{"id":7058,"date":"2023-07-21T17:56:12","date_gmt":"2023-07-21T10:56:12","guid":{"rendered":"https:\/\/vacif.com\/?p=7058"},"modified":"2023-07-21T17:56:12","modified_gmt":"2023-07-21T10:56:12","slug":"ryuk-ransomware-la-gi-phuong-thuc-tan-cong-va-cach-bao-ve","status":"publish","type":"post","link":"https:\/\/vacif.com\/en\/ryuk-ransomware-la-gi-phuong-thuc-tan-cong-va-cach-bao-ve\/","title":{"rendered":"RYUK RANSOMWARE L\u00c0 G\u00cc? PH\u01af\u01a0NG TH\u1ee8C T\u1ea4N C\u00d4NG V\u00c0 C\u00c1CH B\u1ea2O V\u1ec6."},"content":{"rendered":"\n

1.Ryuk Ransomware l\u00e0 g\u00ec?<\/strong><\/p>\n\n\n\n

Ryuk Ransomware l\u00e0 m\u1ed9t lo\u1ea1i ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i (malware) \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 th\u1ef1c hi\u1ec7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng ransomware. N\u00f3 \u0111\u00e3 xu\u1ea5t hi\u1ec7n v\u00e0o n\u0103m 2018 v\u00e0 \u0111\u01b0\u1ee3c bi\u1ebft \u0111\u1ebfn v\u1edbi t\u00ednh chuy\u00ean nghi\u1ec7p v\u00e0 hi\u1ec7u su\u1ea5t cao trong vi\u1ec7c t\u1ea5n c\u00f4ng c\u00e1c t\u1ed5 ch\u1ee9c v\u00e0 c\u00f4ng ty l\u1edbn.<\/p>\n\n\n\n

Ryuk s\u1eed d\u1ee5ng m\u00e3 h\u00f3a \u0111\u1ed1i x\u1ee9ng AES (Advanced Encryption Standard) v\u00e0 m\u00e3 h\u00f3a kh\u00f4ng \u0111\u1ed1i x\u1ee9ng RSA (Rivest-Shamir-Adleman) \u0111\u1ec3 m\u00e3 h\u00f3a c\u00e1c t\u1eadp tin tr\u00ean h\u1ec7 th\u1ed1ng. M\u00e3 h\u00f3a AES \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 m\u00e3 h\u00f3a d\u1eef li\u1ec7u theo c\u00e1c kh\u1ed1i, trong khi m\u00e3 h\u00f3a RSA \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 m\u00e3 h\u00f3a c\u00e1c kh\u00f3a \u0111\u1ed1i x\u1ee9ng AES. S\u1ef1 k\u1ebft h\u1ee3p c\u1ee7a c\u1ea3 hai m\u00e3 h\u00f3a n\u00e0y gi\u00fap t\u0103ng c\u01b0\u1eddng t\u00ednh b\u1ea3o m\u1eadt c\u1ee7a qu\u00e1 tr\u00ecnh m\u00e3 h\u00f3a.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

Ryuk Ransomware \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 t\u1ea5n c\u00f4ng c\u00e1c h\u1ec7 th\u1ed1ng v\u00e0 m\u1ea1ng m\u00e1y t\u00ednh, sau \u0111\u00f3 m\u00e3 h\u00f3a d\u1eef li\u1ec7u quan tr\u1ecdng c\u1ee7a c\u00e1c n\u1ea1n nh\u00e2n b\u1eb1ng m\u1eadt m\u00e3 m\u1ea1nh. Sau khi d\u1eef li\u1ec7u \u0111\u00e3 \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a, n\u00f3 s\u1ebd hi\u1ec3n th\u1ecb m\u1ed9t th\u00f4ng b\u00e1o y\u00eau c\u1ea7u ti\u1ec1n chu\u1ed9c, th\u00f4ng qua m\u1ed9t t\u1ec7p v\u0103n b\u1ea3n hay h\u00ecnh n\u1ec1n m\u00e0n h\u00ecnh m\u00e1y t\u00ednh, y\u00eau c\u1ea7u ng\u01b0\u1eddi n\u1ea1n nh\u00e2n tr\u1ea3 ti\u1ec1n chu\u1ed9c b\u1eb1ng ti\u1ec1n \u0111i\u1ec7n t\u1eed (th\u01b0\u1eddng l\u00e0 Bitcoin) \u0111\u1ec3 nh\u1eadn \u0111\u01b0\u1ee3c kh\u00f3a gi\u1ea3i m\u00e3 v\u00e0 ph\u1ee5c h\u1ed3i d\u1eef li\u1ec7u.<\/p>\n\n\n\n

