{"id":28148,"date":"2024-09-05T10:37:17","date_gmt":"2024-09-05T03:37:17","guid":{"rendered":"https:\/\/cdcangiang.vn\/?p=28148"},"modified":"2024-09-05T10:47:56","modified_gmt":"2024-09-05T03:47:56","slug":"bai-01-09-24","status":"publish","type":"post","link":"https:\/\/cdcangiang.vn\/index.php\/2024\/09\/05\/bai-01-09-24\/","title":{"rendered":"Th\u00f4ng tin chi ti\u1ebft v\u1ec1 chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng AppDomainManager Injection"},"content":{"rendered":"

K\u1ec3 t\u1eeb th\u00e1ng 7\/2024, Trung t\u00e2m Gi\u00e1m s\u00e1t an to\u00e0n th\u00f4ng tin, C\u1ee5c An to\u00e0n th\u00f4ng tin \u0111\u00e3 ghi nh\u00e2n th\u00f4ng tin li\u00ean quan \u0111\u1ebfn chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng c\u00f3 ch\u1ee7 \u0111\u00edch s\u1eed d\u1ee5ng k\u1ef9 thu\u1eadt m\u1edbi AppDomainManager Injection \u0111\u1ec3 ph\u00e1t t\u00e1n m\u00e3 \u0111\u1ed9c.<\/span><\/p>\n

Qua ph\u00e2n t\u00edch, m\u00e3 \u0111\u1ed9c trong chi\u1ebfn d\u1ecbch n\u00e0y \u0111\u01b0\u1ee3c x\u00e1c \u0111\u1ecbnh l\u00e0 CobaltStrike, v\u1edbi c\u00e1c d\u1ea5u hi\u1ec7u k\u1ef9 thu\u1eadt v\u00e0 h\u1ea1 t\u1ea7ng t\u01b0\u01a1ng t\u1ef1 nh\u00f3m APT41. Chi\u1ebfn d\u1ecbch \u0111\u00e3 g\u00e2y ra nh\u1eefng t\u00e1c \u0111\u1ed9ng \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn c\u00e1c t\u1ed5 ch\u1ee9c ch\u00ednh ph\u1ee7 t\u1ea1i \u0110\u00e0i Loan, c\u00e1c \u0111\u01a1n v\u1ecb qu\u00e2n s\u1ef1 \u1edf Philippines… \u0110i\u1ec1u n\u00e0y, cho th\u1ea5y quy m\u00f4 v\u00e0 t\u00ednh ch\u1ea5t nguy hi\u1ec3m c\u1ee7a cu\u1ed9c t\u1ea5n c\u00f4ng, \u0111\u00f2i h\u1ecfi c\u00e1c bi\u1ec7n ph\u00e1p ph\u00f2ng ch\u1ed1ng n\u00e2ng cao t\u1eeb c\u00e1c c\u01a1 quan an ninh m\u1ea1ng trong khu v\u1ef1c.<\/span><\/p>\n

AppDomain Manager Injection l\u00e0 m\u1ed9t k\u1ef9 thu\u1eadt cho ph\u00e9p bi\u1ebfn b\u1ea5t k\u1ef3 \u1ee9ng d\u1ee5ng Microsoft.NET n\u00e0o tr\u00ean m\u00e1y ch\u1ee7 Windows th\u00e0nh LOLBIN (Living Off the Land Binary) m\u1ed9t c\u00e1ch hi\u1ec7u qu\u1ea3 b\u1eb1ng c\u00e1ch bu\u1ed9c \u1ee9ng d\u1ee5ng t\u1ea3i m\u1ed9t assembly .NET \u0111\u01b0\u1ee3c ch\u1ebf t\u1ea1o \u0111\u1eb7c bi\u1ec7t, s\u1eed d\u1ee5ng t\u00ean \u0111\u1ea7y \u0111\u1ee7 c\u1ee7a assembly \u0111\u00f3.<\/span><\/p>\n

