{"id":10475,"date":"2025-07-18T12:35:57","date_gmt":"2025-07-18T05:35:57","guid":{"rendered":"https:\/\/infosec.new88088.net\/?p=10475"},"modified":"2026-02-05T12:36:05","modified_gmt":"2026-02-05T05:36:05","slug":"chien-dich-ghostcontainer-am-tham-xam-nhap-ha-tang-chinh-phu-va-cong-nghe-tai-chau-a","status":"publish","type":"post","link":"https:\/\/infosec.new88088.net\/2025\/07\/18\/chien-dich-ghostcontainer-am-tham-xam-nhap-ha-tang-chinh-phu-va-cong-nghe-tai-chau-a\/","title":{"rendered":"Chi\u1ebfn d\u1ecbch GhostContainer \u00e2m th\u1ea7m x\u00e2m nh\u1eadp h\u1ea1 t\u1ea7ng ch\u00ednh ph\u1ee7 v\u00e0 c\u00f4ng ngh\u1ec7 t\u1ea1i ch\u00e2u \u00c1"},"content":{"rendered":"

Theo b\u00e1o c\u00e1o do Kaspersky c\u00f4ng b\u1ed1 gi\u1eefa th\u00e1ng 7\/2025, m\u1ed9t chi\u1ebfn d\u1ecbch m\u00e3 \u0111\u1ed9c tinh vi mang t\u00ean GhostContainer \u0111ang \u00e2m th\u1ea7m di\u1ec5n ra nh\u1eafm v\u00e0o c\u00e1c m\u00e1y ch\u1ee7 Microsoft Exchange trong c\u00e1c c\u01a1 quan ch\u00ednh ph\u1ee7 v\u00e0 doanh nghi\u1ec7p c\u00f4ng ngh\u1ec7 t\u1ea1i ch\u00e2u \u00c1. Chi\u1ebfn d\u1ecbch l\u1ee3i d\u1ee5ng l\u1ed7 h\u1ed5ng t\u1ed3n t\u1ea1i tr\u00ean c\u00e1c m\u00e1y ch\u1ee7 Exchange ch\u01b0a \u0111\u01b0\u1ee3c v\u00e1 \u0111\u1ec3 c\u00e0i backdoor, duy tr\u00ec quy\u1ec1n ki\u1ec3m so\u00e1t h\u1ec7 th\u1ed1ng trong th\u1eddi gian d\u00e0i m\u00e0 kh\u00f4ng b\u1ecb ph\u00e1t hi\u1ec7n.<\/b><\/p>\n

GhostContainer \u0111\u01b0\u1ee3c ghi nh\u1eadn l\u00e0 khai th\u00e1c l\u1ed7 h\u1ed5ng CVE-2020-0688, m\u1ed9t l\u1ed7i deserialization t\u1ed3n t\u1ea1i trong Exchange Control Panel. L\u1ed7 h\u1ed5ng n\u00e0y \u0111\u00e3 b\u1ecb c\u00f4ng b\u1ed1 t\u1eeb l\u00e2u, tuy nhi\u00ean nhi\u1ec1u h\u1ec7 th\u1ed1ng v\u1eabn ch\u01b0a v\u00e1, tr\u1edf th\u00e0nh m\u1ee5c ti\u00eau l\u00fd t\u01b0\u1edfng cho c\u00e1c nh\u00f3m APT. B\u1eb1ng c\u00e1ch khai th\u00e1c l\u1ed7 h\u1ed5ng n\u00e0y, m\u00e3 \u0111\u1ed9c c\u1ea5y t\u1ec7p \u0111\u1ed9c h\u1ea1i c\u00f3 t\u00ean App_Web_Container_1.dll v\u00e0o h\u1ec7 th\u1ed1ng v\u00e0 b\u1eaft \u0111\u1ea7u th\u1ef1c thi chu\u1ed7i ho\u1ea1t \u0111\u1ed9ng t\u1ea5n c\u00f4ng \u0111\u01b0\u1ee3c l\u1eadp tr\u00ecnh s\u1eb5n.<\/p>\n

