{"id":6258,"date":"2025-12-25T10:54:22","date_gmt":"2025-12-25T03:54:22","guid":{"rendered":"https:\/\/tamanh.asia\/?p=6258"},"modified":"2025-12-29T15:54:41","modified_gmt":"2025-12-29T08:54:41","slug":"phat-hien-ma-doc-webrat-nguy-hiem-loi-dung-github-youtube","status":"publish","type":"post","link":"https:\/\/tamanh.asia\/?p=6258","title":{"rendered":"Ph\u00e1t hi\u1ec7n m\u00e3 \u0111\u1ed9c WebRAT nguy hi\u1ec3m l\u1ee3i d\u1ee5ng GitHub\/YouTube"},"content":{"rendered":"<p>M\u1ed9t chi\u1ebfn d\u1ecbch ph\u00e1t t\u00e1n **m\u00e3 \u0111\u1ed9c WebRAT** m\u1edbi \u0111\u00e3 \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n, s\u1eed d\u1ee5ng c\u00e1c kho l\u01b0u tr\u1eef GitHub \u0111\u1ec3 lan truy\u1ec1n ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i n\u00e0y. M\u00e3 \u0111\u1ed9c \u0111\u01b0\u1ee3c ng\u1ee5y trang d\u01b0\u1edbi d\u1ea1ng c\u00e1c c\u00f4ng c\u1ee5 khai th\u00e1c (proof-of-concept exploits) ho\u1eb7c ti\u1ec7n \u00edch tr\u00f2 ch\u01a1i, nh\u1eafm m\u1ee5c ti\u00eau v\u00e0o ng\u01b0\u1eddi d\u00f9ng t\u00ecm ki\u1ebfm gian l\u1eadn game, ph\u1ea7n m\u1ec1m l\u1eadu v\u00e0 c\u00e1c b\u1ea3n v\u00e1 \u1ee9ng d\u1ee5ng cho c\u00e1c t\u1ef1a game ph\u1ed5 bi\u1ebfn nh\u01b0 **Rust**, **Counter-Strike** v\u00e0 **Roblox**.<\/p><p>Chi\u1ebfn d\u1ecbch n\u00e0y t\u1eadn d\u1ee5ng nhi\u1ec1u k\u00eanh ph\u00e2n ph\u1ed1i bao g\u1ed3m GitHub, b\u00ecnh lu\u1eadn video tr\u00ean YouTube v\u00e0 c\u00e1c trang web ph\u1ea7n m\u1ec1m vi ph\u1ea1m b\u1ea3n quy\u1ec1n. \u0110i\u1ec1u n\u00e0y t\u1ea1o ra m\u1ed9t **m\u1ed1i \u0111e d\u1ecda m\u1ea1ng** r\u1ed9ng kh\u1eafp, \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn c\u1ea3 c\u00e1 nh\u00e2n game th\u1ee7 v\u00e0 m\u00f4i tr\u01b0\u1eddng doanh nghi\u1ec7p.<\/p><h2 class=\"wp-block-heading\">T\u1ed5ng quan v\u1ec1 m\u00e3 \u0111\u1ed9c WebRAT v\u00e0 Kh\u1ea3 n\u0103ng t\u1ea5n c\u00f4ng<\/h2><p>**WebRAT** l\u00e0 m\u1ed9t lo\u1ea1i m\u00e3 \u0111\u1ed9c \u0111a ch\u1ee9c n\u0103ng, k\u1ebft h\u1ee3p kh\u1ea3 n\u0103ng \u0111\u00e1nh c\u1eafp th\u00f4ng tin (stealer) v\u1edbi c\u00f4ng c\u1ee5 truy c\u1eadp t\u1eeb xa (Remote Access Tool \u2013 **RAT**). M\u00e3 \u0111\u1ed9c n\u00e0y c\u00f3 th\u1ec3 tr\u00edch xu\u1ea5t c\u00e1c th\u00f4ng tin \u0111\u0103ng nh\u1eadp nh\u1ea1y c\u1ea3m t\u1eeb nhi\u1ec1u d\u1ecbch v\u1ee5 v\u00e0 \u1ee9ng d\u1ee5ng quan tr\u1ecdng.