{"id":10184,"date":"2021-10-22T12:04:37","date_gmt":"2021-10-22T09:04:37","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=10184"},"modified":"2021-10-22T12:04:37","modified_gmt":"2021-10-22T09:04:37","slug":"trickbot-new-tricks","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/trickbot-new-tricks\/10184\/","title":{"rendered":"Trickbot Truva At\u0131n\u0131n yeni numaralar\u0131"},"content":{"rendered":"<p>\u00c7\u00f6z\u00fcmlerimiz ilk kez tam olarak be\u015f y\u0131l \u00f6nce, Ekim 2016\u2019da Trickbot (di\u011fer ad\u0131yla TrickLoader veya Trickster) adl\u0131 bir Truva At\u0131yla kar\u015f\u0131la\u015ft\u0131. O zamanlar \u00e7o\u011funlukla ev bilgisayarlar\u0131nda g\u00f6r\u00fclen truva at\u0131n\u0131n birincil g\u00f6revi, \u00e7evrimi\u00e7i bankac\u0131l\u0131k hizmetlerine ait giri\u015f bilgilerini \u00e7almakt\u0131. Ancak son y\u0131llarda, yarat\u0131c\u0131lar\u0131 bankac\u0131l\u0131k Truva At\u0131n\u0131 aktif olarak \u00e7ok i\u015flevli mod\u00fcler bir araca d\u00f6n\u00fc\u015ft\u00fcrd\u00fcler.<\/p>\n<p>Dahas\u0131 art\u0131k Trickbot, siber su\u00e7lu gruplar\u0131 aras\u0131nda kurumsal altyap\u0131ya \u00fc\u00e7\u00fcnc\u00fc taraf k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131 y\u00fcklemek i\u00e7in kullan\u0131lan pop\u00fcler bir da\u011f\u0131t\u0131m arac\u0131 haline geldi. Haber kaynaklar\u0131 yak\u0131n zamanda, Trickbot yaz\u0131l\u0131mc\u0131lar\u0131n\u0131n k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131n, Conti fidye yaz\u0131l\u0131m\u0131 gibi her t\u00fcrl\u00fc ek tehdidi kurumsal altyap\u0131ya bula\u015ft\u0131rmak i\u00e7in kullan\u0131lmas\u0131 amac\u0131yla \u00e7e\u015fitli yeni ortaklarla ba\u011flant\u0131 kurduklar\u0131n\u0131 <a href=\"https:\/\/threatpost.com\/trickbot-cybercrime-elite-affiliates\/175510\/\" target=\"_blank\" rel=\"noopener nofollow\">bildirdi<\/a>.<\/p>\n<p>Truva at\u0131n\u0131n bu \u015fekilde farkl\u0131 bir ama\u00e7 i\u00e7in kullan\u0131lmas\u0131, kurumsal g\u00fcvenlik operasyon merkezlerinin \u00e7al\u0131\u015fanlar\u0131 ve di\u011fer siber g\u00fcvenlik uzmanlar\u0131 i\u00e7in ek bir tehlike olu\u015fturabilir. Baz\u0131 g\u00fcvenlik \u00e7\u00f6z\u00fcmleri, as\u0131l uzmanl\u0131k alan\u0131 nedeniyle Trickbot\u2019u hala bir bankac\u0131l\u0131k Truva At\u0131 olarak kabul ediyor. Dolay\u0131s\u0131yla, bunu tespit eden bilgi g\u00fcvenli\u011fi \u00e7al\u0131\u015fanlar\u0131 truva at\u0131n\u0131 yanl\u0131\u015fl\u0131kla \u015firket a\u011f\u0131na giren rastgele bir ev kullan\u0131c\u0131s\u0131 tehdidi olarak g\u00f6rebilir. Ger\u00e7ekte truva at\u0131n\u0131n orada bulunmas\u0131 bir fidye yaz\u0131l\u0131m\u0131 y\u00fckleme giri\u015fimi ve hatta hedefli bir siber casusluk operasyonunun bir par\u00e7as\u0131 gibi \u00e7ok daha ciddi bir \u015feye i\u015faret ediyor olabilir.<\/p>\n<p>Uzmanlar\u0131m\u0131z, C&amp;C (komuta kontrol) sunucular\u0131ndan birinden Truva At\u0131\u2019n\u0131n mod\u00fcllerini indirmeyi ba\u015fard\u0131 ve kapsaml\u0131 bir analiz ger\u00e7ekle\u015ftirdi.<\/p>\n<h2>Trickbot art\u0131k neler yapabiliyor?