3 cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 x\u00e1c th\u1ef1c truy c\u1eadp v\u00e0o c\u00e1c t\u1ec7p nh\u1ea1y c\u1ea3m b\u00ean ngo\u00e0i th\u01b0 m\u1ee5c d\u1ef1 \u0111\u1ecbnh, ho\u1eb7c tri\u1ec3n khai c\u00e1c\u00a0ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i<\/a>\u00a0tr\u00ean th\u01b0 m\u1ee5c kh\u1edfi \u0111\u1ed9ng c\u1ee7a m\u00e1y ch\u1ee7.<\/p>\n \u201cK\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 truy c\u1eadp v\u00e0o t\u1ec7p c\u1ea5u h\u00ecnh, d\u1eef li\u1ec7u ng\u01b0\u1eddi d\u00f9ng ho\u1eb7c th\u1eadm ch\u00ed l\u00e0 m\u00e3 ngu\u1ed3n v\u00e0 t\u00f9y thu\u1ed9c v\u00e0o n\u1ed9i dung t\u1ec7p, \u0111i\u1ec1u n\u00e0y c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn khai th\u00e1c s\u00e2u h\u01a1n, bao g\u1ed3m c\u1ea3 th\u1ef1c thi m\u00e3 t\u1eeb xa\u201d, Srimax, nh\u00e0 ph\u00e1t tri\u1ec3n \u1ee9ng d\u1ee5ng, gi\u1ea3i th\u00edch trong m\u1ed9t khuy\u1ebfn c\u00e1o b\u1ea3o m\u1eadt \u0111\u01b0\u1ee3c \u0111\u01b0a ra v\u00e0o th\u00e1ng 12\/2024 khi l\u1ed7 h\u1ed5ng \u0111\u01b0\u1ee3c v\u00e1 b\u1eb1ng b\u1ea3n ph\u00e1t h\u00e0nh Output Messenger V2.0.63.<\/p>\n M\u1edbi \u0111\u00e2y, Microsoft ti\u1ebft l\u1ed9 r\u1eb1ng nh\u00f3m tin t\u1eb7c Marbled Dust (hay c\u00f2n g\u1ecdi l\u00e0\u00a0Sea Turtle<\/a>, SILICON v\u00e0 UNC1326) \u0111\u00e3 nh\u1eafm m\u1ee5c ti\u00eau v\u00e0o nh\u1eefng ng\u01b0\u1eddi d\u00f9ng ch\u01b0a c\u1eadp nh\u1eadt b\u1ea3n v\u00e1 b\u1ea3o m\u1eadt \u0111\u1ec3 l\u00e2y nhi\u1ec5m ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i, sau khi truy c\u1eadp \u0111\u01b0\u1ee3c v\u00e0o \u1ee9ng d\u1ee5ng Output Messenger Server Manager.<\/p>\n Khi x\u00e2m nh\u1eadp v\u00e0o m\u00e1y ch\u1ee7 th\u00e0nh c\u00f4ng, c\u00e1c tin t\u1eb7c c\u00f3 th\u1ec3 \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m, truy c\u1eadp v\u00e0o m\u1ecdi th\u00f4ng tin li\u00ean l\u1ea1c c\u1ee7a ng\u01b0\u1eddi d\u00f9ng, m\u1ea1o danh ng\u01b0\u1eddi d\u00f9ng, truy c\u1eadp v\u00e0o h\u1ec7 th\u1ed1ng n\u1ed9i b\u1ed9 v\u00e0 g\u00e2y gi\u00e1n \u0111o\u1ea1n ho\u1ea1t \u0111\u1ed9ng.