<\/p><h3 class=\"wp-block-heading\">Ch\u1ee9c n\u0103ng \u0111\u00e1nh c\u1eafp th\u00f4ng tin<\/h3><ul class=\"wp-block-list\"><li>**Th\u00f4ng tin \u0111\u0103ng nh\u1eadp**: **WebRAT** \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 thu th\u1eadp t\u00ean ng\u01b0\u1eddi d\u00f9ng v\u00e0 m\u1eadt kh\u1ea9u t\u1eeb c\u00e1c n\u1ec1n t\u1ea3ng ch\u01a1i game nh\u01b0 **Steam**. N\u00f3 c\u0169ng nh\u1eafm m\u1ee5c ti\u00eau v\u00e0o c\u00e1c \u1ee9ng d\u1ee5ng giao ti\u1ebfp ph\u1ed5 bi\u1ebfn nh\u01b0 **Discord** v\u00e0 **Telegram**.<\/li>\n\n<li>**V\u00ed ti\u1ec1n \u0111i\u1ec7n t\u1eed**: M\u1ed9t trong nh\u1eefng kh\u1ea3 n\u0103ng \u0111\u00e1ng lo ng\u1ea1i nh\u1ea5t l\u00e0 vi\u1ec7c \u0111\u00e1nh c\u1eafp th\u00f4ng tin t\u1eeb c\u00e1c v\u00ed ti\u1ec1n \u0111i\u1ec7n t\u1eed, ti\u1ec1m \u1ea9n nguy c\u01a1 g\u00e2y thi\u1ec7t h\u1ea1i t\u00e0i ch\u00ednh nghi\u00eam tr\u1ecdng cho n\u1ea1n nh\u00e2n.<\/li><\/ul><h3 class=\"wp-block-heading\">Kh\u1ea3 n\u0103ng gi\u00e1m s\u00e1t v\u00e0 ki\u1ec3m so\u00e1t t\u1eeb xa<\/h3><p>Ngo\u00e0i ch\u1ee9c n\u0103ng \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u, **m\u00e3 \u0111\u1ed9c WebRAT** c\u00f2n s\u1edf h\u1eefu c\u00e1c t\u00ednh n\u0103ng gi\u00e1m s\u00e1t v\u00e0 ki\u1ec3m so\u00e1t t\u1eeb xa ti\u00ean ti\u1ebfn, cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng ki\u1ec3m so\u00e1t ho\u00e0n to\u00e0n h\u1ec7 th\u1ed1ng b\u1ecb l\u00e2y nhi\u1ec5m.<\/p><ul class=\"wp-block-list\"><li>**Gi\u00e1m s\u00e1t m\u00e0n h\u00ecnh**: M\u00e3 \u0111\u1ed9c c\u00f3 th\u1ec3 theo d\u00f5i m\u00e0n h\u00ecnh m\u00e1y t\u00ednh \u0111\u1ec3 b\u00e0n c\u1ee7a n\u1ea1n nh\u00e2n theo th\u1eddi gian th\u1ef1c. \u0110i\u1ec1u n\u00e0y cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng thu th\u1eadp th\u00f4ng tin tr\u1ef1c quan v\u1ec1 ho\u1ea1t \u0111\u1ed9ng c\u1ee7a ng\u01b0\u1eddi d\u00f9ng, bao g\u1ed3m c\u00e1c t\u00e0i li\u1ec7u nh\u1ea1y c\u1ea3m, tin nh\u1eafn ho\u1eb7c th\u00f4ng tin c\u00e1 nh\u00e2n.<\/li>\n\n<li>**Truy c\u1eadp webcam**: K\u1ebb t\u1ea5n c\u00f4ng c\u00f3 kh\u1ea3 n\u0103ng k\u00edch ho\u1ea1t v\u00e0 truy c\u1eadp webcam c\u1ee7a thi\u1ebft b\u1ecb b\u1ecb l\u00e2y nhi\u1ec5m. \u0110i\u1ec1u n\u00e0y c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 theo d\u00f5i n\u1ea1n nh\u00e2n m\u1ed9t c\u00e1ch b\u00ed m\u1eadt, thu th\u1eadp h\u00ecnh \u1ea3nh ho\u1eb7c video nh\u1ea1y c\u1ea3m, d\u1eabn \u0111\u1ebfn c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng t\u1ed1ng ti\u1ec1n ho\u1eb7c \u0111e d\u1ecda ri\u00eang t\u01b0.