Computer >> Hướng Dẫn Máy Tính >  >> Kết Nối Mạng >> An Ninh Mạng

RAT (Remote Access Trojan) trong an ninh mạng: Cơ chế, nguy hại và phòng chống

RAT là gì?

RAT (Remote Access Trojan / Remote Administration Tool) là loại mã độc cho phép kẻ tấn công kiểm soát từ xa thiết bị bị nhiễm như thể họ ngồi trước máy. Khác với Remote Admin Tool hợp pháp (TeamViewer, AnyDesk, RDP) – RAT cài lén, ẩn mình, dùng cho mục đích xấu.

Cơ chế hoạt động

  1. Lây lan: Email phishing (attachment .exe/.pdf/.lnk exploit), Drive-by download, Malvertising, Trojanized software (crack, keygen), USB worm, Supply chain compromise.
  2. Cài đặt persistence: Run key Registry, Scheduled Task, Service, WMI Event Subscription, Startup Folder, DLL Hijacking, Bootkit/Rootkit.
  3. C2 (Command & Control): Kết nối ngược (Reverse Shell) về server C2 (HTTP/HTTPS, DNS, TCP raw, Tor, Domain Fronting, Cloud API – GitHub, Telegram, Discord, AWS S3). Sử dụng Domain Generation Algorithm (DGA) hoặc Fast Flux để tránh takedown.
  4. Khả năng (Capabilities):
    • Keylogger, Form grabbing, Clipboard monitoring, Screen capture, Webcam/Mic recording.
    • File manager: Upload/Download/Execute/Delete.
    • Process/Service/Registry manipulation.
    • Credential dumping (LSASS, SAM, Browser, Wi-Fi, VPN, SSH keys).
    • Lateral movement: Pass-the-hash, Pass-the-ticket, SMB/WMI/PSExec, RDP hijack.
    • Botnet: DDoS, Crypto mining, Proxy/VPN exit node, Spam.
    • Anti-analysis: VM detection, Debugger detection, Sandbox evasion, Code obfuscation, Packing.

RAT nổi tiếng

  • Cơ hội/Thương mại (Commodity): njRAT, NanoCore, AsyncRAT, QuasarRAT, Remcos, Agent Tesla, FormBook, LokiBot, NetWire, DarkComet, BlackShades.
  • APT/Custom: PlugX (Korplug), PoisonIvy, Gh0st RAT, Sakula, Derusbi, ShadowPad, Cobalt Strike Beacon (thường dùng cho post-exploit).
  • Mobile: AhMyth, SpyNote, AndroRAT, Hook (Android), Pegasus (iOS – zero-click).

Phát hiện (Detection)

  • Network: IDS/IPS (Suricata/Snort/Zeek rules), NDR (ExtraHop, Corelight, Darktrace), DNS anomaly (DGA, fast flux), TLS fingerprinting (JA3), Proxy log (beaconing interval, user-agent).
  • Endpoint (EDR/XDR): Process tree anomaly, Suspicious parent-child (word.exe → powershell.exe), Memory injection (Cobalt Strike), Scheduled task creation, Registry Run key, WMI persistence, LSASS access, Driver load (kernel RAT).
  • Threat Hunting: MITRE ATT&CK T1219 (Remote Access Software), T1059 (Command Scripting), T1021 (Remote Services), T1003 (Credential Dumping).

Phòng chống & Khắc phục

  1. Prevention: Email security (DMARC, DKIM, SPF, Sandbox), Web proxy/SSL Inspection, Application Control (AppLocker/WDAC), Disable macros, User training (phishing sim), Patch management (browser, Office, OS).
  2. Hardening: LAPS (Local Admin Password Solution), Restrict PowerShell (Constrained Language Mode), Enable AMSI, Block unsigned scripts, Credential Guard, HVCI (VBS).
  3. Detection/Response: EDR/XDR (CrowdStrike, SentinelOne, Defender for Endpoint, Cortex XDR), SIEM correlation, Network segmentation (Zero Trust), Threat Intel feed.
  4. Eradication: Isolate host → Full disk image (forensic) → Rebuild từ gold image (không clean bằng AV – RAT thường có rootkit/persistence sâu). Rotate mọi credential có thể bị đánh cắp.