C\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng Ryuk Ransomware th\u01b0\u1eddng \u0111\u01b0\u1ee3c ti\u1ebfn h\u00e0nh m\u1ed9t c\u00e1ch r\u1ea5t c\u1ea9n th\u1eadn v\u00e0 c\u00f3 ch\u1ecdn l\u1ecdc c\u00e1c m\u1ee5c ti\u00eau c\u00f3 gi\u00e1 tr\u1ecb kinh t\u1ebf cao nh\u01b0 doanh nghi\u1ec7p, t\u1ed5 ch\u1ee9c v\u00e0 c\u01a1 quan ch\u00ednh ph\u1ee7. K\u1ebb t\u1ea5n c\u00f4ng th\u01b0\u1eddng ti\u1ebfn h\u00e0nh m\u1ed9t s\u1ed1 ho\u1ea1t \u0111\u1ed9ng tr\u01b0\u1edbc \u0111\u1ec3 nghi\u00ean c\u1ee9u m\u1ea1ng m\u1ee5c ti\u00eau, x\u00e2m nh\u1eadp v\u00e0 ti\u1ebfn h\u00e0nh t\u1ea5n c\u00f4ng m\u1ed9t c\u00e1ch t\u00f9y ch\u1ec9nh \u0111\u1ec3 t\u1ed1i \u01b0u h\u00f3a kh\u1ea3 n\u0103ng th\u00e0nh c\u00f4ng v\u00e0 ti\u1ec1m n\u0103ng c\u1ee7a vi\u1ec7c nh\u1eadn ti\u1ec1n chu\u1ed9c.<\/p>\n\n\n\n

Nh\u1eefng cu\u1ed9c t\u1ea5n c\u00f4ng n\u00e0y g\u00e2y ra t\u1ed5n th\u1ea5t nghi\u00eam tr\u1ecdng v\u00e0 g\u00e2y \u1ea3nh h\u01b0\u1edfng \u0111\u00e1ng k\u1ec3 \u0111\u1ebfn ho\u1ea1t \u0111\u1ed9ng c\u1ee7a c\u00e1c t\u1ed5 ch\u1ee9c v\u00e0 doanh nghi\u1ec7p. V\u00ec v\u1eady, vi\u1ec7c \u00e1p d\u1ee5ng bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt hi\u1ec7u qu\u1ea3 v\u00e0 duy tr\u00ec sao l\u01b0u d\u1eef li\u1ec7u \u0111\u1ecbnh k\u1ef3 l\u00e0 r\u1ea5t quan tr\u1ecdng \u0111\u1ec3 b\u1ea3o v\u1ec7 kh\u1ecfi Ryuk Ransomware v\u00e0 c\u00e1c lo\u1ea1i ransomware kh\u00e1c.<\/p>\n\n\n\n

2. M\u1ed9t s\u1ed1 cu\u1ed9c t\u1ea5n c\u00f4ng n\u1ed5i ti\u1ebfng c\u1ee7a Ryuk Ransomware.<\/strong><\/p>\n\n\n\n

D\u01b0\u1edbi \u0111\u00e2y l\u00e0 m\u1ed9t s\u1ed1 cu\u1ed9c t\u1ea5n c\u00f4ng n\u1ed5i ti\u1ebfng c\u1ee7a Ryuk Ransomware v\u00e0 s\u1ed1 ti\u1ec1n thi\u1ec7t h\u1ea1i li\u00ean quan:<\/p>\n\n\n\n

Tr\u01b0\u1eddng \u0110\u1ea1i h\u1ecdc Gi\u00e1o d\u1ee5c Continuum (ECU) (2019): <\/strong>Trong th\u00e1ng 4 n\u0103m 2019, Ryuk Ransomware \u0111\u00e3 t\u1ea5n c\u00f4ng tr\u01b0\u1eddng \u0110\u1ea1i h\u1ecdc Gi\u00e1o d\u1ee5c Continuum (ECU) t\u1ea1i North Carolina, Hoa K\u1ef3. Cu\u1ed9c t\u1ea5n c\u00f4ng n\u00e0y khi\u1ebfn ECU ph\u1ea3i \u0111\u00f3ng c\u1eeda c\u00e1c h\u1ec7 th\u1ed1ng m\u1ea1ng v\u00e0 h\u1ee7y b\u1ecf c\u00e1c l\u1edbp h\u1ecdc tr\u1ef1c tuy\u1ebfn, \u1ea3nh h\u01b0\u1edfng nghi\u00eam tr\u1ecdng \u0111\u1ebfn ho\u1ea1t \u0111\u1ed9ng c\u1ee7a tr\u01b0\u1eddng. S\u1ed1 ti\u1ec1n ti\u1ec1n chu\u1ed9c \u0111\u01b0\u1ee3c y\u00eau c\u1ea7u t\u1eeb ECU kh\u00f4ng \u0111\u01b0\u1ee3c ti\u1ebft l\u1ed9 c\u00f4ng khai.<\/p>\n\n\n\n