\n
\"GhostContainer.png\"<\/div>\n<\/div>\n

Ki\u1ebfn tr\u00fac c\u1ee7a GhostContainer g\u1ed3m ba l\u1edbp, m\u1ed7i l\u1edbp \u0111\u1ea3m nh\u1eadn m\u1ed9t vai tr\u00f2 ri\u00eang bi\u1ec7t trong vi\u1ec7c duy tr\u00ec quy\u1ec1n truy c\u1eadp, che gi\u1ea5u ho\u1ea1t \u0111\u1ed9ng v\u00e0 t\u1ea1o k\u00eanh li\u00ean l\u1ea1c \u1ea9n:<\/p>\n

    \n
  • Th\u00e0nh ph\u1ea7n \u0111\u1ea7u ti\u00ean trong ki\u1ebfn tr\u00fac c\u1ee7a GhostContainer l\u00e0 Stub, b\u1ed9 kh\u1edfi \u0111\u1ed9ng ch\u1ecbu tr\u00e1ch nhi\u1ec7m k\u00edch ho\u1ea1t to\u00e0n b\u1ed9 quy tr\u00ecnh t\u1ea5n c\u00f4ng. Khi \u0111\u01b0\u1ee3c th\u1ef1c thi, Stub ti\u1ebfn h\u00e0nh ki\u1ec3m tra m\u00f4i tr\u01b0\u1eddng h\u1ec7 th\u1ed1ng, x\u00e1c \u0111\u1ecbnh \u0111i\u1ec1u ki\u1ec7n th\u00edch h\u1ee3p \u0111\u1ec3 n\u1ea1p c\u00e1c th\u00e0nh ph\u1ea7n k\u1ebf ti\u1ebfp m\u00e0 kh\u00f4ng b\u1ecb ph\u00e1t hi\u1ec7n. N\u00f3 \u0111\u00f3ng vai tr\u00f2 nh\u01b0 m\u1ed9t tr\u00ecnh \u0111i\u1ec1u ph\u1ed1i trung t\u00e2m, \u0111\u1ea3m b\u1ea3o m\u00e3 \u0111\u1ed9c kh\u1edfi ch\u1ea1y an to\u00e0n, \u0111\u00fang l\u00fac v\u00e0 c\u00f3 th\u1ec3 tr\u00e1nh \u0111\u01b0\u1ee3c c\u00e1c bi\u1ec7n ph\u00e1p ph\u00e1t hi\u1ec7n d\u1ef1a tr\u00ean h\u00e0nh vi ho\u1eb7c sandbox.<\/li>\n
  • Th\u00e0nh ph\u1ea7n th\u1ee9 hai c\u00f3 t\u00ean App_Web_843e75cf5b63, \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf chuy\u00ean bi\u1ec7t \u0111\u1ec3 th\u1ef1c hi\u1ec7n k\u1ef9 thu\u1eadt ti\u00eam trang \u1ea3o (virtual page injection). M\u1ee5c ti\u00eau c\u1ee7a l\u1edbp n\u00e0y l\u00e0 t\u1ea1o ra c\u00e1c v\u00f9ng m\u00e3 gi\u1ea3 (ghost page) trong b\u1ed9 nh\u1edb m\u00e0 kh\u00f4ng t\u1ed3n t\u1ea1i tr\u00ean h\u1ec7 th\u1ed1ng t\u1ec7p v\u1eadt l\u00fd, t\u1eeb \u0111\u00f3 gi\u00fap m\u00e3 \u0111\u1ed9c n\u00e9 tr\u00e1nh \u0111\u01b0\u1ee3c c\u01a1 ch\u1ebf gi\u00e1m s\u00e1t c\u1ee7a h\u1ec7 \u0111i\u1ec1u h\u00e0nh v\u00e0 ph\u1ea7n m\u1ec1m b\u1ea3o m\u1eadt. C\u00e1ch ti\u1ebfp c\u1eadn n\u00e0y cho ph\u00e9p GhostContainer t\u1ed3n t\u1ea1i b\u1ec1n v\u1eefng m\u00e0 kh\u00f4ng \u0111\u1ec3 l\u1ea1i d\u1ea5u hi\u1ec7u r\u00f5 r\u1ec7t, m\u1ed9t chi\u1ebfn thu\u1eadt ph\u1ed5 bi\u1ebfn trong c\u00e1c chi\u1ebfn d\u1ecbch APT c\u1ea7n duy tr\u00ec ch\u1ed7 \u0111\u1ee9ng l\u00e2u d\u00e0i.<\/li>\n
  • Th\u00e0nh ph\u1ea7n cu\u1ed1i c\u00f9ng, App_Web_8c9b251fb5b3, ho\u1ea1t \u0111\u1ed9ng nh\u01b0 m\u1ed9t web proxy k\u1ebft h\u1ee3p c\u00f4ng c\u1ee5 t\u1ea1o \u0111\u01b0\u1eddng h\u1ea7m TCP, \u0111\u01b0\u1ee3c ph\u00e1t tri\u1ec3n d\u1ef1a tr\u00ean bi\u1ebfn th\u1ec3 c\u1ee7a Neo-reGeorg m\u00e3 ngu\u1ed3n m\u1edf. N\u00f3 cho ph\u00e9p GhostContainer thi\u1ebft l\u1eadp k\u00eanh li\u00ean l\u1ea1c ng\u1ee5y trang ho\u00e0n to\u00e0n b\u1eb1ng c\u00e1ch s\u1eed d\u1ee5ng c\u00e1c HTTP header t\u00f9y bi\u1ebfn nh\u01b0 Qprtfva v\u00e0 Dzvvlnwkccf \u0111\u1ec3 truy\u1ec1n l\u1ec7nh \u0111i\u1ec1u khi\u1ec3n. Nh\u1edd \u0111\u00f3, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 t\u01b0\u01a1ng t\u00e1c v\u1edbi m\u00e1y ch\u1ee7 b\u1ecb x\u00e2m nh\u1eadp m\u00e0 kh\u00f4ng c\u1ea7n h\u1ea1 t\u1ea7ng C2 c\u1ed1 \u0111\u1ecbnh, l\u00e0m cho l\u01b0u l\u01b0\u1ee3ng \u0111\u1ed9c h\u1ea1i tr\u00f4ng kh\u00f4ng kh\u00e1c g\u00ec c\u00e1c phi\u00ean truy c\u1eadp web h\u1ee3p l\u1ec7, m\u1ed9t th\u1ee7 thu\u1eadt \u0111\u00e1nh l\u1eeba h\u1ec7 th\u1ed1ng ph\u00e1t hi\u1ec7n m\u1ea1ng c\u1ef1c k\u1ef3 hi\u1ec7u qu\u1ea3.<\/li>\n<\/ul>\n

