{"id":288,"date":"2026-10-10T13:21:16","date_gmt":"2026-10-10T06:21:16","guid":{"rendered":"https:\/\/cuudulieu24h.com\/case-study\/?post_type=case_study&p=288"},"modified":"2026-10-12T13:26:39","modified_gmt":"2026-10-12T06:26:39","slug":"cuu-du-lieu-fast-bi-ransomware-peter","status":"publish","type":"case_study","link":"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/","title":{"rendered":"C\u1ee9u d\u1eef li\u1ec7u ph\u1ea7n m\u1ec1m k\u1ebf to\u00e1n Fast b\u1ecb m\u00e3 h\u00f3a ransomware .Peter"},"content":{"rendered":"
T\u00f3m t\u1eaft nhanh:<\/strong> M\u1ed9t doanh nghi\u1ec7p b\u1ecb ransomware .Peter<\/strong> m\u00e3 h\u00f3a s\u1ea1ch c\u01a1 s\u1edf d\u1eef li\u1ec7u k\u1ebf to\u00e1n Fast ch\u1ec9 sau m\u1ed9t \u0111\u00eam. Kh\u00f4ng tr\u1ea3 m\u1ed9t \u0111\u1ed3ng ti\u1ec1n chu\u1ed9c, ch\u00fang t\u00f4i ph\u00e2n t\u00edch v\u00e0 ph\u1ee5c h\u1ed3i l\u1ea1i s\u1ed5 s\u00e1ch \u1edf m\u1ee9c t\u1ec7p. D\u01b0\u1edbi \u0111\u00e2y l\u00e0 ca th\u1eadt \u2014 v\u00e0 c\u00e1ch x\u1eed l\u00fd \u0111\u00fang trong gi\u1edd \u0111\u1ea7u ti\u00ean.<\/div>\n
\n
\n
~97%<\/div>\n
D\u1eef li\u1ec7u ph\u1ee5c h\u1ed3i<\/div>\n<\/div>\n
\n
~240h<\/div>\n
Th\u1eddi gian x\u1eed l\u00fd<\/div>\n<\/div>\n
\n
10+<\/div>\n
N\u0103m s\u1ed5 s\u00e1ch l\u1ea5y l\u1ea1i<\/div>\n<\/div>\n
\n
0\u0111<\/div>\n
Ti\u1ec1n chu\u1ed9c ph\u1ea3i tr\u1ea3<\/div>\n<\/div>\n<\/div>\n

7 gi\u1edd s\u00e1ng. K\u1ebf to\u00e1n m\u1edf ph\u1ea7n m\u1ec1m Fast nh\u01b0 m\u1ecdi ng\u00e0y \u2014 nh\u01b0ng m\u00e0n h\u00ecnh b\u00e1o kh\u00f4ng t\u00ecm th\u1ea5y c\u01a1 s\u1edf d\u1eef li\u1ec7u<\/em>. Ra th\u01b0 m\u1ee5c ki\u1ec3m tra, m\u1ecdi file \u0111\u00e3 b\u1ecb n\u1ed1i th\u00eam \u0111u\u00f4i l\u1ea1 .Peter<\/strong>, v\u00e0 trong t\u1eebng folder l\u00e0 m\u1ed9t l\u1eddi nh\u1eafn \u0111\u00f2i ti\u1ec1n.<\/p>\n

\"ransomware<\/p>\n

Ch\u1ec9 sau m\u1ed9t \u0111\u00eam, to\u00e0n b\u1ed9 s\u1ed5 s\u00e1ch c\u1ee7a c\u1ea3 c\u00f4ng ty b\u1ecb kh\u00f3a s\u1ea1ch. V\u00e0 \u0111i\u1ec1u t\u1ec7 nh\u1ea5t: b\u1ea3n backup \u0111\u1ec3 ngay c\u1ea1nh m\u00e1y ch\u1ee7 c\u0169ng b\u1ecb m\u00e3 h\u00f3a c\u00f9ng.<\/p>\n

\u0110\u00e2y l\u00e0 m\u1ed9t ca ch\u00fang t\u00f4i tr\u1ef1c ti\u1ebfp x\u1eed l\u00fd. D\u01b0\u1edbi \u0111\u00e2y l\u00e0 ch\u00ednh x\u00e1c nh\u1eefng g\u00ec \u0111\u00e3 x\u1ea3y ra \u2014 v\u00e0 v\u00ec sao b\u1ea1n tuy\u1ec7t \u0111\u1ed1i kh\u00f4ng n\u00ean tr\u1ea3 ti\u1ec1n chu\u1ed9c<\/strong>.<\/p>\n

T\u00f3m t\u1eaft nhanh ca x\u1eed l\u00fd<\/h2>\n
\n
\n
Ph\u1ea7n m\u1ec1m<\/div>\n
Fast Accounting (.mdf<\/code>\/.bak<\/code>)<\/div>\n<\/div>\n
\n
\u0110u\u00f4i m\u00e3 h\u00f3a<\/div>\n
[id].[email].Peter<\/div>\n<\/div>\n
\n
H\u1ecd ransomware<\/div>\n
Phobos (d\u00f2ng Dharma)<\/div>\n<\/div>\n
\n
H\u01b0\u1edbng x\u1eed l\u00fd<\/div>\n
Ph\u1ee5c h\u1ed3i \u1edf m\u1ee9c d\u1eef li\u1ec7u g\u1ed1c<\/div>\n<\/div>\n
\n
K\u1ebft qu\u1ea3<\/div>\n
~97% d\u1eef li\u1ec7u k\u1ebf to\u00e1n<\/div>\n<\/div>\n
\n
Th\u1eddi gian<\/div>\n
~240 gi\u1edd l\u00e0m vi\u1ec7c<\/div>\n<\/div>\n<\/div>\n