C\u00f4ng ty c\u1ea5p n\u01b0\u1edbc c\u1ee7a Baltimore (2019): <\/strong>Trong th\u00e1ng 5 n\u0103m 2019, Ryuk Ransomware \u0111\u00e3 t\u1ea5n c\u00f4ng c\u00f4ng ty c\u1ea5p n\u01b0\u1edbc c\u1ee7a Baltimore, Maryland, Hoa K\u1ef3. Cu\u1ed9c t\u1ea5n c\u00f4ng n\u00e0y \u0111\u00e3 l\u00e0m cho h\u1ec7 th\u1ed1ng thanh to\u00e1n v\u00e0 h\u1ec7 th\u1ed1ng cung c\u1ea5p n\u01b0\u1edbc tr\u1edf n\u00ean kh\u00f4ng th\u1ec3 s\u1eed d\u1ee5ng, g\u00e2y ra thi\u1ec7t h\u1ea1i l\u1edbn cho c\u00f4ng ty v\u00e0 ng\u01b0\u1eddi d\u00e2n. S\u1ed1 ti\u1ec1n ti\u1ec1n chu\u1ed9c \u0111\u01b0\u1ee3c y\u00eau c\u1ea7u t\u1eeb c\u00f4ng ty c\u1ea5p n\u01b0\u1edbc c\u1ee7a Baltimore l\u00ean t\u1edbi kho\u1ea3ng 18 tri\u1ec7u USD.<\/p>\n\n\n\n

C\u00f4ng ty d\u1ea7u kh\u00ed PDVSA c\u1ee7a Venezuela (2019): <\/strong>V\u00e0o th\u00e1ng 11 n\u0103m 2019, Ryuk Ransomware \u0111\u00e3 t\u1ea5n c\u00f4ng C\u00f4ng ty d\u1ea7u kh\u00ed PDVSA c\u1ee7a Venezuela, m\u1ed9t c\u00f4ng ty qu\u1ed1c gia ch\u1ecbu tr\u00e1ch nhi\u1ec7m s\u1ea3n xu\u1ea5t d\u1ea7u v\u00e0 \u0111\u00f3ng g\u00f3p l\u1edbn cho ng\u00e2n s\u00e1ch qu\u1ed1c gia. Cu\u1ed9c t\u1ea5n c\u00f4ng n\u00e0y \u0111\u00e3 l\u00e0m cho h\u1ec7 th\u1ed1ng s\u1ea3n xu\u1ea5t d\u1ea7u c\u1ee7a PDVSA b\u1ecb gi\u00e1n \u0111o\u1ea1n v\u00e0 y\u00eau c\u1ea7u s\u1ed1 ti\u1ec1n ti\u1ec1n chu\u1ed9c l\u00ean t\u1edbi h\u00e0ng tri\u1ec7u USD.<\/p>\n\n\n\n

3. Ryuk Ransomware v\u00e0 c\u00e1c b\u01b0\u1edbc t\u1ea5n c\u00f4ng.<\/strong><\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

Ryuk Ransomware l\u00e0 m\u1ed9t lo\u1ea1i ransomware nguy hi\u1ec3m, n\u00f3 \u0111\u00e3 g\u00e2y ra nhi\u1ec1u cu\u1ed9c t\u1ea5n c\u00f4ng l\u1edbn v\u00e0 l\u00e0 m\u1ed9t trong nh\u1eefng m\u1ed1i \u0111e d\u1ecda nghi\u00eam tr\u1ecdng \u0111\u1ed1i v\u1edbi c\u00e1c t\u1ed5 ch\u1ee9c v\u00e0 doanh nghi\u1ec7p tr\u00ean to\u00e0n th\u1ebf gi\u1edbi. D\u01b0\u1edbi \u0111\u00e2y l\u00e0 m\u1ed9t s\u1ed1 b\u01b0\u1edbc t\u1ea5n c\u00f4ng ph\u1ed5 bi\u1ebfn m\u00e0 Ryuk Ransomware th\u01b0\u1eddng th\u1ef1c hi\u1ec7n:<\/p>\n\n\n\n

Phishing Email: <\/strong>Cu\u1ed9c t\u1ea5n c\u00f4ng th\u01b0\u1eddng b\u1eaft \u0111\u1ea7u b\u1eb1ng vi\u1ec7c g\u1eedi m\u1ed9t email gi\u1ea3 m\u1ea1o \u0111\u1ebfn n\u1ea1n nh\u00e2n. Email c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 gi\u1ea3 v\u1edd nh\u01b0 m\u1ed9t email h\u1ee3p ph\u00e1p t\u1eeb m\u1ed9t ngu\u1ed3n \u0111\u00e1ng tin c\u1eady, ch\u1eb3ng h\u1ea1n nh\u01b0 m\u1ed9t c\u00f4ng ty ho\u1eb7c t\u1ed5 ch\u1ee9c. N\u1ed9i dung email th\u01b0\u1eddng ch\u1ee9a c\u00e1c l\u1eddi k\u00eau g\u1ecdi ng\u01b0\u1eddi d\u00f9ng th\u1ef1c hi\u1ec7n h\u00e0nh \u0111\u1ed9ng c\u1ee5 th\u1ec3, nh\u01b0 nh\u1ea5p v\u00e0o m\u1ed9t li\u00ean k\u1ebft ho\u1eb7c t\u1ea3i xu\u1ed1ng m\u1ed9t t\u1ec7p \u0111\u00ednh k\u00e8m.<\/p>\n\n\n\n