    Ngay khi \u0111\u01b0\u1ee3c th\u1ef1c thi, GhostContainer ti\u1ebfn h\u00e0nh v\u00f4 hi\u1ec7u h\u00f3a c\u00e1c c\u01a1 ch\u1ebf b\u1ea3o v\u1ec7 c\u1ee7a h\u1ec7 th\u1ed1ng nh\u01b0 Antimalware Scan Interface v\u00e0 nh\u1eadt k\u00fd s\u1ef1 ki\u1ec7n Windows b\u1eb1ng c\u00e1ch ghi \u0111\u00e8 c\u00e1c h\u00e0m trong th\u01b0 vi\u1ec7n amsi.dll v\u00e0 ntdll.dll. M\u00e3 \u0111\u1ed9c c\u0169ng tr\u00edch xu\u1ea5t kh\u00f3a ASP.NET validation key t\u1eeb c\u1ea5u h\u00ecnh m\u00e1y ch\u1ee7 Exchange, sau \u0111\u00f3 s\u1eed d\u1ee5ng thu\u1eadt to\u00e1n SHA-256 \u0111\u1ec3 t\u1ea1o kh\u00f3a AES 32 byte ph\u1ee5c v\u1ee5 m\u00e3 h\u00f3a li\u00ean l\u1ea1c v\u1edbi m\u00e1y ch\u1ee7 \u0111i\u1ec1u khi\u1ec3n. Nh\u1edd v\u1eady, to\u00e0n b\u1ed9 lu\u1ed3ng l\u1ec7nh v\u00e0 d\u1eef li\u1ec7u ph\u1ea3n h\u1ed3i \u0111\u1ec1u \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a, khi\u1ebfn vi\u1ec7c ph\u00e1t hi\u1ec7n tr\u1edf n\u00ean kh\u00f3 kh\u0103n h\u01a1n.<\/p>\n