Khi c\u1ea3 ph\u00f2ng k\u1ebf to\u00e1n \u0111\u1ee9ng h\u00ecnh<\/h2>\n

Kh\u00e1ch l\u00e0 m\u1ed9t doanh nghi\u1ec7p th\u01b0\u01a1ng m\u1ea1i \u2013 ph\u00e2n ph\u1ed1i, ch\u1ea1y to\u00e0n b\u1ed9 nghi\u1ec7p v\u1ee5 tr\u00ean Fast. S\u1ed5 c\u00e1i, c\u00f4ng n\u1ee3, h\u00f3a \u0111\u01a1n \u0111\u1ea7u v\u00e0o \u0111\u1ea7u ra \u2014 t\u1ea5t c\u1ea3 n\u1eb1m trong m\u1ed9t file d\u1eef li\u1ec7u duy nh\u1ea5t tr\u00ean m\u00e1y ch\u1ee7.<\/p>\n

S\u1ef1 c\u1ed1 r\u01a1i \u0111\u00fang c\u1eadn k\u1ef3 quy\u1ebft to\u00e1n. Kh\u00f4ng c\u00f3 d\u1eef li\u1ec7u th\u00ec kh\u00f4ng xu\u1ea5t \u0111\u01b0\u1ee3c b\u00e1o c\u00e1o, kh\u00f4ng \u0111\u1ed1i chi\u1ebfu c\u00f4ng n\u1ee3, l\u01b0\u01a1ng th\u00e1ng c\u0169ng treo. \u00c1p l\u1ef1c kh\u00f4ng n\u1eb1m \u1edf c\u00e1i m\u00e1y \u2014 n\u00f3 n\u1eb1m \u1edf ch\u1ed7 c\u00f4ng vi\u1ec7c c\u1ee7a c\u1ea3 c\u00f4ng ty ph\u1ee5 thu\u1ed9c v\u00e0o file \u0111\u00f3.<\/p>\n

V\u00ec sao m\u1ea5t m\u1ed9t file d\u1eef li\u1ec7u Fast l\u1ea1i nghi\u00eam tr\u1ecdng \u0111\u1ebfn th\u1ebf?<\/h2>\n

Ng\u01b0\u1eddi ngo\u00e0i ngh\u1ec1 hay ngh\u0129 “m\u1ea5t m\u1ed9t file th\u00ec l\u1ea5y file kh\u00e1c ch\u00e9p v\u00e0o”. V\u1edbi Fast th\u00ec kh\u00f4ng \u2014 to\u00e0n b\u1ed9 d\u1eef li\u1ec7u k\u1ebf to\u00e1n nhi\u1ec1u n\u0103m d\u1ed3n v\u00e0o m\u1ed9t c\u01a1 s\u1edf d\u1eef li\u1ec7u duy nh\u1ea5t. M\u1ea5t n\u00f3 l\u00e0 m\u1ea5t tr\u00ed nh\u1edb t\u00e0i ch\u00ednh c\u1ee7a c\u1ea3 doanh nghi\u1ec7p<\/strong>.<\/p>\n

Trong file \u0111\u00f3 c\u00f3: h\u1ec7 th\u1ed1ng t\u00e0i kho\u1ea3n, b\u00fat to\u00e1n t\u1eebng ng\u00e0y, c\u00f4ng n\u1ee3 theo t\u1eebng \u0111\u1ed1i t\u00e1c, t\u1ed3n kho, b\u1ea3ng l\u01b0\u01a1ng, s\u1ed1 li\u1ec7u quy\u1ebft to\u00e1n thu\u1ebf. Khi b\u1ecb kh\u00f3a, k\u1ebf to\u00e1n kh\u00f4ng tr\u1ea3 l\u1eddi n\u1ed5i c\u00e2u h\u1ecfi \u0111\u01a1n gi\u1ea3n nh\u1ea5t: c\u00f4ng ty \u0111ang n\u1ee3 ai, ai \u0111ang n\u1ee3 c\u00f4ng ty.<\/p>\n

V\u00ec sao kh\u00f4ng th\u1ec3 “b\u1ebb kh\u00f3a” .Peter \u2014 nh\u01b0ng v\u1eabn c\u1ee9u \u0111\u01b0\u1ee3c d\u1eef li\u1ec7u?<\/h2>\n

.Peter l\u00e0 m\u1ed9t bi\u1ebfn th\u1ec3 c\u1ee7a h\u1ecd Phobos<\/strong>, th\u01b0\u1eddng \u0111\u1ed9t nh\u1eadp qua Remote Desktop m\u1eadt kh\u1ea9u y\u1ebfu. N\u00f3 m\u00e3 h\u00f3a n\u1ed9i dung t\u1ec7p b\u1eb1ng AES-256 r\u1ed3i kh\u00f3a ch\u00eca b\u1eb1ng RSA \u2014 kh\u00f4ng c\u00f3 kh\u00f3a ri\u00eang c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng th\u00ec kh\u00f4ng ai b\u1ebb \u0111\u01b0\u1ee3c b\u1eb1ng s\u1ee9c m\u00e1y.<\/p>\n