T\u1ea3i xu\u1ed1ng m\u00e3 \u0111\u1ed9c v\u00e0 l\u00e2y nhi\u1ec5m \u0111\u1ea7u ti\u00ean (Loader): <\/strong>Khi n\u1ea1n nh\u00e2n nh\u1ea5p v\u00e0o li\u00ean k\u1ebft ho\u1eb7c t\u1ea3i xu\u1ed1ng t\u1ec7p \u0111\u00ednh k\u00e8m, m\u00e3 \u0111\u1ed9c (th\u01b0\u1eddng l\u00e0 m\u00e3 \u0111\u1ed9c tr\u01b0\u1edbc nh\u01b0 TrickBot ho\u1eb7c Emotet) s\u1ebd \u0111\u01b0\u1ee3c t\u1ea3i xu\u1ed1ng v\u00e0 ch\u1ea1y tr\u00ean h\u1ec7 th\u1ed1ng n\u1ea1n nh\u00e2n. M\u00e3 \u0111\u1ed9c tr\u01b0\u1edbc th\u01b0\u1eddng s\u1ebd ti\u1ebfn h\u00e0nh thu th\u1eadp th\u00f4ng tin v\u00e0 t\u1ea1o l\u1ed7 h\u1ed5ng \u0111\u1ec3 cho ph\u00e9p Ryuk Ransomware l\u00e2y nhi\u1ec5m v\u00e0o h\u1ec7 th\u1ed1ng m\u1ed9t c\u00e1ch hi\u1ec7u qu\u1ea3 h\u01a1n.<\/p>\n\n\n\n

X\u00e2m nh\u1eadp v\u00e0o h\u1ec7 th\u1ed1ng:<\/strong> Khi \u0111\u00e3 l\u00e2y nhi\u1ec5m tr\u00ean h\u1ec7 th\u1ed1ng m\u1ee5c ti\u00eau, Ryuk Ransomware b\u1eaft \u0111\u1ea7u x\u00e2m nh\u1eadp v\u00e0o c\u00e1c h\u1ec7 th\u1ed1ng v\u00e0 thi\u1ebft b\u1ecb kh\u00e1c trong m\u1ea1ng n\u1ed9i b\u1ed9 c\u1ee7a n\u1ea1n nh\u00e2n \u0111\u1ec3 lan r\u1ed9ng cu\u1ed9c t\u1ea5n c\u00f4ng. \u0110i\u1ec1u n\u00e0y gi\u00fap n\u00f3 truy c\u1eadp v\u00e0o nhi\u1ec1u d\u1eef li\u1ec7u v\u00e0 h\u1ec7 th\u1ed1ng quan tr\u1ecdng h\u01a1n \u0111\u1ec3 m\u00e3 h\u00f3a.<\/p>\n\n\n\n

L\u1ea5y quy\u1ec1n qu\u1ea3n tr\u1ecb v\u00e0 \u0111\u1eb7t quy\u1ec1n \u0111\u1ecdc\/ghi:<\/strong> Ryuk Ransomware s\u1ebd c\u1ed1 g\u1eafng l\u1ea5y quy\u1ec1n qu\u1ea3n tr\u1ecb ho\u1eb7c \u0111\u1eb7t quy\u1ec1n \u0111\u1ecdc\/ghi v\u00e0o c\u00e1c h\u1ec7 th\u1ed1ng v\u00e0 t\u1ec7p quan tr\u1ecdng. \u0110i\u1ec1u n\u00e0y gi\u00fap n\u00f3 m\u00e3 h\u00f3a d\u1eef li\u1ec7u quan tr\u1ecdng m\u1ed9t c\u00e1ch nhanh ch\u00f3ng v\u00e0 hi\u1ec7u qu\u1ea3.<\/p>\n\n\n\n

M\u00e3 h\u00f3a d\u1eef li\u1ec7u: <\/strong>Sau khi \u0111\u00e3 thu th\u1eadp \u0111\u1ee7 th\u00f4ng tin v\u00e0 l\u1ea5y \u0111\u01b0\u1ee3c quy\u1ec1n truy c\u1eadp ph\u00f9 h\u1ee3p, Ryuk Ransomware ti\u1ebfn h\u00e0nh m\u00e3 h\u00f3a d\u1eef li\u1ec7u quan tr\u1ecdng c\u1ee7a n\u1ea1n nh\u00e2n b\u1eb1ng m\u1eadt m\u00e3 m\u1ea1nh. C\u00e1c lo\u1ea1i t\u1ec7p nh\u01b0 v\u0103n b\u1ea3n, h\u00ecnh \u1ea3nh, t\u00e0i li\u1ec7u, c\u01a1 s\u1edf d\u1eef li\u1ec7u, v\u00e0 t\u1ec7p c\u01a1 b\u1ea3n kh\u00e1c s\u1ebd \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a, tr\u1edf n\u00ean kh\u00f4ng th\u1ec3 truy c\u1eadp v\u00e0 s\u1eed d\u1ee5ng.<\/p>\n\n\n\n