<\/li>\n\n<li>**Ki\u1ec3m so\u00e1t m\u00e1y t\u00ednh to\u00e0n di\u1ec7n**: **WebRAT** cung c\u1ea5p cho k\u1ebb t\u1ea5n c\u00f4ng quy\u1ec1n ki\u1ec3m so\u00e1t ho\u00e0n to\u00e0n m\u00e1y t\u00ednh th\u00f4ng qua giao di\u1ec7n ng\u01b0\u1eddi d\u00f9ng t\u1eeb xa. \u0110i\u1ec1u n\u00e0y bao g\u1ed3m kh\u1ea3 n\u0103ng th\u1ef1c thi l\u1ec7nh CLI, s\u1eeda \u0111\u1ed5i c\u1ea5u h\u00ecnh h\u1ec7 th\u1ed1ng, c\u00e0i \u0111\u1eb7t ho\u1eb7c g\u1ee1 b\u1ecf ph\u1ea7n m\u1ec1m, v\u00e0 truy c\u1eadp v\u00e0o t\u1ea5t c\u1ea3 c\u00e1c t\u1ec7p v\u00e0 t\u00e0i nguy\u00ean c\u1ee7a h\u1ec7 th\u1ed1ng.<\/li><\/ul><p>C\u00e1c kh\u1ea3 n\u0103ng n\u00e0y cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng kh\u00f4ng ch\u1ec9 thu th\u1eadp th\u00f4ng tin c\u00e1 nh\u00e2n m\u00e0 c\u00f2n theo d\u00f5i c\u00e1c ho\u1ea1t \u0111\u1ed9ng c\u1ee7a n\u1ea1n nh\u00e2n v\u00e0 tri\u1ec3n khai th\u00eam c\u00e1c payload \u0111\u1ed9c h\u1ea1i kh\u00e1c. V\u00ed d\u1ee5, ch\u00fang c\u00f3 th\u1ec3 c\u00e0i \u0111\u1eb7t c\u00e1c c\u00f4ng c\u1ee5 \u0111\u00e0o ti\u1ec1n \u0111i\u1ec7n t\u1eed (cryptocurrency miners) ho\u1eb7c c\u00e1c ph\u1ea7n m\u1ec1m ch\u1eb7n truy c\u1eadp (blockers).<\/p><h2 class=\"wp-block-heading\">R\u1ee7i ro v\u00e0 T\u00e1c \u0111\u1ed9ng c\u1ee7a cu\u1ed9c t\u1ea5n c\u00f4ng m\u1ea1ng v\u1edbi m\u00e3 \u0111\u1ed9c WebRAT<\/h2><p>D\u1eef li\u1ec7u \u0111\u01b0\u1ee3c thu th\u1eadp b\u1edfi **m\u00e3 \u0111\u1ed9c WebRAT** c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng cho nhi\u1ec1u m\u1ee5c \u0111\u00edch \u0111\u1ed9c h\u1ea1i kh\u00e1c nhau, g\u00e2y ra nh\u1eefng h\u1eadu qu\u1ea3 nghi\u00eam tr\u1ecdng cho c\u1ea3 c\u00e1 nh\u00e2n v\u00e0 t\u1ed5 ch\u1ee9c.<\/p><h3 class=\"wp-block-heading\">H\u1eadu qu\u1ea3 \u0111\u1ed1i v\u1edbi ng\u01b0\u1eddi d\u00f9ng c\u00e1 nh\u00e2n<\/h3><ul class=\"wp-block-list\"><li>**Chi\u1ebfm quy\u1ec1n t\u00e0i kho\u1ea3n**: Th\u00f4ng tin \u0111\u0103ng nh\u1eadp b\u1ecb \u0111\u00e1nh c\u1eafp c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn vi\u1ec7c chi\u1ebfm \u0111o\u1ea1t t\u00e0i kho\u1ea3n tr\u00ean c\u00e1c n\u1ec1n t\u1ea3ng quan tr\u1ecdng, t\u1eeb game \u0111\u1ebfn m\u1ea1ng x\u00e3 h\u1ed9i v\u00e0 d\u1ecbch v\u1ee5 t\u00e0i ch\u00ednh.