Nh\u01b0ng \u0111\u00e2y l\u00e0 ch\u1ed7 nhi\u1ec1u ng\u01b0\u1eddi hi\u1ec3u nh\u1ea7m: l\u1ea5y l\u1ea1i d\u1eef li\u1ec7u<\/em> v\u00e0 b\u1ebb kh\u00f3a<\/em> l\u00e0 hai chuy\u1ec7n kh\u00e1c nhau. V\u1edbi t\u1ec7p c\u01a1 s\u1edf d\u1eef li\u1ec7u k\u1ebf to\u00e1n, kh\u1ea3 n\u0103ng ph\u1ee5c h\u1ed3i d\u1eef li\u1ec7u<\/a> ph\u1ee5 thu\u1ed9c v\u00e0o k\u1ebft qu\u1ea3 ph\u00e2n t\u00edch t\u1eebng ca \u2014 kh\u00f4ng ph\u1ea3i v\u00e0o vi\u1ec7c gi\u1ea3i m\u00e3.<\/p>\n

Hi\u1ec7n tr\u1ea1ng l\u00fac nh\u1eadn m\u00e1y<\/h2>\n

File d\u1eef li\u1ec7u Fast \u0111\u00e3 b\u1ecb \u0111\u1ed5i t\u00ean ki\u1ec3u FAST.mdf.id-xxxx.[email].Peter<\/code>. R\u1ea3i kh\u1eafp c\u00e1c th\u01b0 m\u1ee5c l\u00e0 file \u0111\u00f2i ti\u1ec1n info.hta<\/code> \/ info.txt<\/code>. Fast d\u0129 nhi\u00ean kh\u00f4ng m\u1edf n\u1ed5i.<\/p>\n

Nguy\u00ean t\u1eafc s\u1ed1 m\u1ed9t, c\u0169ng l\u00e0 ch\u1ed7 nhi\u1ec1u n\u01a1i l\u00e0m h\u1ecfng: kh\u00f4ng \u0111\u1ee5ng v\u00e0o d\u1eef li\u1ec7u g\u1ed1c<\/strong>. M\u1ecdi thao t\u00e1c \u0111\u1ec1u l\u00e0m tr\u00ean b\u1ea3n sao.<\/p>\n

4 d\u1ea5u hi\u1ec7u b\u1ea1n \u0111\u00e3 d\u00ednh Phobos<\/h2>\n
    \n
  • File d\u1eef li\u1ec7u b\u1ecb n\u1ed1i \u0111u\u00f4i l\u1ea1 d\u1ea1ng [id].[email].Peter<\/em>.<\/li>\n
  • File \u0111\u00f2i ti\u1ec1n chu\u1ed9c info.hta<\/em> \/ info.txt<\/em> xu\u1ea5t hi\u1ec7n kh\u1eafp th\u01b0 m\u1ee5c.<\/li>\n
  • Ph\u1ea7n m\u1ec1m k\u1ebf to\u00e1n b\u00e1o l\u1ed7i kh\u00f4ng k\u1ebft n\u1ed1i \u0111\u01b0\u1ee3c c\u01a1 s\u1edf d\u1eef li\u1ec7u.<\/li>\n
  • C\u1ea3 th\u01b0 m\u1ee5c sao l\u01b0u c\u0169ng b\u1ecb m\u00e3 h\u00f3a theo.<\/li>\n<\/ul>\n

    Gi\u1edd \u0111\u1ea7u ti\u00ean quy\u1ebft \u0111\u1ecbnh c\u1ee9u \u0111\u01b0\u1ee3c bao nhi\u00eau<\/h2>\n

    C\u00e0ng thao t\u00e1c sai trong gi\u1edd \u0111\u1ea7u, ph\u1ea7n c\u1ee9u \u0111\u01b0\u1ee3c c\u00e0ng \u00edt. H\u00e3y l\u00e0m \u0111\u00fang 5 b\u01b0\u1edbc n\u00e0y \u2014 v\u00e0 ch\u1ec9 b\u1ea5y nhi\u00eau:<\/p>\n

      \n
    1. R\u00fat m\u1ea1ng ngay<\/strong> (th\u00e1o LAN, t\u1eaft Wi-Fi) \u0111\u1ec3 ch\u1eb7n l\u00e2y lan.<\/li>\n
    2. \u0110\u1eebng t\u1eaft m\u00e1y \u0111\u1ed9t ng\u1ed9t<\/strong>, ch\u1ec9 ng\u1eaft k\u1ebft n\u1ed1i.<\/li>\n
    3. Kh\u00f4ng \u0111\u1ed5i t\u00ean, x\u00f3a hay m\u1edf file b\u1ecb m\u00e3<\/strong>; gi\u1eef nguy\u00ean th\u01b0 t\u1ed1ng ti\u1ec1n l\u00e0m b\u1eb1ng ch\u1ee9ng.<\/li>\n
    4. R\u00fat c\u00e1c \u1ed5 c\u1eafm ngo\u00e0i<\/strong> ch\u01b0a b\u1ecb kh\u00f3a (USB, NAS).<\/li>\n
    5. Ch\u1ee5p \u1ea3nh hi\u1ec7n tr\u1ea1ng v\u00e0 g\u1ecdi chuy\u00ean gia<\/strong> \u2014 \u0111\u1eebng t\u1ef1 th\u1eed c\u00e1ch tr\u00ean m\u1ea1ng.<\/li>\n<\/ol>\n

      \u0110i\u1ec1u ch\u00fang t\u00f4i ti\u1ebfc nh\u1ea5t \u1edf m\u1ed7i ca Phobos kh\u00f4ng ph\u1ea3i ph\u1ea7n b\u1ecb m\u00e3 h\u00f3a \u2014 m\u00e0 l\u00e0 b\u1ea3n backup l\u1ebd ra \u0111\u00e3 c\u1ee9u h\u1ecd, nh\u01b0ng \u0111\u1ec3 ngay c\u1ea1nh m\u00e1y ch\u00ednh n\u00ean b\u1ecb kh\u00f3a c\u00f9ng.<\/p><\/blockquote>\n