    GhostContainer h\u1ed7 tr\u1ee3 \u0111\u1ebfn m\u01b0\u1eddi b\u1ed1n l\u1ec7nh \u0111i\u1ec1u khi\u1ec3n kh\u00e1c nhau, t\u1eeb th\u1ef1c thi shellcode, ch\u1ea1y d\u00f2ng l\u1ec7nh, t\u1ea3i m\u00e3 .NET, cho t\u1edbi \u0111\u1ecdc ghi t\u1ec7p, t\u1ea3i d\u1eef li\u1ec7u t\u1eeb xa v\u00e0 g\u1eedi y\u00eau c\u1ea7u HTTP POST \u0111\u1ed3ng th\u1eddi \u0111\u1ebfn nhi\u1ec1u \u0111\u1ecba ch\u1ec9. M\u00e3 \u0111\u1ed9c \u0111\u01b0\u1ee3c tri\u1ec3n khai d\u01b0\u1edbi d\u1ea1ng th\u01b0 vi\u1ec7n .NET \u0111\u1ed9ng (DLL), \u0111\u01b0\u1ee3c c\u1ea5y v\u00e0o th\u01b0 m\u1ee5c \u1ee9ng d\u1ee5ng web c\u1ee7a Exchange v\u00e0 th\u1ef1c thi nh\u01b0 m\u1ed9t th\u00e0nh ph\u1ea7n h\u1ee3p ph\u00e1p trong m\u00f4i tr\u01b0\u1eddng ASP.NET. C\u00e1ch th\u1ee9c n\u00e0y gi\u00fap GhostContainer d\u1ec5 d\u00e0ng h\u00f2a m\u00ecnh v\u00e0o h\u1ea1 t\u1ea7ng h\u1ee3p ph\u00e1p, tr\u00e1nh b\u1ecb ch\u00fa \u00fd v\u00e0 t\u1ed3n t\u1ea1i b\u1ec1n v\u1eefng trong h\u1ec7 th\u1ed1ng. Chi\u1ebfn d\u1ecbch c\u0169ng cho th\u1ea5y d\u1ea5u hi\u1ec7u r\u00f5 r\u00e0ng c\u1ee7a vi\u1ec7c t\u00e1i s\u1eed d\u1ee5ng v\u00e0 tinh ch\u1ec9nh c\u00f4ng c\u1ee5 m\u00e3 ngu\u1ed3n m\u1edf: m\u00e3 \u0111\u1ed9c ch\u1ee9a chu\u1ed7i XML \u0111\u1ecbnh danh tr\u00f9ng v\u1edbi ExchangeCmdPy.py, trong khi web proxy \u0111\u01b0\u1ee3c tri\u1ec3n khai d\u1ef1a tr\u00ean bi\u1ebfn th\u1ec3 Neo-reGeorg. Vi\u1ec7c t\u1eadn d\u1ee5ng c\u00e1c c\u00f4ng c\u1ee5 s\u1eb5n c\u00f3 kh\u00f4ng ch\u1ec9 r\u00fat ng\u1eafn th\u1eddi gian ph\u00e1t tri\u1ec3n m\u00e0 c\u00f2n gi\u00fap h\u00e0nh vi t\u1ea5n c\u00f4ng \u1ea9n m\u00ecnh t\u1ed1t h\u01a1n, kh\u00f3 b\u1ecb ph\u00e1t hi\u1ec7n b\u1edfi c\u00e1c gi\u1ea3i ph\u00e1p ch\u1ed1ng m\u00e3 \u0111\u1ed9c truy\u1ec1n th\u1ed1ng.<\/p>\n

