Yeni tehdit brifing raporumuzda, Forescout’un Vedere Laboratuvarlar\u0131 bir Emotet \u00f6rne\u011fini analiz etmi\u015f, analizden \u00e7\u0131kar\u0131lan IoC’lerin bir listesini sunarak ve azaltmay\u0131 tart\u0131\u015ft\u0131\u011f\u0131m\u0131z \u00e7\u00f6z\u00fcmler \u00f6nermi\u015ftik.<\/p>\n
Emotet, hem bir siber su\u00e7 grubunun hem de da\u011f\u0131tt\u0131\u011f\u0131 k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m y\u00fckleyicinin ad\u0131d\u0131r. Grup ayr\u0131ca MUMMY SPIDER olarak bilinirken, k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m Geodo veya Heodo olarak da bilinir. CISA’ya g\u00f6re, Emotet, \u00f6zel ve kamu sekt\u00f6rlerine kar\u015f\u0131 kullan\u0131lan en maliyetli ve y\u0131k\u0131c\u0131 k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar aras\u0131nda yer al\u0131yor ve bireysel olaylar\u0131n d\u00fczeltilmesi 1 milyon dolara kadar \u00e7\u0131k\u0131yor. Europol’e g\u00f6re, Emotet d\u00fcnyan\u0131n en tehlikeli k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131d\u0131r.<\/p>\n
K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m, genellikle makbuzlar ve faturalar gibi finansal bir temas\u0131 olan veya vergi mevsimi doland\u0131r\u0131c\u0131l\u0131\u011f\u0131 ve m\u00fclteciler i\u00e7in ba\u011f\u0131\u015f talepleri gibi g\u00fcncel olaylar\u0131 takip eden k\u00f6t\u00fc niyetli e-postalar arac\u0131l\u0131\u011f\u0131yla yay\u0131l\u0131r. Bula\u015fma, kurban, e-postaya eklenmi\u015f, k\u00f6t\u00fc ama\u00e7l\u0131 makrolar i\u00e7eren ve ard\u0131ndan k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m indiricisini \u00e7al\u0131\u015ft\u0131ran bir belge a\u00e7t\u0131\u011f\u0131nda ger\u00e7ekle\u015fir. \u0130ndirdikten sonra, Emotet vir\u00fcsl\u00fc makinede kalmaya devam eder, talimatlar\u0131 almak i\u00e7in bir C2 sunucusuyla ileti\u015fim kurar ve yerel a\u011fda yay\u0131lmaya \u00e7al\u0131\u015f\u0131r.<\/p>\n
Emotet, 2014 y\u0131l\u0131nda kimlik bilgilerini \u00e7almak i\u00e7in kullan\u0131lan bir bankac\u0131l\u0131k truva at\u0131 olarak ba\u015flad\u0131, ancak birka\u00e7 mutasyon ve ek DLL mod\u00fclleri yoluyla geli\u015fti ve TrickBot veya IcedID gibi di\u011fer k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131 ve Ryuk gibi fidye yaz\u0131l\u0131mlar\u0131n\u0131 sunabilen bir botnet haline geldi. Bu yetenek o kadar \u00f6nemlidir ki, Emotet genellikle ilk eri\u015fim ve k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m da\u011f\u0131t\u0131m\u0131 i\u00e7in \u201chizmet olarak altyap\u0131\u201d \u015feklinde kabul edilir.<\/p>\n
Botnet, Ocak 2021’de polis m\u00fcdahalesiyle kald\u0131r\u0131ld\u0131, ancak tehdit akt\u00f6r\u00fc altyap\u0131s\u0131n\u0131 yeniden in\u015fa etti ve Kas\u0131m 2021’de geri d\u00f6nd\u00fc. Emotet, Ocak ay\u0131 civar\u0131nda daha fazla bot eklemeye ba\u015flad\u0131 ve say\u0131 giderek art\u0131yor. Polis m\u00fcdahalesinden \u00f6nceki zirvesindeyken, Emotet milyonlarca cihaza bula\u015ft\u0131. Yeniden canlanmas\u0131ndan bu yana, hedef spam g\u00f6ndererek k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131 yayan, hedeflenen kurulu\u015flarda yanal hareket i\u00e7in kullan\u0131labilecek veya proxy C2 sunucular\u0131na terfi ettirilebilecek yakla\u015f\u0131k 130.000 bot var. Emotet enfeksiyonlar\u0131n\u0131n say\u0131s\u0131 Mart 2022’de bir \u00f6nceki aya g\u00f6re \u00fc\u00e7 kat\u0131na \u00e7\u0131kt\u0131.<\/p>\n
Forescout, kurulu\u015flar\u0131n riskleri azaltmak i\u00e7in a\u015fa\u011f\u0131daki ad\u0131mlar\u0131 kullanmas\u0131n\u0131 \u00f6nerir:<\/p>\n
<\/p>\n
<\/p>","protected":false},"excerpt":{"rendered":"
Yeni tehdit brifing raporumuzda, Forescout’un Vedere Laboratuvarlar\u0131 bir Emotet \u00f6rne\u011fini analiz etmi\u015f, analizden \u00e7\u0131kar\u0131lan IoC’lerin bir listesini sunarak ve azaltmay\u0131 tart\u0131\u015ft\u0131\u011f\u0131m\u0131z \u00e7\u00f6z\u00fcmler \u00f6nermi\u015ftik. Emotet, hem bir siber su\u00e7 grubunun hem de da\u011f\u0131tt\u0131\u011f\u0131 k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m y\u00fckleyicinin ad\u0131d\u0131r. Grup ayr\u0131ca MUMMY SPIDER olarak bilinirken, k\u00f6t\u00fc ama\u00e7l\u0131…<\/p>","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[255],"tags":[],"class_list":["post-8105","post","type-post","status-publish","format-standard","hentry","category-haberler"],"acf":[],"yoast_head":"\n