      V\u00ec sao m\u00e1y b\u1ecb d\u00ednh?<\/h2>\n
        \n
      • Remote Desktop m\u1edf th\u1eb3ng ra Internet, m\u1eadt kh\u1ea9u y\u1ebfu<\/strong> \u2014 c\u1eeda ch\u00ednh c\u1ee7a Phobos.<\/li>\n
      • Backup \u0111\u1ec3 chung m\u00e1y, chung m\u1ea1ng<\/strong> \u2014 khi m\u00e3 \u0111\u1ed9c ch\u1ea1y, n\u00f3 kh\u00f3a lu\u00f4n c\u1ea3 b\u1ea3n d\u1ef1 ph\u00f2ng.<\/li>\n
      • Di\u1ec7t virus b\u1ecb t\u1eaft ho\u1eb7c kh\u00f4ng c\u1eadp nh\u1eadt<\/strong>, n\u00ean m\u00e3 \u0111\u1ed9c ch\u1ea1y kh\u00f4ng ai c\u1ea3n.<\/li>\n<\/ul>\n

        Truy v\u1ebft: k\u1ebb t\u1ea5n c\u00f4ng v\u00e0o b\u1eb1ng \u0111\u01b0\u1eddng n\u00e0o?<\/h2>\n

        \"T\u1ec7p<\/p>\n

        C\u1ee9u \u0111\u01b0\u1ee3c d\u1eef li\u1ec7u m\u1edbi xong m\u1ed9t n\u1eeda. N\u1eeda c\u00f2n l\u1ea1i l\u00e0 t\u00ecm ra \u0111\u01b0\u1eddng v\u00e0o<\/strong> \u0111\u1ec3 b\u1ecbt l\u1ea1i \u2014 kh\u00f4i ph\u1ee5c xong m\u00e0 \u0111\u1ec3 h\u1edf c\u1eeda th\u00ec v\u00e0i tu\u1ea7n sau b\u1ecb l\u1ea1i, th\u01b0\u1eddng n\u1eb7ng h\u01a1n.<\/p>\n

        D\u00f2ng th\u1eddi gian d\u1ef1ng l\u1ea1i \u0111\u01b0\u1ee3c<\/strong> (m\u1ed1c gi\u1edd minh h\u1ecda):<\/p>\n

        \n

        ~02:14<\/strong> \u2014 H\u00e0ng lo\u1ea1t l\u1ea7n \u0111\u0103ng nh\u1eadp RDP th\u1ea5t b\u1ea1i t\u1eeb m\u1ed9t IP l\u1ea1.<\/p>\n

        ~02:36<\/strong> \u2014 M\u1ed9t l\u1ea7n \u0111\u0103ng nh\u1eadp th\u00e0nh c\u00f4ng<\/em> b\u1eb1ng t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb.<\/p>\n

        ~02:41<\/strong> \u2014 Windows Defender b\u1ecb t\u1eaft, b\u1ea3n sao d\u1ef1 ph\u00f2ng b\u1ecb x\u00f3a.<\/p>\n

        ~03:05<\/strong> \u2014 B\u1eaft \u0111\u1ea7u m\u00e3 h\u00f3a, file d\u1eef li\u1ec7u b\u1ecb n\u1ed1i \u0111u\u00f4i .Peter.<\/p>\n

        ~08:10<\/strong> \u2014 Nh\u00e2n vi\u00ean \u0111\u1ebfn l\u00e0m, ph\u00e1t hi\u1ec7n Fast kh\u00f4ng m\u1edf \u0111\u01b0\u1ee3c.<\/p>\n<\/div>\n

        Cu\u1ed9c t\u1ea5n c\u00f4ng di\u1ec5n ra l\u00fac 2\u20133 gi\u1edd s\u00e1ng, khi kh\u00f4ng ai ng\u1ed3i m\u00e1y. Ph\u00f2ng th\u1ee7 kh\u00f4ng th\u1ec3 tr\u00f4ng v\u00e0o vi\u1ec7c “c\u00f3 ng\u01b0\u1eddi canh”.<\/p>\n

        3 sai l\u1ea7m khi\u1ebfn m\u1ea5t tr\u1eafng d\u1eef li\u1ec7u<\/h2>\n
        \n

        \u0110\u1eebng m\u1eafc 3 sai l\u1ea7m n\u00e0y:<\/strong><\/p>\n

        \u0110\u1eebng tr\u1ea3 ti\u1ec1n chu\u1ed9c. \u0110\u1eebng t\u1ea3i “tool gi\u1ea3i m\u00e3” tr\u00f4i n\u1ed5i. \u0110\u1eebng c\u00e0i l\u1ea1i ph\u1ea7n m\u1ec1m hay format \u0111\u00e8 l\u00ean \u1ed5 \u0111\u0129a \u2014 m\u1ed7i thao t\u00e1c sai \u0111\u1ec1u c\u00f3 th\u1ec3 x\u00f3a v\u0129nh vi\u1ec5n<\/strong> ph\u1ea7n d\u1eef li\u1ec7u \u0111\u00e1ng ra c\u00f2n c\u1ee9u \u0111\u01b0\u1ee3c.<\/p>\n<\/div>\n