    M\u1ed9t \u0111\u1eb7c \u0111i\u1ec3m \u0111\u00e1ng lo ng\u1ea1i c\u1ee7a chi\u1ebfn d\u1ecbch n\u00e0y l\u00e0 GhostContainer kh\u00f4ng thi\u1ebft l\u1eadp k\u00eanh li\u00ean l\u1ea1c c\u1ed1 \u0111\u1ecbnh ra ngo\u00e0i. Thay v\u00e0o \u0111\u00f3, k\u1ebb t\u1ea5n c\u00f4ng truy c\u1eadp v\u00e0o m\u00e1y ch\u1ee7 Exchange t\u1eeb b\u00ean ngo\u00e0i, g\u1eedi c\u00e1c l\u1ec7nh \u0111i\u1ec1u khi\u1ec3n \u0111\u01b0\u1ee3c ng\u1ee5y trang ho\u00e0n to\u00e0n trong l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp h\u1ee3p ph\u00e1p, cho ph\u00e9p h\u1ecd duy tr\u00ec quy\u1ec1n ki\u1ec3m so\u00e1t h\u1ec7 th\u1ed1ng m\u00e0 kh\u00f4ng c\u1ea7n h\u1ea1 t\u1ea7ng C2 r\u00f5 r\u00e0ng. C\u00e1ch ti\u1ebfp c\u1eadn n\u00e0y kh\u00f4ng ch\u1ec9 t\u0103ng t\u00ednh \u1ea9n m\u00ecnh m\u00e0 c\u00f2n l\u00e0m gi\u1ea3m kh\u1ea3 n\u0103ng ph\u00e1t hi\u1ec7n qua ph\u00e2n t\u00edch l\u01b0u l\u01b0\u1ee3ng m\u1ea1ng.<\/p>\n

    Theo ph\u00e2n t\u00edch t\u1eeb Kaspersky, \u00edt nh\u1ea5t hai m\u1ee5c ti\u00eau \u0111\u00e3 b\u1ecb x\u00e2m nh\u1eadp th\u00e0nh c\u00f4ng, bao g\u1ed3m m\u1ed9t c\u01a1 quan ch\u00ednh ph\u1ee7 v\u00e0 m\u1ed9t t\u1eadp \u0111o\u00e0n c\u00f4ng ngh\u1ec7 l\u1edbn t\u1ea1i ch\u00e2u \u00c1. Vi\u1ec7c l\u1ef1a ch\u1ecdn Exchange l\u00e0m m\u1ee5c ti\u00eau cho th\u1ea5y m\u1ee9c \u0111\u1ed9 am hi\u1ec3u s\u00e2u s\u1eafc c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng v\u1ec1 h\u1ea1 t\u1ea7ng CNTT trong m\u00f4i tr\u01b0\u1eddng doanh nghi\u1ec7p v\u00e0 ch\u00ednh ph\u1ee7. GhostContainer kh\u00f4ng \u0111\u01a1n thu\u1ea7n l\u00e0 m\u1ed9t m\u00e3 \u0111\u1ed9c th\u00f4ng th\u01b0\u1eddng m\u00e0 l\u00e0 s\u1ea3n ph\u1ea9m c\u1ee7a m\u1ed9t nh\u00f3m APT c\u00f3 k\u1ef9 n\u0103ng cao, \u0111\u01b0\u1ee3c trang b\u1ecb \u0111\u1ea7y \u0111\u1ee7 c\u00f4ng c\u1ee5, hi\u1ec3u r\u00f5 c\u00e1ch v\u1eadn h\u00e0nh c\u1ee7a h\u1ec7 th\u1ed1ng Exchange v\u00e0 bi\u1ebft c\u00e1ch \u1ea9n m\u00ecnh trong l\u00f2ng h\u1ea1 t\u1ea7ng s\u1ed1.<\/p>\n