<\/li>\n\n<li>**Tr\u1ed9m c\u1eafp t\u00e0i ch\u00ednh**: V\u1edbi quy\u1ec1n truy c\u1eadp v\u00e0o v\u00ed ti\u1ec1n \u0111i\u1ec7n t\u1eed ho\u1eb7c th\u00f4ng tin ng\u00e2n h\u00e0ng, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 th\u1ef1c hi\u1ec7n c\u00e1c giao d\u1ecbch tr\u00e1i ph\u00e9p, g\u00e2y thi\u1ec7t h\u1ea1i t\u00e0i ch\u00ednh tr\u1ef1c ti\u1ebfp cho n\u1ea1n nh\u00e2n.<\/li>\n\n<li>**T\u1ed1ng ti\u1ec1n**: D\u1eef li\u1ec7u c\u00e1 nh\u00e2n, h\u00ecnh \u1ea3nh t\u1eeb webcam ho\u1eb7c th\u00f4ng tin nh\u1ea1y c\u1ea3m kh\u00e1c c\u00f3 th\u1ec3 b\u1ecb s\u1eed d\u1ee5ng \u0111\u1ec3 t\u1ed1ng ti\u1ec1n n\u1ea1n nh\u00e2n, g\u00e2y \u00e1p l\u1ef1c t\u00e2m l\u00fd n\u1eb7ng n\u1ec1.<\/li>\n\n<li>**C\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng qu\u1ea5y r\u1ed1i (Swatting)**: Trong m\u1ed9t s\u1ed1 tr\u01b0\u1eddng h\u1ee3p \u0111\u01b0\u1ee3c b\u00e1o c\u00e1o, th\u00f4ng tin c\u00e1 nh\u00e2n \u0111\u00e3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 t\u1ea1o ra c\u00e1c b\u00e1o c\u00e1o sai l\u1ec7ch cho c\u1ea3nh s\u00e1t, d\u1eabn \u0111\u1ebfn vi\u1ec7c l\u1ef1c l\u01b0\u1ee3ng ch\u1ee9c n\u0103ng \u0111\u1ebfn nh\u00e0 n\u1ea1n nh\u00e2n m\u00e0 kh\u00f4ng c\u00f3 l\u00fd do ch\u00ednh \u0111\u00e1ng, g\u00e2y hoang mang v\u00e0 nguy hi\u1ec3m.<\/li><\/ul><h3 class=\"wp-block-heading\">Nguy c\u01a1 \u0111\u1ed1i v\u1edbi m\u00f4i tr\u01b0\u1eddng doanh nghi\u1ec7p<\/h3><p>M\u1eb7c d\u00f9 ban \u0111\u1ea7u nh\u1eafm m\u1ee5c ti\u00eau v\u00e0o game th\u1ee7, **r\u1ee7i ro b\u1ea3o m\u1eadt** t\u1eeb **m\u00e3 \u0111\u1ed9c WebRAT** m\u1edf r\u1ed9ng sang c\u1ea3 c\u00e1c nh\u00e2n vi\u00ean doanh nghi\u1ec7p. N\u1ebfu nh\u00e2n vi\u00ean t\u1ea3i xu\u1ed1ng ph\u1ea7n m\u1ec1m vi ph\u1ea1m b\u1ea3n quy\u1ec1n tr\u00ean thi\u1ebft b\u1ecb c\u1ee7a c\u00f4ng ty, **WebRAT** c\u00f3 th\u1ec3 d\u1ec5 d\u00e0ng x\u00e2m ph\u1ea1m th\u00f4ng tin nh\u1ea1y c\u1ea3m c\u1ee7a doanh nghi\u1ec7p.<\/p><ul class=\"wp-block-list\"><li>**R\u00f2 r\u1ec9 d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m**: M\u00e3 \u0111\u1ed9c c\u00f3 th\u1ec3 thu th\u1eadp c\u00e1c cu\u1ed9c tr\u00f2 chuy\u1ec7n n\u1ed9i b\u1ed9, t\u00e0i li\u1ec7u kinh doanh b\u1ea3o m\u1eadt v\u00e0 c\u00e1c d\u1eef li\u1ec7u quan tr\u1ecdng kh\u00e1c.