        Tr\u1ea3 ti\u1ec1n chu\u1ed9c hay thu\u00ea c\u1ee9u d\u1eef li\u1ec7u?<\/h2>\n

        \u0110\u1eb7t hai l\u1ef1a ch\u1ecdn c\u1ea1nh nhau cho r\u00f5:<\/p>\n\n\n\n\n\n\n\n
        Ti\u00eau ch\u00ed<\/th>\nTr\u1ea3 ti\u1ec1n chu\u1ed9c<\/th>\nThu\u00ea c\u1ee9u d\u1eef li\u1ec7u<\/th>\n<\/tr>\n
        Ch\u1eafc ch\u1eafn l\u1ea5y l\u1ea1i?<\/td>\nKh\u00f4ng \u2014 tr\u1ea3 r\u1ed3i m\u1ea5t tr\u1eafng l\u00e0 c\u00f3 th\u1eadt<\/td>\n\u0110\u00e1nh gi\u00e1 \u0111\u01b0\u1ee3c tr\u01b0\u1edbc, c\u00f3 b\u1eb1ng ch\u1ee9ng<\/td>\n<\/tr>\n
        Chi ph\u00ed<\/td>\nTheo y\u00eau s\u00e1ch k\u1ebb t\u1ea5n c\u00f4ng, d\u1ec5 b\u1ecb v\u00f2i th\u00eam<\/td>\nB\u00e1o gi\u00e1 r\u00f5 theo m\u1ee9c \u0111\u1ed9 s\u1ef1 c\u1ed1<\/td>\n<\/tr>\n
        R\u1ee7i ro k\u00e8m theo<\/td>\nL\u1ed9 m\u00ecnh l\u00e0 con m\u1ed3i d\u1ec5<\/td>\nKh\u00f4ng ph\u00e1t sinh r\u1ee7i ro m\u1edbi<\/td>\n<\/tr>\n
        V\u1ec1 l\u00e2u d\u00e0i<\/td>\nNu\u00f4i ch\u00ednh k\u1ebb t\u1ea5n c\u00f4ng m\u00ecnh<\/td>\nK\u00e8m truy v\u1ebft, b\u1ecbt l\u1ed7 h\u1ed5ng<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        Ch\u00fang t\u00f4i ch\u01b0a bao gi\u1edd khuy\u00ean kh\u00e1ch tr\u1ea3 ti\u1ec1n \u2014 \u0111\u00f3 l\u00e0 canh b\u1ea1c m\u00e0 ph\u1ea7n thua nghi\u00eang h\u1eb3n v\u1ec1 ph\u00eda n\u1ea1n nh\u00e2n.<\/p>\n

        Nh\u1eefng d\u1eef li\u1ec7u Fast n\u00e0o c\u00f3 th\u1ec3 l\u1ea5y l\u1ea1i?<\/h2>\n

        T\u00f9y m\u1ee9c \u0111\u1ed9 m\u00e3 h\u00f3a t\u1eebng ca, nh\u01b0ng ph\u1ea7n kh\u00e1ch quan t\u00e2m nh\u1ea5t th\u01b0\u1eddng n\u1eb1m trong nh\u00f3m l\u1ea5y l\u1ea1i \u0111\u01b0\u1ee3c:<\/p>\n

          \n
        • H\u1ec7 th\u1ed1ng t\u00e0i kho\u1ea3n v\u00e0 to\u00e0n b\u1ed9 b\u00fat to\u00e1n<\/strong> theo t\u1eebng k\u1ef3.<\/li>\n
        • C\u00f4ng n\u1ee3<\/strong> ph\u1ea3i thu, ph\u1ea3i tr\u1ea3 theo t\u1eebng \u0111\u1ed1i t\u00e1c.<\/li>\n
        • D\u1eef li\u1ec7u h\u00f3a \u0111\u01a1n<\/strong> \u0111\u1ea7u v\u00e0o, \u0111\u1ea7u ra.<\/li>\n
        • T\u1ed3n kho, b\u1ea3ng l\u01b0\u01a1ng, s\u1ed1 li\u1ec7u ph\u1ee5c v\u1ee5 quy\u1ebft to\u00e1n thu\u1ebf<\/strong>.<\/li>\n<\/ul>\n

          K\u1ebft qu\u1ea3 & b\u1eb1ng ch\u1ee9ng b\u00e0n giao<\/h2>\n

          M\u1ed7i ca \u0111\u1ec1u k\u00e8m b\u1eb1ng ch\u1ee9ng \u0111\u1ec3 kh\u00e1ch \u0111\u1ed1i chi\u1ebfu: \u1ea3nh file b\u1ecb m\u00e3 h\u00f3a v\u00e0 th\u01b0 t\u1ed1ng ti\u1ec1n l\u00fac ti\u1ebfp nh\u1eadn, \u1ea3nh d\u1eef li\u1ec7u k\u1ebf to\u00e1n m\u1edf l\u1ea1i \u0111\u01b0\u1ee3c sau ph\u1ee5c h\u1ed3i, v\u00e0 bi\u00ean b\u1ea3n b\u00e0n giao k\u00e8m s\u1ed1 li\u1ec7u kh\u00f4i ph\u1ee5c c\u1ee5 th\u1ec3.<\/p>\n

          Ca n\u00e0y: l\u1ea5y l\u1ea1i ~97% d\u1eef li\u1ec7u<\/strong>, g\u1ed3m to\u00e0n b\u1ed9 s\u1ed5 c\u00e1i, c\u00f4ng n\u1ee3 v\u00e0 h\u00f3a \u0111\u01a1n, ho\u00e0n t\u1ea5t trong ~240 gi\u1edd<\/strong>.<\/div>\n