<\/p>\n Microsoft cho bi\u1ebft: \u201cM\u1eb7c d\u00f9 hi\u1ec7n t\u1ea1i ch\u00fang t\u00f4i kh\u00f4ng bi\u1ebft Marbled Dust \u0111\u00e3 x\u00e1c th\u1ef1c nh\u01b0 th\u1ebf n\u00e0o trong t\u1eebng tr\u01b0\u1eddng h\u1ee3p, nh\u01b0ng ch\u00fang t\u00f4i cho r\u1eb1ng k\u1ebb t\u1ea5n c\u00f4ng l\u1ee3i d\u1ee5ng vi\u1ec7c chi\u1ebfm \u0111o\u1ea1t\u00a0DNS<\/a>\u00a0ho\u1eb7c t\u00ean mi\u1ec1n \u0111\u1ec3 ch\u1eb7n, ghi nh\u1eadt k\u00fd v\u00e0 s\u1eed d\u1ee5ng l\u1ea1i th\u00f4ng tin \u0111\u0103ng nh\u1eadp, v\u00ec \u0111\u00e2y l\u00e0 nh\u1eefng k\u1ef9 thu\u1eadt m\u00e0 Marbled Dust \u0111\u00e3 s\u1eed d\u1ee5ng trong c\u00e1c ho\u1ea1t \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i \u0111\u00e3 ph\u00e1t hi\u1ec7n tr\u01b0\u1edbc \u0111\u00f3\u201d.<\/p>\n Ti\u1ebfp theo, nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng tri\u1ec3n khai m\u1ed9t backdoor (OMServerService[.]exe) v\u00e0o thi\u1ebft b\u1ecb c\u1ee7a n\u1ea1n nh\u00e2n, ki\u1ec3m tra k\u1ebft n\u1ed1i v\u1edbi m\u00e1y ch\u1ee7 \u0111i\u1ec1u khi\u1ec3n v\u00e0 ra l\u1ec7nh (C2) do k\u1ebb t\u1ea5n c\u00f4ng ki\u1ec3m so\u00e1t (api[.]wordinfos[.]com) v\u00e0 sau \u0111\u00f3 cung c\u1ea5p cho tin t\u1eb7c th\u00f4ng tin b\u1ed5 sung \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh t\u1eebng n\u1ea1n nh\u00e2n.<\/p>\n Chu\u1ed7i t\u1ea5n c\u00f4ng c\u1ee7a\u00a0Marbled Dust (ngu\u1ed3n: Microsoft)<\/em><\/p>\n Trong m\u1ed9t tr\u01b0\u1eddng h\u1ee3p, \u1ee9ng d\u1ee5ng Output Messenger tr\u00ean thi\u1ebft b\u1ecb c\u1ee7a n\u1ea1n nh\u00e2n \u0111\u01b0\u1ee3c k\u1ebft n\u1ed1i v\u1edbi \u0111\u1ecba ch\u1ec9 IP c\u00f3 li\u00ean k\u1ebft v\u1edbi nh\u00f3m tin t\u1eb7c Marbled Dust, c\u00f3 kh\u1ea3 n\u0103ng l\u00e0 \u0111\u1ec3 \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u, ngay sau khi k\u1ebb t\u1ea5n c\u00f4ng ra l\u1ec7nh cho ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i thu th\u1eadp c\u00e1c t\u1ec7p v\u00e0 l\u01b0u tr\u1eef ch\u00fang d\u01b0\u1edbi d\u1ea1ng t\u1ec7p\u00a0RAR<\/a>.<\/p>\n Marbled Dust th\u01b0\u1eddng \u0111\u01b0\u1ee3c bi\u1ebft \u0111\u1ebfn v\u1edbi m\u1ee5c ti\u00eau nh\u1eafm v\u00e0o khu v\u1ef1c ch\u00e2u \u00c2u v\u00e0\u00a0Trung \u0110\u00f4ng<\/a>, t\u1eadp trung v\u00e0o c\u00e1c c\u00f4ng ty vi\u1ec5n th\u00f4ng v\u00e0 c\u00f4ng ngh\u1ec7 th\u00f4ng, c\u0169ng nh\u01b0 c\u00e1c t\u1ed5 ch\u1ee9c ch\u1ed1ng \u0111\u1ed1i Ch\u00ednh ph\u1ee7 Th\u1ed5 Nh\u0129 K\u1ef3.