<\/li>\n\n<li>**X\u00e2m nh\u1eadp m\u1ea1ng n\u1ed9i b\u1ed9**: Kh\u1ea3 n\u0103ng ki\u1ec3m so\u00e1t h\u1ec7 th\u1ed1ng t\u1eeb xa cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng di chuy\u1ec3n s\u00e2u h\u01a1n v\u00e0o m\u1ea1ng n\u1ed9i b\u1ed9 c\u1ee7a c\u00f4ng ty, c\u00f3 kh\u1ea3 n\u0103ng d\u1eabn \u0111\u1ebfn c\u00e1c vi ph\u1ea1m b\u1ea3o m\u1eadt l\u1edbn h\u01a1n, \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn to\u00e0n b\u1ed9 h\u1ec7 th\u1ed1ng v\u00e0 d\u1eef li\u1ec7u c\u1ee7a t\u1ed5 ch\u1ee9c.<\/li><\/ul><h2 class=\"wp-block-heading\">Chi\u1ebfn l\u01b0\u1ee3c Ph\u00e2n ph\u1ed1i v\u00e0 K\u1ef9 thu\u1eadt Social Engineering<\/h2><p>Chi\u1ebfn l\u01b0\u1ee3c ph\u00e2n ph\u1ed1i c\u1ee7a **m\u00e3 \u0111\u1ed9c WebRAT** ph\u1ee5 thu\u1ed9c r\u1ea5t nhi\u1ec1u v\u00e0o k\u1ef9 thu\u1eadt social engineering tinh vi, khai th\u00e1c l\u00f2ng tin c\u1ee7a ng\u01b0\u1eddi d\u00f9ng v\u00e0o c\u00e1c n\u1ec1n t\u1ea3ng m\u00e3 ngu\u1ed3n m\u1edf v\u00e0 video h\u01b0\u1edbng d\u1eabn.<\/p><h3 class=\"wp-block-heading\">K\u1ef9 thu\u1eadt l\u1eeba \u0111\u1ea3o tr\u00ean GitHub<\/h3><p>K\u1ebb t\u1ea5n c\u00f4ng t\u1ea1o ra c\u00e1c kho l\u01b0u tr\u1eef GitHub gi\u1ea3 m\u1ea1o, tr\u00f4ng c\u00f3 v\u1ebb gi\u1ed1ng nh\u01b0 c\u00e1c c\u00f4ng c\u1ee5 khai th\u00e1c Proof-of-Concept (PoC) h\u1ee3p ph\u00e1p, c\u00e1c b\u1ea3n hack game ho\u1eb7c ti\u1ec7n \u00edch h\u1eefu \u00edch. \u0110\u1ec3 t\u0103ng \u0111\u1ed9 tin c\u1eady, nh\u1eefng kho l\u01b0u tr\u1eef n\u00e0y th\u01b0\u1eddng \u0111i k\u00e8m v\u1edbi:<\/p><ul class=\"wp-block-list\"><li>**T\u00e0i li\u1ec7u chi ti\u1ebft**: C\u00e1c h\u01b0\u1edbng d\u1eabn v\u00e0 m\u00f4 t\u1ea3 k\u1ef9 thu\u1eadt gi\u1ea3 m\u1ea1o, \u0111\u01b0\u1ee3c vi\u1ebft m\u1ed9t c\u00e1ch chuy\u00ean nghi\u1ec7p.<\/li>\n\n<li>**\u0110\u00e1nh gi\u00e1 v\u00e0 b\u00ecnh lu\u1eadn gi\u1ea3**: T\u1ea1o \u1ea5n t\u01b0\u1ee3ng r\u1eb1ng c\u00f4ng c\u1ee5 \u0111\u00e3 \u0111\u01b0\u1ee3c nhi\u1ec1u ng\u01b0\u1eddi s\u1eed d\u1ee5ng v\u00e0 x\u00e1c nh\u1eadn hi\u1ec7u qu\u1ea3.