          N\u00f3i th\u1eadt v\u1ec1 ph\u1ea7n kh\u00f4ng c\u1ee9u \u0111\u01b0\u1ee3c<\/h2>\n

          V\u1edbi ransomware, hi\u1ebfm khi l\u1ea5y l\u1ea1i tr\u1ecdn v\u1eb9n 100%. Ph\u1ea7n r\u01a1i \u0111\u00fang v\u00f9ng b\u1ecb m\u00e3 h\u00f3a \u1edf v\u1ecb tr\u00ed quan tr\u1ecdng th\u00ec ph\u1ea3i ch\u1ea5p nh\u1eadn m\u1ea5t. Ch\u00fang t\u00f4i n\u00f3i tr\u01b0\u1edbc \u0111i\u1ec1u \u0111\u00f3 ngay t\u1eeb kh\u1ea3o s\u00e1t \u2014 m\u1ed9t con s\u1ed1 th\u1eadt \u0111\u00e1ng tin h\u01a1n m\u1ed9t l\u1eddi h\u1ee9a \u0111\u1eb9p.<\/p>\n

          Sau khi kh\u00f4i ph\u1ee5c: nh\u1eefng ng\u00e0y \u0111\u1ea7u quan tr\u1ecdng nh\u1ea5t<\/h2>\n

          L\u1ea5y l\u1ea1i d\u1eef li\u1ec7u kh\u00f4ng c\u00f3 ngh\u0129a l\u00e0 xong. Kh\u00f4i ph\u1ee5c m\u00e0 \u0111\u1ec3 nguy\u00ean l\u1ed7 h\u1ed5ng th\u00ec ch\u1ec9 l\u00e0 d\u1eddi ng\u00e0y b\u1ecb l\u1ea1i:<\/p>\n

            \n
          1. \u0110\u1ed5i to\u00e0n b\u1ed9 m\u1eadt kh\u1ea9u<\/strong> \u2014 Windows, qu\u1ea3n tr\u1ecb, ph\u1ea7n m\u1ec1m, email.<\/li>\n
          2. \u0110\u00f3ng Remote Desktop ra Internet<\/strong>, d\u00f9ng VPN + x\u00e1c th\u1ef1c hai l\u1edbp.<\/li>\n
          3. G\u1ee1 t\u00e0i kho\u1ea3n l\u1ea1<\/strong> m\u00e0 b\u01b0\u1edbc truy v\u1ebft ph\u00e1t hi\u1ec7n.<\/li>\n
          4. C\u1eadp nh\u1eadt Windows, b\u1eadt di\u1ec7t virus\/EDR<\/strong> tr\u00ean m\u1ecdi m\u00e1y.<\/li>\n
          5. D\u1ef1ng l\u1ea1i backup 3-2-1<\/strong> v\u1edbi m\u1ed9t b\u1ea3n t\u00e1ch r\u1eddi kh\u1ecfi h\u1ec7 th\u1ed1ng.<\/li>\n<\/ol>\n

            Ba hi\u1ec3u l\u1ea7m khi\u1ebfn doanh nghi\u1ec7p tr\u1ea3 gi\u00e1<\/h2>\n

            “Tr\u1ea3 ti\u1ec1n l\u00e0 ch\u1eafc l\u1ea5y l\u1ea1i \u0111\u01b0\u1ee3c.”<\/strong> Kh\u00f4ng \u2014 nhi\u1ec1u n\u1ea1n nh\u00e2n tr\u1ea3 xong v\u1eabn kh\u00f4ng nh\u1eadn \u0111\u01b0\u1ee3c kh\u00f3a.<\/p>\n

            “C\u00f3 di\u1ec7t virus l\u00e0 an to\u00e0n.”<\/strong> Phobos v\u00e0o tay qua RDP r\u1ed3i t\u1eaft lu\u00f4n di\u1ec7t virus.<\/p>\n

            “C\u00f4ng ty nh\u1ecf ai th\u00e8m t\u1ea5n c\u00f4ng.”<\/strong> Ng\u01b0\u1ee3c l\u1ea1i \u2014 doanh nghi\u1ec7p nh\u1ecf l\u00e0 m\u1ee5c ti\u00eau \u01b0a th\u00edch v\u00ec s\u01a1 h\u1edf h\u01a1n.<\/p>\n

            C\u00e2u h\u1ecfi th\u01b0\u1eddng g\u1eb7p<\/h2>\n

            File .Peter c\u00f3 gi\u1ea3i m\u00e3 \u0111\u01b0\u1ee3c kh\u00f4ng?<\/strong> Ph\u1ea7n \u0111\u00e3 b\u1ecb AES\/RSA kh\u00f3a th\u00ec kh\u00f4ng, nh\u01b0ng nhi\u1ec1u ca v\u1eabn ph\u1ee5c h\u1ed3i \u0111\u01b0\u1ee3c ph\u1ea7n l\u1edbn s\u1ed5 s\u00e1ch k\u1ebf to\u00e1n.<\/p>\n

            Tr\u1ea3 ti\u1ec1n chu\u1ed9c c\u00f3 l\u1ea5y l\u1ea1i \u0111\u01b0\u1ee3c kh\u00f4ng?<\/strong> Kh\u00f4ng c\u00f3 g\u00ec ch\u1eafc \u2014 nhi\u1ec1u ng\u01b0\u1eddi tr\u1ea3 xong v\u1eabn m\u1ea5t tr\u1eafng, l\u1ea1i c\u00f2n b\u1ecb \u0111\u00e1nh d\u1ea5u l\u00e0 con m\u1ed3i d\u1ec5.<\/p>\n