Hi\u1ec3n th\u1ecb th\u00f4ng b\u00e1o chu\u1ed9c v\u00e0 y\u00eau c\u1ea7u chu\u1ed9c:<\/strong> Sau khi m\u00e3 h\u00f3a d\u1eef li\u1ec7u, Ryuk Ransomware s\u1ebd hi\u1ec3n th\u1ecb m\u1ed9t th\u00f4ng b\u00e1o chu\u1ed9c tr\u00ean m\u00e1y t\u00ednh c\u1ee7a n\u1ea1n nh\u00e2n. Th\u00f4ng b\u00e1o n\u00e0y th\u00f4ng b\u00e1o v\u1ec1 vi\u1ec7c d\u1eef li\u1ec7u \u0111\u00e3 b\u1ecb m\u00e3 h\u00f3a v\u00e0 y\u00eau c\u1ea7u n\u1ea1n nh\u00e2n tr\u1ea3 ti\u1ec1n chu\u1ed9c b\u1eb1ng ti\u1ec1n \u0111i\u1ec7n t\u1eed (th\u01b0\u1eddng l\u00e0 Bitcoin) \u0111\u1ec3 nh\u1eadn \u0111\u01b0\u1ee3c kh\u00f3a gi\u1ea3i m\u00e3 v\u00e0 ph\u1ee5c h\u1ed3i d\u1eef li\u1ec7u. <\/p>\n\n\n\n

Qu\u1ea3n l\u00fd ti\u1ebfn tr\u00ecnh tr\u1ea3 ti\u1ec1n chu\u1ed9c: <\/strong>K\u1ebb t\u1ea5n c\u00f4ng s\u1ebd cung c\u1ea5p h\u01b0\u1edbng d\u1eabn v\u00e0 th\u00f4ng tin li\u00ean l\u1ea1c, th\u01b0\u1eddng th\u00f4ng qua \u0111\u1ecba ch\u1ec9 email ho\u1eb7c c\u00e1c d\u1ecbch v\u1ee5 truy\u1ec1n th\u00f4ng m\u00e3 h\u00f3a, \u0111\u1ec3 qu\u1ea3n l\u00fd vi\u1ec7c tr\u1ea3 ti\u1ec1n chu\u1ed9c v\u00e0 gi\u1ea3i m\u00e3 d\u1eef li\u1ec7u sau khi nh\u1eadn ti\u1ec1n chu\u1ed9c.<\/p>\n\n\n\n

4. M\u1ed9t s\u1ed1 c\u00e1ch b\u1ea3o v\u1ec7 kh\u1ecfi t\u1ea5n c\u00f4ng Ryuk Ransomware.<\/strong><\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

\u0110\u1ec3 b\u1ea3o v\u1ec7 h\u1ec7 th\u1ed1ng c\u1ee7a b\u1ea1n tr\u01b0\u1edbc Ryuk Ransomware v\u00e0 c\u00e1c lo\u1ea1i ransomware kh\u00e1c, h\u00e3y th\u1ef1c hi\u1ec7n c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt m\u1ea1nh m\u1ebd. D\u01b0\u1edbi \u0111\u00e2y l\u00e0 m\u1ed9t s\u1ed1 c\u00e1ch b\u1ea3o v\u1ec7 tr\u01b0\u1edbc Ryuk Ransomware:<\/p>\n\n\n\n

C\u1eadp nh\u1eadt h\u1ec7 th\u1ed1ng v\u00e0 ph\u1ea7n m\u1ec1m: <\/strong>\u0110\u1ea3m b\u1ea3o r\u1eb1ng h\u1ec7 th\u1ed1ng v\u00e0 ph\u1ea7n m\u1ec1m tr\u00ean m\u00e1y t\u00ednh v\u00e0 m\u1ea1ng c\u1ee7a b\u1ea1n \u0111\u01b0\u1ee3c c\u1eadp nh\u1eadt \u0111\u1ea7y \u0111\u1ee7. C\u00e1c b\u1ea3n v\u00e1 v\u00e0 b\u1ea3n v\u00e1 b\u1ea3o m\u1eadt th\u01b0\u1eddng ch\u1ee9a c\u00e1c s\u1eeda l\u1ed7i l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt, gi\u00fap ng\u0103n ch\u1eb7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng s\u1eed d\u1ee5ng c\u00e1c l\u1ed7 h\u1ed5ng n\u00e0y.<\/p>\n\n\n\n

