{"id":7064,"date":"2024-09-11T15:36:07","date_gmt":"2024-09-11T12:36:07","guid":{"rendered":"https:\/\/yalovasondakika.com.tr\/?p=7064"},"modified":"2024-09-11T15:36:07","modified_gmt":"2024-09-11T12:36:07","slug":"kobilere-fidye-tuzagi","status":"publish","type":"post","link":"https:\/\/yalovasondakika.com.tr\/index.php\/2024\/09\/11\/kobilere-fidye-tuzagi\/","title":{"rendered":"KOB\u0130’lere fidye tuza\u011f\u0131"},"content":{"rendered":"

dit k\u00fcmesinin son faaliyetlerini haritaland\u0131rarak yeni ScRansom fidye yaz\u0131l\u0131m\u0131n\u0131n konu\u015fland\u0131r\u0131ld\u0131\u011f\u0131n\u0131 belgeledi ve \u00f6teki esasl\u0131 fidye yaz\u0131l\u0131m\u0131 \u00e7eteleriyle kontaklar\u0131n\u0131 ke\u015ffetti. CosmicBeetle, bilhassa Avrupa ve Asya’daki k\u00fc\u00e7\u00fck ve orta \u00f6l\u00e7ekli i\u015fletmelere (KOB\u0130’ler) fidye yaz\u0131l\u0131m\u0131 yay\u0131yor. Siber hatal\u0131lar\u0131n T\u00fcrk\u00e7e fidye notu ve mail adresleri kullanmalar\u0131 bu ziyanl\u0131 yaz\u0131l\u0131m\u0131n arkas\u0131nda bir T\u00fcrk m\u00fc var ku\u015fkusu uyand\u0131rd\u0131.\u00a0<\/strong><\/p>\n

\u00a0<\/p>\n

ESET Research, tehdit akt\u00f6r\u00fcn\u00fcn s\u0131zd\u0131r\u0131lan LockBit olu\u015fturucusunu kulland\u0131\u011f\u0131n\u0131 ve LockBit’in fidye yaz\u0131l\u0131m\u0131 prestijinden yararlanmaya \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 g\u00f6zlemledi. LockBit’in yan\u0131 s\u0131ra ESET, CosmicBeetle’\u0131n muhtemelen Mart 2024’ten bu yana etkin olan ve s\u00fcratle artan faaliyetleriyle yeni bir fidye yaz\u0131l\u0131m\u0131 \u00e7etesi olan hizmet olarak fidye yaz\u0131l\u0131m\u0131 akt\u00f6r\u00fc RansomHub’\u0131n yeni bir i\u015ftiraki oldu\u011funa inan\u0131yor.\u00a0<\/p>\n

\u00a0<\/p>\n

CosmicBeetle’\u0131n son faaliyetlerini tahlil eden ESET ara\u015ft\u0131rmac\u0131s\u0131 Jakub Sou\u010dek, “Muhtemelen s\u0131f\u0131rdan \u00f6zel fidye yaz\u0131l\u0131m\u0131 yazman\u0131n getirdi\u011fi zorluklar nedeniyle CosmicBeetle temel fidye yaz\u0131l\u0131m\u0131ndaki problemleri maskelemek ve kurbanlar\u0131n \u00f6deme yapma baht\u0131n\u0131 art\u0131rmak i\u00e7in LockBit’in prestijinden yararlanmaya \u00e7al\u0131\u015ft\u0131\u201c dedi.” Buna ek olarak, yak\u0131n vakitte ScRansom ve RansomHub y\u00fcklerinin yaln\u0131zca bir hafta ortayla birebir makineye yerle\u015ftirildi\u011fini g\u00f6zlemledik. RansomHub’\u0131n bu halde \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131, ESET telemetrisinde g\u00f6rd\u00fc\u011f\u00fcm\u00fcz tipik hadiselere k\u0131yasla \u00e7ok s\u0131ra d\u0131\u015f\u0131yd\u0131 lakin CosmicBeetle’\u0131n \u00e7al\u0131\u015fma yoluna epeyce benziyordu. RansomHub’\u0131n halka a\u00e7\u0131k s\u0131z\u0131nt\u0131lar\u0131 olmad\u0131\u011f\u0131ndan bu durum, CosmicBeetle’\u0131n onlar\u0131n yeni bir i\u015ftiraki olabilece\u011fine inanmam\u0131za yol a\u00e7\u0131yor” diye ekledi.<\/p>\n