<\/p>\n \u0110\u1ec3 x\u00e2m ph\u1ea1m m\u1ea1ng l\u01b0\u1edbi c\u1ee7a c\u00e1c nh\u00e0 cung c\u1ea5p c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng, c\u00e1c tin t\u1eb7c r\u00e0 qu\u00e9t c\u00e1c l\u1ed7 h\u1ed5ng trong c\u00e1c thi\u1ebft b\u1ecb k\u1ebft n\u1ed1i Internet. Ch\u00fang c\u0169ng \u0111ang khai th\u00e1c quy\u1ec1n truy c\u1eadp v\u00e0o c\u00e1c registry DNS b\u1ecb x\u00e2m ph\u1ea1m \u0111\u1ec3 thay \u0111\u1ed5i c\u1ea5u h\u00ecnh m\u00e1y ch\u1ee7 DNS c\u1ee7a c\u00e1c t\u1ed5 ch\u1ee9c, cho ph\u00e9p ch\u00fang ch\u1eb7n l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp v\u00e0 \u0111\u00e1nh c\u1eafp th\u00f4ng tin \u0111\u0103ng nh\u1eadp trong c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng MitM.<\/p>\n \u201cCu\u1ed9c t\u1ea5n c\u00f4ng m\u1edbi n\u00e0y b\u00e1o hi\u1ec7u s\u1ef1 thay \u0111\u1ed5i \u0111\u00e1ng k\u1ec3 trong kh\u1ea3 n\u0103ng c\u1ee7a Marbled Dust trong khi v\u1eabn duy tr\u00ec t\u00ednh nh\u1ea5t qu\u00e1n trong c\u00e1ch ti\u1ebfp c\u1eadn t\u1ed5ng th\u1ec3 c\u1ee7a ch\u00fang. Vi\u1ec7c khai th\u00e1c th\u00e0nh c\u00f4ng l\u1ed7 h\u1ed5ng zero-day cho th\u1ea5y s\u1ef1 gia t\u0103ng v\u1ec1 m\u1eb7t k\u1ef9 thu\u1eadt v\u00e0 c\u0169ng c\u00f3 th\u1ec3 cho th\u1ea5y c\u00e1c \u01b0u ti\u00ean nh\u1eafm m\u1ee5c ti\u00eau c\u1ee7a Marbled Dust \u0111\u00e3 tinh vi, m\u1edf r\u1ed9ng h\u01a1n\u201d, Microsoft cho bi\u1ebft.<\/p>\n Marbled Dust c\u0169ng c\u00f3 li\u00ean quan \u0111\u1ebfn nhi\u1ec1u chi\u1ebfn d\u1ecbch\u00a0gi\u00e1n \u0111i\u1ec7p<\/a>\u00a0nh\u1eafm v\u00e0o c\u00e1c t\u1ed5 ch\u1ee9c \u1edf\u00a0H\u00e0 Lan<\/a>, ch\u1ee7 y\u1ebfu t\u1ea5n c\u00f4ng m\u1ea1ng v\u00e0o c\u00e1c c\u00f4ng ty vi\u1ec5n th\u00f4ng, nh\u00e0 cung c\u1ea5p d\u1ecbch v\u1ee5 Internet (ISP) v\u00e0 c\u00e1c trang web c\u1ee7a ng\u01b0\u1eddi Kurd t\u1eeb n\u0103m 2021 \u0111\u1ebfn n\u0103m 2023.<\/p>\n Khuy\u1ebfn ngh\u1ecb gi\u1ea3m thi\u1ec3u<\/strong><\/p>\n Microsoft khuy\u1ebfn ngh\u1ecb c\u00e1c bi\u1ec7n ph\u00e1p gi\u1ea3m thi\u1ec3u sau \u0111\u00e2y \u0111\u1ec3 gi\u1ea3m t\u00e1c \u0111\u1ed9ng c\u1ee7a m\u1ed1i \u0111e d\u1ecda n\u00e0y:<\/p>\n T\u0103ng c\u01b0\u1eddng c\u1ea5u h\u00ecnh m\u00f4i tr\u01b0\u1eddng ho\u1ea1t \u0111\u1ed9ng<\/em><\/p>\n – \u0110\u1ea3m b\u1ea3o r\u1eb1ng Output Messenger \u0111\u01b0\u1ee3c c\u1eadp nh\u1eadt l\u00ean phi\u00ean b\u1ea3n kh\u00f4ng b\u1ecb \u1ea3nh h\u01b0\u1edfng b\u1edfi l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt, bao g\u1ed3m phi\u00ean b\u1ea3n 2.0.63 cho Windows v\u00e0 2.0.62 cho m\u00e1y ch\u1ee7.