            B\u1ecb .Peter r\u1ed3i c\u00f3 b\u1ecb l\u1ea1i kh\u00f4ng?<\/strong> C\u00f3, n\u1ebfu kh\u00f4ng b\u1ecbt l\u1ed7 h\u1ed5ng: \u0111\u1ed5i m\u1eadt kh\u1ea9u, \u0111\u00f3ng Remote Desktop ra Internet, b\u1eadt x\u00e1c th\u1ef1c hai l\u1edbp.<\/p>\n

            \n

            D\u1eef li\u1ec7u k\u1ebf to\u00e1n c\u1ee7a b\u1ea1n \u0111ang g\u1eb7p nguy?<\/strong>\u0110\u1eebng tr\u1ea3 ti\u1ec1n chu\u1ed9c \u2014 gi\u1eef nguy\u00ean hi\u1ec7n tr\u1ea1ng v\u00e0 g\u1ecdi chuy\u00ean gia ngay.<\/span><\/p>\n

            0917 756 775 \u00a0\u00b7\u00a0 0888 711 775<\/div>\n
            Kh\u1ea3o s\u00e1t mi\u1ec5n ph\u00ed \u00b7 H\u1ed7 tr\u1ee3 24\/7<\/div>\n<\/div>\n","protected":false},"featured_media":290,"template":"","case_category":[4],"class_list":["post-288","case_study","type-case_study","status-publish","has-post-thumbnail","hentry","case_category-server"],"acf":[],"yoast_head":"\nC\u1ee9u d\u1eef li\u1ec7u ph\u1ea7n m\u1ec1m k\u1ebf to\u00e1n Fast b\u1ecb m\u00e3 h\u00f3a ransomware .Peter - Case Study<\/title>\n<meta name=\"description\" content=\"C\u1ee9u d\u1eef li\u1ec7u ph\u1ea7n m\u1ec1m k\u1ebf to\u00e1n Fast b\u1ecb ransomware .Peter: ca th\u1eadt, c\u00e1ch ph\u1ee5c h\u1ed3i s\u1ed5 s\u00e1ch m\u00e0 kh\u00f4ng tr\u1ea3 ti\u1ec1n chu\u1ed9c. Hotline 0917 756 775.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/\" \/>\n<meta property=\"og:locale\" content=\"vi_VN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"C\u1ee9u d\u1eef li\u1ec7u ph\u1ea7n m\u1ec1m k\u1ebf to\u00e1n Fast b\u1ecb m\u00e3 h\u00f3a ransomware .Peter - Case Study\" \/>\n<meta property=\"og:description\" content=\"C\u1ee9u d\u1eef li\u1ec7u ph\u1ea7n m\u1ec1m k\u1ebf to\u00e1n Fast b\u1ecb ransomware .Peter: ca th\u1eadt, c\u00e1ch ph\u1ee5c h\u1ed3i s\u1ed5 s\u00e1ch m\u00e0 kh\u00f4ng tr\u1ea3 ti\u1ec1n chu\u1ed9c. Hotline 0917 756 775.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/\" \/>\n<meta property=\"og:site_name\" content=\"Case Study\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-12T06:26:39+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cuudulieu24h.com\/case-study\/wp-content\/uploads\/2026\/10\/e02-ransom-note.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1640\" \/>\n\t<meta property=\"og:image:height\" content=\"1200\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u01af\u1edbc t\u00ednh th\u1eddi gian \u0111\u1ecdc\" \/>\n\t<meta name=\"twitter:data1\" content=\"10 ph\u00fat\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/\",\"url\":\"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/\",\"name\":\"C\u1ee9u d\u1eef li\u1ec7u ph\u1ea7n m\u1ec1m k\u1ebf to\u00e1n Fast b\u1ecb m\u00e3 h\u00f3a ransomware .Peter - Case Study\",\"isPartOf\":{\"@id\":\"https:\/\/cuudulieu24h.com\/case-study\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cuudulieu24h.com\/case-study\/wp-content\/uploads\/2026\/10\/e02-ransom-note.png\",\"datePublished\":\"2026-10-10T06:21:16+00:00\",\"dateModified\":\"2026-10-12T06:26:39+00:00\",\"description\":\"C\u1ee9u d\u1eef li\u1ec7u ph\u1ea7n m\u1ec1m k\u1ebf to\u00e1n Fast b\u1ecb ransomware .Peter: ca th\u1eadt, c\u00e1ch ph\u1ee5c h\u1ed3i s\u1ed5 s\u00e1ch m\u00e0 kh\u00f4ng tr\u1ea3 ti\u1ec1n chu\u1ed9c. Hotline 0917 756 775.\",\"breadcrumb\":{\"@id\":\"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/#breadcrumb\"},\"inLanguage\":\"vi\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"vi\",\"@id\":\"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/#primaryimage\",\"url\":\"https:\/\/cuudulieu24h.com\/case-study\/wp-content\/uploads\/2026\/10\/e02-ransom-note.png\",\"contentUrl\":\"https:\/\/cuudulieu24h.com\/case-study\/wp-content\/uploads\/2026\/10\/e02-ransom-note.png\",\"width\":1640,\"height\":1200,\"caption\":\"ransomware notes\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Case Study\",\"item\":\"https:\/\/cuudulieu24h.com\/case-study\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SERVER\",\"item\":\"https:\/\/cuudulieu24h.com\/case-study\/server\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"C\u1ee9u d\u1eef li\u1ec7u ph\u1ea7n m\u1ec1m k\u1ebf to\u00e1n Fast b\u1ecb m\u00e3 h\u00f3a ransomware .Peter\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cuudulieu24h.com\/case-study\/#website\",\"url\":\"https:\/\/cuudulieu24h.com\/case-study\/\",\"name\":\"Case Study\",\"description\":\"Case Study\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cuudulieu24h.com\/case-study\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"vi\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"C\u1ee9u d\u1eef li\u1ec7u ph\u1ea7n m\u1ec1m k\u1ebf to\u00e1n Fast b\u1ecb m\u00e3 h\u00f3a ransomware .Peter - Case Study","description":"C\u1ee9u d\u1eef li\u1ec7u ph\u1ea7n m\u1ec1m k\u1ebf to\u00e1n Fast b\u1ecb ransomware .Peter: ca th\u1eadt, c\u00e1ch ph\u1ee5c h\u1ed3i s\u1ed5 s\u00e1ch m\u00e0 kh\u00f4ng tr\u1ea3 ti\u1ec1n chu\u1ed9c. Hotline 0917 756 775.