\u00a0<\/p>\n

Sald\u0131r\u0131lar\u0131n ard\u0131nda bir T\u00fcrk olabilir mi?<\/strong><\/p>\n

CosmicBeetle, muhtemelen son birka\u00e7 y\u0131l\u0131n en berbat \u015f\u00f6hretli fidye yaz\u0131l\u0131m\u0131 \u00e7etesi olan ve k\u0131sa m\u00fcddet evvel \u00e7\u00f6kertilen LockBit’i taklit ederek bu problemleri k\u0131smen ele almaya ya da daha do\u011frusu gizlemeye \u00e7al\u0131\u015ft\u0131. LockBit ismini kullanarak kurbanlar\u0131 \u00f6deme yapmaya daha kolay ikna etmeyi umuyordu. CosmicBeetle ayr\u0131yeten T\u00fcrk\u00e7e fidye notu i\u00e7eren \u00f6zel \u00f6rneklerini olu\u015fturmak i\u00e7in s\u0131zd\u0131r\u0131lan LockBit Black builder’\u0131 kulland\u0131. Zaufana Trzencia Strona analistleri yak\u0131n vakitte CosmicBeetle hakk\u0131nda bir blog yaz\u0131s\u0131 yay\u0131mlayarak CosmicBeetle’\u0131 ger\u00e7ek bir \u015fahsa – bir T\u00fcrk yaz\u0131l\u0131m geli\u015ftiricisine – atfetmi\u015f olsalar da ESET ara\u015ft\u0131rmac\u0131lar\u0131 bu atf\u0131n ger\u00e7ek oldu\u011funu d\u00fc\u015f\u00fcnm\u00fcyor.<\/p>\n

\u00a0<\/p>\n

Sald\u0131r\u0131dan etkilenen kesimler: \u00dcretim, ila\u00e7, hukuk, e\u011fitim, s\u0131hhat, teknoloji, konaklama-e\u011flence, finansal hizmetler ve lokal y\u00f6netimler<\/strong><\/p>\n

CosmicBeetle maksatlar\u0131na sald\u0131rmak i\u00e7in \u00e7oklukla kaba kuvvet prosed\u00fcrlerini benimser. Bunun yan\u0131 s\u0131ra bilinen \u00e7e\u015fitli g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 da berbata kullan\u0131r. D\u00fcnyan\u0131n d\u00f6rt bir yan\u0131ndaki her t\u00fcrl\u00fc dikey kesimden k\u00fc\u00e7\u00fck ve orta \u00f6l\u00e7ekli i\u015fletmeler, bu tehdit akt\u00f6r\u00fcn\u00fcn en yayg\u0131n kurbanlar\u0131d\u0131r zira etkilenen yaz\u0131l\u0131m\u0131 kullanma m\u00fcmk\u00fcnl\u00fc\u011f\u00fc en y\u00fcksek olan yahut sa\u011flam yama idaresi s\u00fcre\u00e7lerine sahip olmayan kesim budur. ESET Research, KOB\u0130’lere y\u00f6nelik ak\u0131nlar\u0131 \u015fu dallarda g\u00f6zlemledi: \u00dcretim, ila\u00e7, hukuk, e\u011fitim, s\u0131hhat, teknoloji, konaklama-e\u011flence, finansal hizmetler ve b\u00f6lgesel idare.<\/p>\n