<\/p>\n – B\u1eadt t\u00ednh n\u0103ng Cloud-Delivered Protection trong Microsoft Defender Antivirus ho\u1eb7c c\u00e1c ch\u01b0\u01a1ng tr\u00ecnh, \u1ee9ng d\u1ee5ng anti-virus kh\u00e1c.<\/p>\n – T\u1ea1o ch\u00ednh s\u00e1ch ph\u00e1t hi\u1ec7n b\u1ea5t th\u01b0\u1eddng tr\u00ean Defender for Cloud Apps.<\/p>\n – S\u1eed d\u1ee5ng h\u1ec7 th\u1ed1ng qu\u1ea3n l\u00fd l\u1ed7 h\u1ed5ng, ch\u1eb3ng h\u1ea1n nh\u01b0 Microsoft Defender Vulnerability Management, \u0111\u1ec3 qu\u1ea3n l\u00fd c\u00e1c l\u1ed7 h\u1ed5ng, \u0111i\u1ec3m y\u1ebfu v\u00e0 n\u1ed7 l\u1ef1c kh\u1eafc ph\u1ee5c tr\u00ean to\u00e0n b\u1ed9 h\u1ec7 \u0111i\u1ec1u h\u00e0nh, kho ph\u1ea7n m\u1ec1m v\u00e0 thi\u1ebft b\u1ecb m\u1ea1ng c\u1ee7a m\u00f4i tr\u01b0\u1eddng ng\u01b0\u1eddi d\u00f9ng.<\/p>\n – Khuy\u1ebfn kh\u00edch ng\u01b0\u1eddi d\u00f9ng s\u1eed d\u1ee5ng Microsoft Edge v\u00e0 c\u00e1c tr\u00ecnh duy\u1ec7t web kh\u00e1c h\u1ed7 tr\u1ee3 Microsoft Defender SmartScreen, t\u00ednh n\u0103ng n\u00e0y c\u00f3 th\u1ec3 x\u00e1c \u0111\u1ecbnh v\u00e0 ng\u0103n ch\u1eb7n c\u00e1c trang web \u0111\u1ed9c h\u1ea1i, bao g\u1ed3m c\u00e1c trang web l\u1eeba \u0111\u1ea3o v\u00e0 c\u00e1c trang web l\u01b0u tr\u1eef ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i.<\/p>\n – C\u00e1c t\u1ed5 ch\u1ee9c c\u0169ng c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng Microsoft Defender External Attack Surface Management (EASM), m\u1ed9t c\u00f4ng c\u1ee5 li\u00ean t\u1ee5c ph\u00e1t hi\u1ec7n v\u00e0 l\u1eadp b\u1ea3n \u0111\u1ed3 b\u1ec1 m\u1eb7t t\u1ea5n c\u00f4ng k\u1ef9 thu\u1eadt s\u1ed1. EASM t\u1eadn d\u1ee5ng d\u1eef li\u1ec7u v\u1ec1 l\u1ed7 h\u1ed5ng v\u00e0 c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng \u0111\u1ec3 t\u1ea1o Attack Surface Insights, b\u00e1o c\u00e1o n\u00eau b\u1eadt c\u00e1c r\u1ee7i ro ch\u00ednh \u0111\u1ed1i v\u1edbi m\u1ed9t t\u1ed5 ch\u1ee9c nh\u1ea5t \u0111\u1ecbnh.<\/p>\n T\u0103ng c\u01b0\u1eddng c\u1ea5u h\u00ecnh Microsoft Defender for Endpoint<\/em><\/p>\n – \u0110\u1ea3m b\u1ea3o r\u1eb1ng t\u00ednh n\u0103ng Tamper Protection \u0111\u01b0\u1ee3c b\u1eadt trong Microsoft Defender for Endpoint.