S\u1eed d\u1ee5ng ph\u1ea7n m\u1ec1m b\u1ea3o m\u1eadt: <\/strong>C\u00e0i \u0111\u1eb7t ph\u1ea7n m\u1ec1m b\u1ea3o m\u1eadt m\u1ea1nh m\u1ebd v\u00e0 c\u00f3 \u0111\u1ee7 t\u00ednh n\u0103ng \u0111\u1ec3 ng\u0103n ch\u1eb7n ransomware v\u00e0 c\u00e1c lo\u1ea1i m\u00e3 \u0111\u1ed9c kh\u00e1c. Ph\u1ea7n m\u1ec1m b\u1ea3o m\u1eadt n\u00ean c\u00f3 ch\u1ee9c n\u0103ng nh\u1eadn di\u1ec7n v\u00e0 ng\u0103n ch\u1eb7n c\u00e1c ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i tr\u01b0\u1edbc khi ch\u00fang c\u00f3 th\u1ec3 g\u00e2y h\u1ea1i.<\/p>\n\n\n\n

H\u1ea1n ch\u1ebf quy\u1ec1n truy c\u1eadp: <\/strong>Gi\u1edbi h\u1ea1n quy\u1ec1n truy c\u1eadp \u0111\u1ed1i v\u1edbi c\u00e1c t\u00e0i kho\u1ea3n ng\u01b0\u1eddi d\u00f9ng. Kh\u00f4ng cho ph\u00e9p t\u00e0i kho\u1ea3n ng\u01b0\u1eddi d\u00f9ng th\u00f4ng th\u01b0\u1eddng c\u00f3 quy\u1ec1n truy c\u1eadp \u0111\u1ea7y \u0111\u1ee7 v\u00e0o c\u00e1c t\u1ec7p v\u00e0 th\u01b0 m\u1ee5c quan tr\u1ecdng. Thay v\u00e0o \u0111\u00f3, ch\u1ec9 c\u1ea5p quy\u1ec1n truy c\u1eadp c\u1ea7n thi\u1ebft cho t\u1eebng ng\u01b0\u1eddi d\u00f9ng.<\/p>\n\n\n\n

Sao l\u01b0u d\u1eef li\u1ec7u th\u01b0\u1eddng xuy\u00ean: <\/strong>Th\u1ef1c hi\u1ec7n sao l\u01b0u d\u1eef li\u1ec7u th\u01b0\u1eddng xuy\u00ean v\u00e0 l\u01b0u tr\u1eef n\u00f3 \u1edf n\u01a1i an to\u00e0n, n\u1eb1m ngo\u00e0i m\u1ea1ng c\u1ee7a b\u1ea1n. N\u1ebfu h\u1ec7 th\u1ed1ng c\u1ee7a b\u1ea1n b\u1ecb t\u1ea5n c\u00f4ng b\u1edfi Ryuk Ransomware, b\u1ea1n c\u00f3 th\u1ec3 kh\u00f4i ph\u1ee5c d\u1eef li\u1ec7u t\u1eeb sao l\u01b0u m\u00e0 kh\u00f4ng c\u1ea7n tr\u1ea3 ti\u1ec1n chu\u1ed9c.<\/p>\n\n\n\n

Chu\u1ea9n h\u00f3a ch\u00ednh s\u00e1ch an to\u00e0n: <\/strong>X\u00e2y d\u1ef1ng v\u00e0 \u00e1p d\u1ee5ng ch\u00ednh s\u00e1ch an to\u00e0n chi ti\u1ebft cho to\u00e0n b\u1ed9 m\u1ea1ng v\u00e0 h\u1ec7 th\u1ed1ng c\u1ee7a b\u1ea1n. \u0110\u1ea3m b\u1ea3o t\u1ea5t c\u1ea3 nh\u00e2n vi\u00ean \u0111\u1ec1u \u0111\u01b0\u1ee3c \u0111\u00e0o t\u1ea1o v\u1ec1 c\u00e1c m\u1ed1i nguy hi\u1ec3m t\u1eeb c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng ransomware v\u00e0 bi\u1ec7n ph\u00e1p ph\u00f2ng ng\u1eeba.<\/p>\n\n\n\n

Ki\u1ec3m tra v\u00e0 ph\u00e1t hi\u1ec7n m\u00e3 \u0111\u1ed9c:<\/strong> Th\u01b0\u1eddng xuy\u00ean ki\u1ec3m tra h\u1ec7 th\u1ed1ng c\u1ee7a b\u1ea1n \u0111\u1ec3 ph\u00e1t hi\u1ec7n s\u1edbm c\u00e1c m\u00e3 \u0111\u1ed9c tr\u01b0\u1edbc nh\u01b0 TrickBot v\u00e0 Emotet. M\u1ed9t s\u1ed1 ph\u1ea7n m\u1ec1m b\u1ea3o m\u1eadt s\u1ebd cung c\u1ea5p c\u00e1c c\u00f4ng c\u1ee5 ph\u00e1t hi\u1ec7n s\u1edbm m\u00e3 \u0111\u1ed9c n\u00e0y v\u00e0 gi\u00fap ng\u0103n ch\u1eb7n cu\u1ed9c t\u1ea5n c\u00f4ng c\u1ee7a Ryuk Ransomware.<\/p>\n\n\n\n