\u00a0<\/p>\n

ScRansom \u015fifrelemenin yan\u0131 s\u0131ra etkilenen makinedeki \u00e7e\u015fitli s\u00fcre\u00e7leri ve hizmetleri de \u00f6ld\u00fcrebilir. CosmicBeetle de\u011fi\u015fik ama\u00e7lar\u0131 tehlikeye atmay\u0131 ve onlara b\u00fcy\u00fck ziyan vermeyi ba\u015farm\u0131\u015f olsa da ScRansom \u00e7ok karma\u015f\u0131k bir fidye yaz\u0131l\u0131m\u0131 de\u011fildir. Bunun nedeni \u00e7o\u011funlukla CosmicBeetle’\u0131n fidye yaz\u0131l\u0131m\u0131 d\u00fcnyas\u0131nda olgunla\u015fmam\u0131\u015f bir akt\u00f6r olmas\u0131 ve ScRansom’un da\u011f\u0131t\u0131m\u0131nda ya\u015fanan meselelerdir. ScRansom’dan etkilenen ve \u00f6deme yapmaya karar veren kurbanlar dikkatli olmal\u0131d\u0131r.\u00a0<\/p>\n

\u00a0<\/p>\n

ESET Research, CosmicBeetle taraf\u0131ndan son \u015fifreleme \u015femas\u0131 i\u00e7in kullan\u0131lan bir \u015fifre \u00e7\u00f6z\u00fcc\u00fc elde etmeyi ba\u015fard\u0131. ScRansom daima geli\u015ftiriliyor, bu da fidye yaz\u0131l\u0131mlar\u0131 i\u00e7in asla yeterli bir i\u015faret de\u011fil. \u015eifreleme (ve \u015fifre \u00e7\u00f6zme) s\u00fcrecinin \u00e7ok karma\u015f\u0131kl\u0131\u011f\u0131 kusurlara a\u00e7\u0131k ve t\u00fcm evraklar\u0131n geri y\u00fcklenmesini ku\u015fkulu hale getirir. Ba\u015far\u0131l\u0131 bir \u015fifre \u00e7\u00f6zme s\u00fcreci, \u015fifre \u00e7\u00f6z\u00fcc\u00fcn\u00fcn d\u00fczg\u00fcn \u00e7al\u0131\u015fmas\u0131na ve CosmicBeetle’\u0131n gerekli t\u00fcm anahtarlar\u0131 sa\u011flamas\u0131na ba\u011fl\u0131d\u0131r ve bu durumda bile kimi evraklar tehdit akt\u00f6r\u00fc taraf\u0131ndan kal\u0131c\u0131 olarak yok edilebilir. En \u00e2l\u00e2 senaryoda bile \u015fifre \u00e7\u00f6zme s\u00fcreci uzun ve karma\u015f\u0131kt\u0131r.\u00a0<\/p>\n

\u00a0<\/p>\n

En az 2020’den beri etkin olan CosmicBeetle, ESET ara\u015ft\u0131rmac\u0131lar\u0131n\u0131n 2023’te ke\u015ffetti\u011fi bir tehdit akt\u00f6r\u00fcne verdi\u011fi isimdir. Bu tehdit akt\u00f6r\u00fc en \u00e7ok ScHackTool, ScInstaller, ScService ve ScPatcher’dan olu\u015fan ve ekseriyetle Spacecolon olarak isimlendirilen \u00f6zel Delphi ara\u00e7lar\u0131 koleksiyonunu kullanmas\u0131yla biliniyor.<\/p>\n

Kaynak: (BYZHA) Beyaz Haber Ajans\u0131<\/p>\n","protected":false},"excerpt":{"rendered":"

CosmicBeetle k\u00fcmesi ba\u015fka fidye yaz\u0131l\u0131m\u0131 \u00e7eteleriyle g\u00fc\u00e7lerini birle\u015ftirerek Avrupa ve Asya’daki i\u015fletmeleri ama\u00e7 al\u0131yor<\/p>\n","protected":false},"author":1,"featured_media":7065,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[243,2760,2761,936,336],"class_list":["post-7064","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-teknoloji","tag-eset","tag-fidye-yazilimi","tag-lockbit","tag-sifre","tag-turk"],"_links":{"self":[{"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/posts\/7064"}],"collection":[{"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/comments?post=7064"}],"version-history":[{"count":1,"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/posts\/7064\/revisions"}],"predecessor-version":[{"id":7066,"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/posts\/7064\/revisions\/7066"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/media\/7065"}],"wp:attachment":[{"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/media?parent=7064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/categories?post=7064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/yalovasondakika.com.tr\/index.php\/wp-json\/wp\/v2\/tags?post=7064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}