<\/p>\n – B\u1eadt t\u00ednh n\u0103ng Network Protection trong Microsoft Defender for Endpoint.<\/p>\n – B\u1eadt t\u00ednh n\u0103ng Web Protection.<\/p>\n – Ch\u1ea1y Endpoint Detection and Response (EDR) \u1edf ch\u1ebf \u0111\u1ed9 Block mode \u0111\u1ec3 Microsoft Defender for Endpoint c\u00f3 th\u1ec3 ng\u0103n ch\u1eb7n c\u00e1c m\u1eabu \u0111\u1ed9c h\u1ea1i, ngay c\u1ea3 khi ph\u1ea7n m\u1ec1m anti-virus kh\u00f4ng ph\u00e1t hi\u1ec7n ra m\u1ed1i \u0111e d\u1ecda, ho\u1eb7c khi Microsoft Defender Antivirus \u0111ang ch\u1ea1y \u1edf ch\u1ebf \u0111\u1ed9 Passive.<\/p>\n<\/article>\n","protected":false},"excerpt":{"rendered":" M\u1ed9t nh\u00f3m gi\u00e1n \u0111i\u1ec7p m\u1ea1ng \u0111\u01b0\u1ee3c cho l\u00e0 do Th\u1ed5 Nh\u0129 K\u1ef3 h\u1eadu thu\u1eabn \u0111\u00e3 khai th\u00e1c l\u1ed7 h\u1ed5ng zero-day \u0111\u1ec3 t\u1ea5n c\u00f4ng ng\u01b0\u1eddi d\u00f9ng Output Messenger c\u00f3 li\u00ean quan \u0111\u1ebfn qu\u00e2n \u0111\u1ed9i ng\u01b0\u1eddi Kurd \u1edf Iraq. Apple ph\u00e1t c\u1ea3nh b\u00e1o kh\u1ea9n c\u1ea5p v\u1ec1 ph\u1ea7n m\u1ec1m gi\u00e1n \u0111i\u1ec7p tr\u00ean iPhone SpyLoan: nh\u00f3m \u1ee9ng d\u1ee5ng \u0111\u1ed9c […]<\/p>\n","protected":false},"author":1,"featured_media":46253,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[24,35],"tags":[],"class_list":["post-46252","post","type-post","status-publish","format-standard","has-post-thumbnail","category-tin-noi-bat","category-tin-tuc-su-kien"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/46252","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/comments?post=46252"}],"version-history":[{"count":1,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/46252\/revisions"}],"predecessor-version":[{"id":46254,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/46252\/revisions\/46254"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media\/46253"}],"wp:attachment":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media?parent=46252"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/categories?post=46252"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/tags?post=46252"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![](\"https:\/\/dulieu.antoanthongtin.gov.vn\/tapchiantoanthongtin\/4baeb4d8-4377-4476-bbdf-f1096341bcd8\/attack-chain.png\")
<\/p>\n