Khuy\u1ebfn c\u00e1o ph\u00f2ng ng\u1eeba: <\/strong>Ki\u1ec3m tra, r\u00e0 so\u00e1t c\u00e1c h\u1ec7 th\u1ed1ng th\u00f4ng tin c\u00f3 s\u1eed d\u1ee5ng Microsoft.NET. Ch\u1ee7 \u0111\u1ed9ng theo d\u00f5i c\u00e1c th\u00f4ng tin li\u00ean quan \u0111\u1ebfn chi\u1ebfn d\u1ecbch nh\u1eb1m th\u1ef1c hi\u1ec7n ng\u0103n ch\u1eb7n nh\u1eb1m tr\u00e1nh nguy c\u01a1 b\u1ecb t\u1ea5n c\u00f4ng.<\/span><\/p>\n

Trong tr\u01b0\u1eddng h\u1ee3p c\u1ea7n thi\u1ebft, c\u00f3 th\u1ec3 li\u00ean h\u1ec7 \u0111\u1ea7u m\u1ed1i h\u1ed7 tr\u1ee3: <\/strong><\/span><\/p>\n

– Th\u01b0\u1eddng tr\u1ef1c \u0110\u1ed9i \u1ee9ng c\u1ee9u \u2013 S\u1edf Th\u00f4ng tin v\u00e0 Truy\u1ec1n th\u00f4ng (th\u00f4ng qua Trung t\u00e2m C\u00f4ng ngh\u1ec7 Th\u00f4ng tin v\u00e0 Truy\u1ec1n th\u00f4ng), \u0111i\u1ec7n tho\u1ea1i: 02963.856.188, Email: hotro@angiang.gov.vn<\/a>.<\/span><\/p>\n

– C\u1ee5c An to\u00e0n th\u00f4ng tin: Trung t\u00e2m Gi\u00e1m s\u00e1t an to\u00e0n kh\u00f4ng gian m\u1ea1ng qu\u1ed1c gia, \u0111i\u1ec7n tho\u1ea1i: 02432.09.16.16, th\u01b0 \u0111i\u1ec7n t\u1eed: ncsc@ais.gov.vn<\/a>.\u00a0<\/span><\/p>\n

Minh H\u1ea3i – <\/em>Khoa TT-GDSK, TT.KSBT An Giang<\/em><\/span><\/strong><\/p>\n

(Ngu\u1ed3n C\u00f4ng v\u0103n s\u1ed1 1435\/\u0110\u01afCSCATTTM ng\u00e0y 29\/08\/2024 c\u1ee7a \u0110\u1ed9i \u1ee9ng c\u1ee9u s\u1ef1 c\u1ed1 an to\u00e0n th\u00f4ng tin m\u1ea1ng)<\/em><\/span><\/strong><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

K\u1ec3 t\u1eeb th\u00e1ng 7\/2024, Trung t\u00e2m Gi\u00e1m s\u00e1t an to\u00e0n th\u00f4ng tin, C\u1ee5c An to\u00e0n th\u00f4ng tin \u0111\u00e3 ghi nh\u00e2n th\u00f4ng tin li\u00ean quan \u0111\u1ebfn chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng c\u00f3 ch\u1ee7 \u0111\u00edch s\u1eed d\u1ee5ng k\u1ef9 thu\u1eadt m\u1edbi AppDomainManager Injection \u0111\u1ec3 ph\u00e1t t\u00e1n m\u00e3 \u0111\u1ed9c. Qua ph\u00e2n t\u00edch, m\u00e3 \u0111\u1ed9c trong chi\u1ebfn d\u1ecbch n\u00e0y \u0111\u01b0\u1ee3c x\u00e1c […]<\/p>\n","protected":false},"author":8,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"limit_modified_date":"","last_modified_date":"","footnotes":""},"categories":[312,351,322,54],"tags":[],"class_list":["post-28148","post","type-post","status-publish","format-standard","hentry","category-bai-cds","category-bai-viet-ngan","category-cham-nhuan-but","category-cong-nghe-thong-tin"],"_links":{"self":[{"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/posts\/28148","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/comments?post=28148"}],"version-history":[{"count":1,"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/posts\/28148\/revisions"}],"predecessor-version":[{"id":28149,"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/posts\/28148\/revisions\/28149"}],"wp:attachment":[{"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/media?parent=28148"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/categories?post=28148"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cdcangiang.vn\/index.php\/wp-json\/wp\/v2\/tags?post=28148"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}