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/","og_locale":"vi_VN","og_type":"article","og_title":"C\u1ee9u d\u1eef li\u1ec7u ph\u1ea7n m\u1ec1m k\u1ebf to\u00e1n Fast b\u1ecb m\u00e3 h\u00f3a ransomware .Peter - Case Study","og_description":"C\u1ee9u d\u1eef li\u1ec7u ph\u1ea7n m\u1ec1m k\u1ebf to\u00e1n Fast b\u1ecb ransomware .Peter: ca th\u1eadt, c\u00e1ch ph\u1ee5c h\u1ed3i s\u1ed5 s\u00e1ch m\u00e0 kh\u00f4ng tr\u1ea3 ti\u1ec1n chu\u1ed9c. Hotline 0917 756 775.","og_url":"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/","og_site_name":"Case Study","article_modified_time":"2026-10-12T06:26:39+00:00","og_image":[{"width":1640,"height":1200,"url":"https:\/\/cuudulieu24h.com\/case-study\/wp-content\/uploads\/2026\/10\/e02-ransom-note.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"\u01af\u1edbc t\u00ednh th\u1eddi gian \u0111\u1ecdc":"10 ph\u00fat"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/","url":"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/","name":"C\u1ee9u d\u1eef li\u1ec7u ph\u1ea7n m\u1ec1m k\u1ebf to\u00e1n Fast b\u1ecb m\u00e3 h\u00f3a ransomware .Peter - Case Study","isPartOf":{"@id":"https:\/\/cuudulieu24h.com\/case-study\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/#primaryimage"},"image":{"@id":"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/#primaryimage"},"thumbnailUrl":"https:\/\/cuudulieu24h.com\/case-study\/wp-content\/uploads\/2026\/10\/e02-ransom-note.png","datePublished":"2026-10-10T06:21:16+00:00","dateModified":"2026-10-12T06:26:39+00:00","description":"C\u1ee9u d\u1eef li\u1ec7u ph\u1ea7n m\u1ec1m k\u1ebf to\u00e1n Fast b\u1ecb ransomware .Peter: ca th\u1eadt, c\u00e1ch ph\u1ee5c h\u1ed3i s\u1ed5 s\u00e1ch m\u00e0 kh\u00f4ng tr\u1ea3 ti\u1ec1n chu\u1ed9c. Hotline 0917 756 775.","breadcrumb":{"@id":"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/#breadcrumb"},"inLanguage":"vi","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/"]}]},{"@type":"ImageObject","inLanguage":"vi","@id":"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/#primaryimage","url":"https:\/\/cuudulieu24h.com\/case-study\/wp-content\/uploads\/2026\/10\/e02-ransom-note.png","contentUrl":"https:\/\/cuudulieu24h.com\/case-study\/wp-content\/uploads\/2026\/10\/e02-ransom-note.png","width":1640,"height":1200,"caption":"ransomware notes"},{"@type":"BreadcrumbList","@id":"https:\/\/cuudulieu24h.com\/case-study\/cuu-du-lieu-fast-bi-ransomware-peter\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Case Study","item":"https:\/\/cuudulieu24h.com\/case-study\/"},{"@type":"ListItem","position":2,"name":"SERVER","item":"https:\/\/cuudulieu24h.com\/case-study\/server\/"},{"@type":"ListItem","position":3,"name":"C\u1ee9u d\u1eef li\u1ec7u ph\u1ea7n m\u1ec1m k\u1ebf to\u00e1n Fast b\u1ecb m\u00e3 h\u00f3a ransomware .Peter"}]},{"@type":"WebSite","@id":"https:\/\/cuudulieu24h.com\/case-study\/#website","url":"https:\/\/cuudulieu24h.com\/case-study\/","name":"Case Study","description":"Case Study","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cuudulieu24h.com\/case-study\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"vi"}]}},"_links":{"self":[{"href":"https:\/\/cuudulieu24h.com\/case-study\/wp-json\/wp\/v2\/case_study\/288","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cuudulieu24h.com\/case-study\/wp-json\/wp\/v2\/case_study"}],"about":[{"href":"https:\/\/cuudulieu24h.com\/case-study\/wp-json\/wp\/v2\/types\/case_study"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cuudulieu24h.com\/case-study\/wp-json\/wp\/v2\/media\/290"}],"wp:attachment":[{"href":"https:\/\/cuudulieu24h.com\/case-study\/wp-json\/wp\/v2\/media?parent=288"}],"wp:term":[{"taxonomy":"case_category","embeddable":true,"href":"https:\/\/cuudulieu24h.com\/case-study\/wp-json\/wp\/v2\/case_category?post=288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}