<\/li><\/ul><h3 class=\"wp-block-heading\">K\u00eanh YouTube v\u00e0 t\u1ea3i xu\u1ed1ng \u0111\u1ed9c h\u1ea1i<\/h3><p>Song song v\u1edbi GitHub, k\u1ebb t\u1ea5n c\u00f4ng c\u0169ng s\u1eed d\u1ee5ng YouTube \u0111\u1ec3 lan truy\u1ec1n **m\u00e3 \u0111\u1ed9c WebRAT**. Ch\u00fang t\u1ea3i l\u00ean c\u00e1c video h\u01b0\u1edbng d\u1eabn s\u1eed d\u1ee5ng c\u00e1c c\u00f4ng c\u1ee5 gi\u1ea3 m\u1ea1o, sau \u0111\u00f3 \u0111\u1ec3 l\u1ea1i c\u00e1c li\u00ean k\u1ebft t\u1ea3i xu\u1ed1ng c\u00e1c kho l\u01b0u tr\u1eef ch\u1ee9a m\u00e3 \u0111\u1ed9c trong ph\u1ea7n b\u00ecnh lu\u1eadn.<\/p><h3 class=\"wp-block-heading\">Qu\u00e1 tr\u00ecnh l\u00e2y nhi\u1ec5m v\u00e0 duy tr\u00ec quy\u1ec1n truy c\u1eadp<\/h3><p>Khi ng\u01b0\u1eddi d\u00f9ng t\u1ea3i xu\u1ed1ng v\u00e0 th\u1ef1c thi c\u00e1c t\u1ec7p t\u1eeb c\u00e1c li\u00ean k\u1ebft \u0111\u1ed9c h\u1ea1i, **m\u00e3 \u0111\u1ed9c WebRAT** s\u1ebd t\u1ef1 \u0111\u1ed9ng c\u00e0i \u0111\u1eb7t m\u1ed9t c\u00e1ch \u00e2m th\u1ea7m v\u00e0o h\u1ec7 th\u1ed1ng. Qu\u00e1 tr\u00ecnh n\u00e0y di\u1ec5n ra m\u00e0 kh\u00f4ng g\u00e2y ra b\u1ea5t k\u1ef3 nghi ng\u1edd ngay l\u1eadp t\u1ee9c n\u00e0o cho n\u1ea1n nh\u00e2n.<\/p><p>Sau khi \u0111\u01b0\u1ee3c c\u00e0i \u0111\u1eb7t, m\u00e3 \u0111\u1ed9c s\u1ebd thi\u1ebft l\u1eadp c\u01a1 ch\u1ebf duy tr\u00ec quy\u1ec1n truy c\u1eadp (persistence) tr\u00ean h\u1ec7 th\u1ed1ng c\u1ee7a n\u1ea1n nh\u00e2n. \u0110i\u1ec1u n\u00e0y \u0111\u1ea3m b\u1ea3o r\u1eb1ng **WebRAT** s\u1ebd v\u1eabn ho\u1ea1t \u0111\u1ed9ng ngay c\u1ea3 sau khi h\u1ec7 th\u1ed1ng \u0111\u01b0\u1ee3c kh\u1edfi \u0111\u1ed9ng l\u1ea1i. T\u1eeb \u0111\u00f3, n\u00f3 b\u1eaft \u0111\u1ea7u tr\u00edch xu\u1ea5t d\u1eef li\u1ec7u v\u00e0 g\u1eedi v\u1ec1 m\u00e1y ch\u1ee7 ch\u1ec9 huy v\u00e0 ki\u1ec3m so\u00e1t (Command-and-Control \u2013 C2) c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng.<\/p><h2 class=\"wp-block-heading\">Ph\u00e1t hi\u1ec7n v\u00e0 Ch\u1ec9 b\u00e1o v\u1ec1 m\u00e3 \u0111\u1ed9c WebRAT<\/h2><p>\u0110\u1ec3 ch\u1ed1ng l\u1ea1i m\u1ed1i \u0111e d\u1ecda t\u1eeb **m\u00e3 \u0111\u1ed9c WebRAT**, c\u00e1c \u0111\u1ed9i ng\u0169 b\u1ea3o m\u1eadt c\u1ea7n tri\u1ec3n khai c\u00e1c bi\u1ec7n ph\u00e1p ph\u00e1t hi\u1ec7n ch\u1ee7 \u0111\u1ed9ng. C\u00e1c nh\u00e0 ph\u00e2n t\u00edch t\u1ea1i Solar \u0111\u00e3 ph\u00e1t hi\u1ec7n ra **WebRAT** trong qu\u00e1 tr\u00ecnh nghi\u00ean c\u1ee9u c\u00e1c ho\u1ea1t \u0111\u1ed9ng tr\u00ean dark web v\u00e0 ghi nh\u1eadn c\u00e1c phi\u00ean b\u1ea3n \u0111\u1ea7u