    Chi\u1ebfn d\u1ecbch GhostContainer l\u00e0 l\u1eddi nh\u1eafc m\u1ea1nh m\u1ebd r\u1eb1ng c\u00e1c l\u1ed7 h\u1ed5ng N-day kh\u00f4ng th\u1ec3 b\u1ecb xem nh\u1eb9, \u0111\u1eb7c bi\u1ec7t l\u00e0 v\u1edbi c\u00e1c h\u1ec7 th\u1ed1ng l\u00f5i nh\u01b0 Microsoft Exchange. Trong b\u1ed1i c\u1ea3nh nhi\u1ec1u t\u1ed5 ch\u1ee9c v\u1eabn ch\u01b0a \u00e1p d\u1ee5ng \u0111\u1ea7y \u0111\u1ee7 c\u00e1c b\u1ea3n v\u00e1 b\u1ea3o m\u1eadt, vi\u1ec7c duy tr\u00ec c\u01a1 ch\u1ebf gi\u00e1m s\u00e1t ch\u1eb7t ch\u1ebd v\u00e0 ph\u00e2n t\u00edch h\u00e0nh vi b\u1ea5t th\u01b0\u1eddng trong \u1ee9ng d\u1ee5ng n\u1ed9i b\u1ed9 l\u00e0 tuy\u1ebfn ph\u00f2ng th\u1ee7 cu\u1ed1i c\u00f9ng tr\u01b0\u1edbc c\u00e1c m\u1ed1i \u0111e d\u1ecda tinh vi nh\u01b0 GhostContainer.<\/p>\n

    WhiteHat<\/i><\/b>\u200b<\/div>\n
    Theo: https:\/\/whitehat.vn\/threads\/chien-dich-ghostcontainer-am-tham-xam-nhap-ha-tang-chinh-phu-va-cong-nghe-tai-chau-a.18577\/<\/a><\/i><\/div>\n","protected":false},"excerpt":{"rendered":"

    Theo b\u00e1o c\u00e1o do Kaspersky c\u00f4ng b\u1ed1 gi\u1eefa th\u00e1ng 7\/2025, m\u1ed9t chi\u1ebfn d\u1ecbch m\u00e3 \u0111\u1ed9c tinh vi mang t\u00ean GhostContainer \u0111ang \u00e2m th\u1ea7m di\u1ec5n ra nh\u1eafm v\u00e0o c\u00e1c m\u00e1y ch\u1ee7 Microsoft Exchange trong c\u00e1c c\u01a1 quan ch\u00ednh ph\u1ee7 v\u00e0 doanh nghi\u1ec7p c\u00f4ng ngh\u1ec7 t\u1ea1i ch\u00e2u \u00c1. Chi\u1ebfn d\u1ecbch l\u1ee3i d\u1ee5ng l\u1ed7 h\u1ed5ng t\u1ed3n t\u1ea1i tr\u00ean […]<\/p>\n","protected":false},"author":46,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33],"tags":[],"class_list":["post-10475","post","type-post","status-publish","format-standard","hentry","category-tin-tuc-cua-vien"],"_links":{"self":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/10475","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/users\/46"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/comments?post=10475"}],"version-history":[{"count":0,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/10475\/revisions"}],"wp:attachment":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/media?parent=10475"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/categories?post=10475"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/tags?post=10475"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}