{"id":354,"date":"2020-12-27T21:12:04","date_gmt":"2020-12-27T21:12:04","guid":{"rendered":"http:\/\/unalenes.com\/blog\/?p=354"},"modified":"2020-12-27T21:12:04","modified_gmt":"2020-12-27T21:12:04","slug":"powerpepper-zararlisi-windows-bilgisayarlara-bulasiyor-kendini-gizliyor","status":"publish","type":"post","link":"http:\/\/unalenes.com\/blog\/powerpepper-zararlisi-windows-bilgisayarlara-bulasiyor-kendini-gizliyor\/","title":{"rendered":"PowerPepper Zararl\u0131s\u0131 Windows Bilgisayarlara Bula\u015f\u0131yor; Kendini Gizliyor!"},"content":{"rendered":"

<\/p>\n

Kaspersky’deki g\u00fcvenlik ara\u015ft\u0131rmac\u0131lar\u0131, kiral\u0131k bir hacker grubu olan DeathStalker<\/strong> taraf\u0131ndan geli\u015ftirilen yeni bir k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m t\u00fcr\u00fcn\u00fc duyurdu. DeathStalker en az 2012’den beri aktif, ancak siber su\u00e7lular veya devlet destekli bilgisayar korsanlar\u0131 taraf\u0131ndan kullan\u0131lanlara benzemeyen kendine \u00f6zg\u00fc sald\u0131r\u0131 \u00f6zellikleri nedeniyle Kaspersky’nin dikkatini ilk kez 2018’de \u00e7ekti. Grup, sald\u0131r\u0131lar\u0131nda \u00e7ok \u00e7e\u015fitli k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m t\u00fcrleri ve karma\u015f\u0131k da\u011f\u0131t\u0131m zincirleri kullanmas\u0131yla biliniyor, ancak tespitten ka\u00e7mak i\u00e7in kullan\u0131lan taktikler onu ger\u00e7ekten \u00f6ne \u00e7\u0131kar\u0131yor.<\/p>\n

Kaspersky, grubun PowerShell tabanl\u0131 Powersing y\u00f6ntemini<\/strong> kullanan di\u011fer sald\u0131r\u0131lar\u0131n\u0131 ara\u015ft\u0131r\u0131rken May\u0131s ay\u0131nda PowerPepper<\/strong> ad\u0131 verilen yeni bir k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m t\u00fcr\u00fcn\u00fc ke\u015ffetti. Bu d\u00f6nemden sonra yeni PowerPepper s\u00fcr\u00fcmleri internete da\u011f\u0131ld\u0131 ve DeathStalker’\u0131n a\u00e7t\u0131\u011f\u0131 yollar\u0131 kullanarak yeni hedeflere bula\u015f\u0131yor.<\/p>\n

PowerPepper zararl\u0131s\u0131<\/b><\/p>\n

Yeni PowerPepper k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131, operat\u00f6rlerinin bir komut ve kontrol (C2) sunucusundan uzaktan kabuk komutlar\u0131 y\u00fcr\u00fctmesine olanak tan\u0131yan, bellek i\u00e7i Windows PowerShell tabanl\u0131 bir arka kap\u0131 a\u00e7\u0131\u011f\u0131n\u0131 kullan\u0131yor.<\/p>\n

DealthStalker’in \u00f6nceki \u00e7al\u0131\u015fmas\u0131nda oldu\u011fu gibi, PowerPepper da fare hareketlerini tespit etmek<\/strong>, bir istemcinin MAC adreslerini filtrelemek ve bir hedef sistemde hangi antivir\u00fcs \u00fcr\u00fcnlerinin kurulu oldu\u011funa ba\u011fl\u0131 olarak y\u00fcr\u00fctme ak\u0131\u015f\u0131n\u0131 uyarlamak gibi \u00e7e\u015fitli hileler kullanarak Windows 10 taraf\u0131ndan alg\u0131lanmaktan ka\u00e7\u0131n\u0131yor. K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m, kimlik av\u0131 e-posta ekleri yoluyla veya PowerPepper’\u0131 \u00e7al\u0131\u015ft\u0131ran ve vir\u00fcsl\u00fc sistemlerde kal\u0131c\u0131l\u0131k kazanan k\u00f6t\u00fc ama\u00e7l\u0131 Visual Basic for Application (VBA) makrolar\u0131 i\u00e7eren belgelere ba\u011flant\u0131lar yoluyla yay\u0131l\u0131yor.<\/p>\n","protected":false},"excerpt":{"rendered":"

\nKaspersky’deki g\u00fcvenlik ara\u015ft\u0131rmac\u0131lar\u0131, kiral\u0131k bir hacker grubu olan DeathStalker taraf\u0131ndan geli\u015ftirilen yeni bir k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m t\u00fcr\u00fcn\u00fc …<\/p>\n","protected":false},"author":1,"featured_media":355,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[6],"tags":[61],"_links":{"self":[{"href":"http:\/\/unalenes.com\/blog\/wp-json\/wp\/v2\/posts\/354"}],"collection":[{"href":"http:\/\/unalenes.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/unalenes.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/unalenes.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/unalenes.com\/blog\/wp-json\/wp\/v2\/comments?post=354"}],"version-history":[{"count":1,"href":"http:\/\/unalenes.com\/blog\/wp-json\/wp\/v2\/posts\/354\/revisions"}],"predecessor-version":[{"id":356,"href":"http:\/\/unalenes.com\/blog\/wp-json\/wp\/v2\/posts\/354\/revisions\/356"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/unalenes.com\/blog\/wp-json\/wp\/v2\/media\/355"}],"wp:attachment":[{"href":"http:\/\/unalenes.com\/blog\/wp-json\/wp\/v2\/media?parent=354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/unalenes.com\/blog\/wp-json\/wp\/v2\/categories?post=354"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/unalenes.com\/blog\/wp-json\/wp\/v2\/tags?post=354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}