ti\u00ean c\u1ee7a m\u00e3 \u0111\u1ed9c xu\u1ea5t hi\u1ec7n v\u00e0o th\u00e1ng 1 n\u0103m 2025. Hi\u1ec7n t\u1ea1i, **m\u00e3 \u0111\u1ed9c WebRAT** \u0111ang \u0111\u01b0\u1ee3c rao b\u00e1n cho c\u00e1c t\u1ed9i ph\u1ea1m m\u1ea1ng th\u00f4ng qua c\u00e1c k\u00eanh k\u00edn, l\u00e0m t\u0103ng kh\u1ea3 n\u0103ng ti\u1ebfp c\u1eadn c\u1ee7a nhi\u1ec1u nh\u00f3m t\u00e1c nh\u00e2n \u0111e d\u1ecda kh\u00e1c nhau.<\/p><p>Ngu\u1ed3n tin t\u1eeb Solar Analysts \u0111\u00e3 cung c\u1ea5p c\u00e1c ch\u1ec9 b\u00e1o v\u1ec1 s\u1ef1 th\u1ecfa hi\u1ec7p (Indicators of Compromise \u2013 **IOCs**) gi\u00fap c\u00e1c \u0111\u1ed9i ng\u0169 an ninh c\u00f3 th\u1ec3 nh\u1eadn di\u1ec7n ho\u1ea1t \u0111\u1ed9ng c\u1ee7a **WebRAT**. C\u00e1c IOCs n\u00e0y bao g\u1ed3m:<\/p><ul class=\"wp-block-list\"><li>**\u0110\u1ecba ch\u1ec9 m\u00e1y ch\u1ee7 (Server Addresses)**: C\u00e1c \u0111\u1ecba ch\u1ec9 IP ho\u1eb7c t\u00ean mi\u1ec1n m\u00e0 **m\u00e3 \u0111\u1ed9c WebRAT** s\u1eed d\u1ee5ng \u0111\u1ec3 giao ti\u1ebfp v\u1edbi m\u00e1y ch\u1ee7 C2 c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng. Vi\u1ec7c gi\u00e1m s\u00e1t l\u01b0u l\u01b0\u1ee3ng m\u1ea1ng \u0111\u1ebfn v\u00e0 \u0111i t\u1eeb c\u00e1c \u0111\u1ecba ch\u1ec9 n\u00e0y c\u00f3 th\u1ec3 gi\u00fap **ph\u00e1t hi\u1ec7n x\u00e2m nh\u1eadp**.<\/li>\n\n<li>**Ch\u1eef k\u00fd m\u1ea1ng (Network Signatures)**: C\u00e1c m\u1eabu l\u01b0u l\u01b0\u1ee3ng m\u1ea1ng \u0111\u1eb7c tr\u01b0ng ho\u1eb7c c\u00e1c giao th\u1ee9c t\u00f9y ch\u1ec9nh m\u00e0 **WebRAT** s\u1eed d\u1ee5ng \u0111\u1ec3 truy\u1ec1n d\u1eef li\u1ec7u. Vi\u1ec7c ph\u00e1t hi\u1ec7n c\u00e1c ch\u1eef k\u00fd n\u00e0y th\u00f4ng qua h\u1ec7 th\u1ed1ng ph\u00e1t hi\u1ec7n x\u00e2m nh\u1eadp (IDS) ho\u1eb7c ph\u1ea7n m\u1ec1m ph\u00e2n t\u00edch m\u1ea1ng l\u00e0 r\u1ea5t quan tr\u1ecdng.<\/li><\/ul><p>Vi\u1ec7c theo d\u00f5i v\u00e0 ph\u00e2n t\u00edch c\u00e1c IOCs n\u00e0y l\u00e0 c\u1ea7n thi\u1ebft \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh c\u00e1c h\u1ec7 th\u1ed1ng b\u1ecb l\u00e2y nhi\u1ec5m v\u00e0 ng\u0103n ch\u1eb7n s\u1ef1 l\u00e2y lan c\u1ee7a m\u00e3 \u0111\u1ed9c trong m\u1ea1ng. Tham kh\u1ea3o th\u00eam v\u1ec1 ph\u00e2n t\u00edch c\u1ee7a Solar t\u1ea1i&nbsp;<a href=\"https:\/\/rt-solar.ru\/events\/news\/5561\/\" target=\"_blank\" rel=\"noreferrer noopener\">rt-solar.ru<\/a>.