T\u1ea1o ph\u1ea3n h\u1ed3i kh\u1ea9n c\u1ea5p: <\/strong>Chu\u1ea9n b\u1ecb s\u1eb5n s\u00e0ng k\u1ebf ho\u1ea1ch ph\u1ea3n h\u1ed3i kh\u1ea9n c\u1ea5p \u0111\u1ec3 \u0111\u1ed1i ph\u00f3 v\u1edbi c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng ransomware. \u0110i\u1ec1u n\u00e0y bao g\u1ed3m vi\u1ec7c c\u00e1ch ly h\u1ec7 th\u1ed1ng b\u1ecb nhi\u1ec5m v\u00e0 th\u00f4ng b\u00e1o ngay l\u1eadp t\u1ee9c cho nh\u00f3m b\u1ea3o m\u1eadt \u0111\u1ec3 x\u1eed l\u00fd t\u00ecnh hu\u1ed1ng.<\/p>\n\n\n\n

5. Gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt Sophos Endpoint<\/strong>.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

Sophos Endpoint l\u00e0 m\u1ed9t ph\u1ea7n c\u1ee7a gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt c\u1ee7a Sophos v\u00e0 \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 b\u1ea3o v\u1ec7 h\u1ec7 th\u1ed1ng kh\u1ecfi nhi\u1ec1u m\u1ed1i \u0111e d\u1ecda, bao g\u1ed3m Ryuk Ransomware. D\u01b0\u1edbi \u0111\u00e2y l\u00e0 m\u1ed9t s\u1ed1 c\u00e1ch m\u00e0 Sophos Endpoint b\u1ea3o v\u1ec7 kh\u1ecfi Ryuk Ransomware:<\/p>\n\n\n\n

Ph\u00e1t hi\u1ec7n v\u00e0 ch\u1eb7n m\u00e3 \u0111\u1ed9c (Malware):<\/strong> Sophos Endpoint s\u1eed d\u1ee5ng c\u00e1c c\u00f4ng ngh\u1ec7 ph\u00e1t hi\u1ec7n v\u00e0 ch\u1eb7n m\u00e3 \u0111\u1ed9c tr\u01b0\u1edbc nh\u01b0 m\u00e1y h\u1ecdc (machine learning) v\u00e0 heuristic \u0111\u1ec3 ng\u0103n ch\u1eb7n c\u00e1c m\u00e3 \u0111\u1ed9c tr\u01b0\u1edbc nh\u01b0 TrickBot v\u00e0 Emotet t\u1eeb x\u00e2m nh\u1eadp v\u00e0o h\u1ec7 th\u1ed1ng c\u1ee7a b\u1ea1n. \u0110i\u1ec1u n\u00e0y gi\u00fap ng\u0103n ch\u1eb7n s\u1ef1 lan truy\u1ec1n c\u1ee7a Ryuk Ransomware trong h\u1ec7 th\u1ed1ng.<\/p>\n\n\n\n

Ph\u00e1t hi\u1ec7n v\u00e0 ng\u0103n ch\u1eb7n Ransomware (Ransomware Detection and Blocking): <\/strong>Sophos Endpoint c\u00f3 kh\u1ea3 n\u0103ng ph\u00e1t hi\u1ec7n v\u00e0 ng\u0103n ch\u1eb7n c\u00e1c ho\u1ea1t \u0111\u1ed9ng li\u00ean quan \u0111\u1ebfn ransomware, bao g\u1ed3m vi\u1ec7c m\u00e3 h\u00f3a t\u1eadp tin v\u00e0 t\u1ea1o c\u00e1c th\u00f4ng b\u00e1o chu\u1ed9c. N\u1ebfu ph\u00e1t hi\u1ec7n h\u00e0nh vi t\u01b0\u01a1ng t\u1ef1 Ryuk Ransomware, Sophos Endpoint s\u1ebd ng\u0103n ch\u1eb7n ho\u1ea1t \u0111\u1ed9ng \u0111\u00f3 v\u00e0 b\u00e1o c\u00e1o cho ng\u01b0\u1eddi qu\u1ea3n tr\u1ecb h\u1ec7 th\u1ed1ng.<\/p>\n\n\n\n