<\/p><p><sub>Ngu\u1ed3n : <a href=\"https:\/\/adsecvn.com\/ma-doc-webrat-nguy-hiem-tan-cong-mang-nghiem-trong\/#Tong_quan_ve_ma_doc_WebRAT_va_Kha_nang_tan_cong\">https:\/\/adsecvn.com\/ma-doc-webrat-nguy-hiem-tan-cong-mang-nghiem-trong\/#Tong_quan_ve_ma_doc_WebRAT_va_Kha_nang_tan_cong<\/a><\/sub><\/p><p><\/p>","protected":false},"excerpt":{"rendered":"<p>M\u1ed9t chi\u1ebfn d\u1ecbch ph\u00e1t t\u00e1n **m\u00e3 \u0111\u1ed9c WebRAT** m\u1edbi \u0111\u00e3 \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n, s\u1eed d\u1ee5ng c\u00e1c kho l\u01b0u tr\u1eef GitHub \u0111\u1ec3 lan truy\u1ec1n ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i n\u00e0y. M\u00e3 \u0111\u1ed9c \u0111\u01b0\u1ee3c ng\u1ee5y trang d\u01b0\u1edbi d\u1ea1ng c\u00e1c c\u00f4ng c\u1ee5 khai th\u00e1c (proof-of-concept exploits) ho\u1eb7c ti\u1ec7n \u00edch tr\u00f2 ch\u01a1i, nh\u1eafm m\u1ee5c ti\u00eau v\u00e0o ng\u01b0\u1eddi d\u00f9ng t\u00ecm ki\u1ebfm&#8230;.<\/p>\n","protected":false},"author":1,"featured_media":6259,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[311],"tags":[],"class_list":["post-6258","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc"],"acf":[],"_links":{"self":[{"href":"https:\/\/tamanh.asia\/index.php?rest_route=\/wp\/v2\/posts\/6258","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tamanh.asia\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tamanh.asia\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tamanh.asia\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tamanh.asia\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6258"}],"version-history":[{"count":2,"href":"https:\/\/tamanh.asia\/index.php?rest_route=\/wp\/v2\/posts\/6258\/revisions"}],"predecessor-version":[{"id":6300,"href":"https:\/\/tamanh.asia\/index.php?rest_route=\/wp\/v2\/posts\/6258\/revisions\/6300"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tamanh.asia\/index.php?rest_route=\/wp\/v2\/media\/6259"}],"wp:attachment":[{"href":"https:\/\/tamanh.asia\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6258"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tamanh.asia\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6258"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tamanh.asia\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6258"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}