H\u1ec7 th\u1ed1ng ph\u00f2ng ch\u1ed1ng x\u00e2m nh\u1eadp (Intrusion Prevention System – IPS): <\/strong>Sophos Endpoint s\u1eed d\u1ee5ng IPS \u0111\u1ec3 ng\u0103n ch\u1eb7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng t\u1eeb xa, bao g\u1ed3m c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng th\u1eed v\u00e0 l\u1ed7i (brute force) v\u00e0o giao th\u1ee9c RDP. \u0110i\u1ec1u n\u00e0y gi\u00fap ng\u0103n ch\u1eb7n Ryuk Ransomware v\u00e0 c\u00e1c m\u00e3 \u0111\u1ed9c kh\u00e1c t\u1eeb vi\u1ec7c x\u00e2m nh\u1eadp v\u00e0o h\u1ec7 th\u1ed1ng qua c\u00e1c l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt.<\/p>\n\n\n\n

B\u1ea3o v\u1ec7 tr\u00ecnh duy\u1ec7t (Web Protection): <\/strong>Sophos Endpoint b\u1ea3o v\u1ec7 tr\u00ecnh duy\u1ec7t c\u1ee7a b\u1ea1n kh\u1ecfi c\u00e1c trang web \u0111\u1ed9c h\u1ea1i v\u00e0 c\u00e1c t\u1ec7p \u0111\u00ednh k\u00e8m \u0111\u1ed9c h\u1ea1i trong email, gi\u00fap ng\u0103n ch\u1eb7n c\u00e1c h\u00ecnh th\u1ee9c ph\u1ed5 bi\u1ebfn c\u1ee7a t\u1ea5n c\u00f4ng ransomware, bao g\u1ed3m c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng spear-phishing.<\/p>\n\n\n\n

Extended Detection and Response – XDR: <\/strong>Sophos Endpoint cung c\u1ea5p ch\u1ee9c n\u0103ng XDR cho ph\u00e9p b\u1ea1n theo d\u00f5i v\u00e0 ph\u00e2n t\u00edch ho\u1ea1t \u0111\u1ed9ng c\u1ee7a h\u1ec7 th\u1ed1ng. \u0110i\u1ec1u n\u00e0y gi\u00fap ph\u00e1t hi\u1ec7n s\u1edbm c\u00e1c ho\u1ea1t \u0111\u1ed9ng b\u1ea5t th\u01b0\u1eddng c\u00f3 th\u1ec3 li\u00ean quan \u0111\u1ebfn Ryuk Ransomware v\u00e0 cho ph\u00e9p b\u1ea1n ph\u1ea3n \u1ee9ng k\u1ecbp th\u1eddi.<\/p>\n\n\n\n

C\u1eadp nh\u1eadt \u0111\u1ecbnh k\u1ef3:<\/strong> Ph\u1ea7n m\u1ec1m Sophos Endpoint \u0111\u01b0\u1ee3c c\u1eadp nh\u1eadt \u0111\u1ecbnh k\u1ef3 \u0111\u1ec3 b\u1ea3o \u0111\u1ea3m t\u00ednh hi\u1ec7u qu\u1ea3 v\u00e0 \u0111\u00e1ng tin c\u1eady trong vi\u1ec7c ng\u0103n ch\u1eb7n c\u00e1c m\u1ed1i \u0111e d\u1ecda m\u1edbi, bao g\u1ed3m c\u00e1c phi\u00ean b\u1ea3n m\u1edbi c\u1ee7a Ryuk Ransomware.<\/p>\n","protected":false},"excerpt":{"rendered":"

1.Ryuk Ransomware l\u00e0 g\u00ec? Ryuk Ransomware l\u00e0 m\u1ed9t lo\u1ea1i ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i (malware) \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 th\u1ef1c hi\u1ec7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng ransomware. N\u00f3 \u0111\u00e3 xu\u1ea5t hi\u1ec7n v\u00e0o n\u0103m 2018 v\u00e0 \u0111\u01b0\u1ee3c bi\u1ebft \u0111\u1ebfn v\u1edbi t\u00ednh chuy\u00ean nghi\u1ec7p v\u00e0 hi\u1ec7u su\u1ea5t cao trong vi\u1ec7c t\u1ea5n c\u00f4ng c\u00e1c t\u1ed5 ch\u1ee9c v\u00e0 c\u00f4ng ty l\u1edbn. […]<\/p>\n","protected":false},"author":12,"featured_media":7073,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_eb_attr":"","ocean_post_layout":"","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"","ocean_second_sidebar":"","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"","ocean_custom_header_template":"","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"","ocean_menu_typo_font_family":"","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"","ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"on","ocean_gallery_id":[],"footnotes":""},"categories":[18,80,17],"tags":[116,165,97],"class_list":["post-7058","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-endpoint","category-huong-dan-tai-lieu","category-bao-mat","tag-malware","tag-ryuk-ransomware","tag-sophos-endpoint","entry","has-media"],"_links":{"self":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts\/7058","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/comments?post=7058"}],"version-history":[{"count":0,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/posts\/7058\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/media\/7073"}],"wp:attachment":[{"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/media?parent=7058"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/categories?post=7058"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vacif.com\/en\/wp-json\/wp\/v2\/tags?post=7058"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}