<\/h2>\n<p>Bug\u00fcnk\u00fc Trickbot\u2019un temel amac\u0131, yerel a\u011flara girmek ve yay\u0131lmakt\u0131r. Ard\u0131ndan Truva At\u0131n\u0131n operat\u00f6rleri, elde ettikleri kurumsal altyap\u0131 eri\u015fimini \u00fc\u00e7\u00fcnc\u00fc taraf sald\u0131rganlara satmaktan, hassas verileri \u00e7almaya kadar \u00e7e\u015fitli ama\u00e7lar i\u00e7in kullanabilir. K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131n \u015fu anda:<\/p>\n<ul>\n<li>Active Directory\u2019den ve kay\u0131t defterinden a\u011fda yatay hareket imkan\u0131 sa\u011flayan kullan\u0131c\u0131 adlar\u0131n\u0131, parola hesaba dayal\u0131 adreslemelerini ve di\u011fer bilgileri toplayabiliyor,<\/li>\n<li>Bula\u015ft\u0131\u011f\u0131 bilgisayardaki internet trafi\u011fini durdurabiliyor,<\/li>\n<li>VNC protokol\u00fc arac\u0131l\u0131\u011f\u0131yla uzaktan cihaz kontrol\u00fc sa\u011flayabiliyor,<\/li>\n<li>Taray\u0131c\u0131lardan \u00e7erezleri \u00e7alabiliyor,<\/li>\n<li>Kay\u0131t defterinden, \u00e7e\u015fitli uygulamalar\u0131n veri tabanlar\u0131ndan ve yap\u0131land\u0131rma dosyalar\u0131ndan oturum a\u00e7ma kimlik bilgilerini alabiliyor ve ayr\u0131ca kripto para c\u00fczdanlar\u0131n\u0131n \u00f6zel anahtarlar\u0131n\u0131, SSL sertifikalar\u0131n\u0131 ve veri dosyalar\u0131n\u0131 \u00e7alabiliyor,<\/li>\n<li>Taray\u0131c\u0131lardaki otomatik doldurma verilerini ve kullan\u0131c\u0131lar\u0131n internet sitelerindeki formlara girdi\u011fi bilgileri ele ge\u00e7irebiliyor,<\/li>\n<li>FTP ve SFTP sunucular\u0131ndaki dosyalar\u0131 tarayabiliyor,<\/li>\n<li>Web sayfalar\u0131na k\u00f6t\u00fc ama\u00e7l\u0131 komut dosyalar\u0131 yerle\u015ftirebiliyor,<\/li>\n<li>Yerel bir proxy \u00fczerinden taray\u0131c\u0131 trafi\u011fini yeniden y\u00f6nlendirebiliyor,<\/li>\n<li>Do\u011frulama sonu\u00e7lar\u0131n\u0131 yan\u0131ltmak amac\u0131yla sertifika zinciri do\u011frulamas\u0131ndan sorumlu API\u2019leri ele ge\u00e7irebiliyor,<\/li>\n<li>Outlook profili kimlik bilgilerini toplayabiliyor, Outlook\u2019taki e-postalara m\u00fcdahale edebiliyor ve bu sayede spam g\u00f6nderebiliyor,<\/li>\n<li>OWA hizmetini arayabiliyor ve zorla giri\u015f sald\u0131r\u0131s\u0131 d\u00fczenleyebiliyor,<\/li>\n<li>Donan\u0131ma d\u00fc\u015f\u00fck seviye eri\u015fim elde edebiliyor,<\/li>\n<li>Bilgisayara donan\u0131m d\u00fczeyinde eri\u015fim sa\u011flayabiliyor,<\/li>\n<li>G\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 bulmak i\u00e7in alan adlar\u0131n\u0131 tarayabiliyor,<\/li>\n<li>SQL sunucular\u0131n\u0131n adreslerini bulabiliyor ve bunlar \u00fczerinde arama sorgular\u0131 y\u00fcr\u00fctebiliyor,<\/li>\n<li>EternalRomance ve EternalBlue a\u00e7\u0131klar\u0131ndan yararlanarak yay\u0131labiliyor,<\/li>\n<li>VPN ba\u011flant\u0131lar\u0131 olu\u015fturabiliyor.<\/li>\n<\/ul>\n<p>Mod\u00fcllerin ayr\u0131nt\u0131l\u0131 a\u00e7\u0131klamas\u0131na ve risk g\u00f6stergelerine <a href=\"https:\/\/securelist.com\/trickbot-module-descriptions\/104603\/\" target=\"_blank\" rel=\"noopener\">Securelist g\u00f6nderimizden<\/a> ula\u015fabilirsiniz.<\/p>\n<h2>Trickbot Truva At\u0131na kar\u015f\u0131 nas\u0131l korunulur<\/h2>\n<p>\u0130statistikler, bu y\u0131l Trickbot Truva At\u0131n\u0131n \u00e7o\u011funlukla ABD, Avustralya, \u00c7in, Meksika ve Fransa\u2019da tespit edildi\u011fini g\u00f6steriyor. Ancak bu, \u00f6zellikle yaz\u0131l\u0131mc\u0131lar\u0131n\u0131n di\u011fer siber su\u00e7lularla i\u015fbirli\u011fi yapmaya haz\u0131r oldu\u011fu da d\u00fc\u015f\u00fcn\u00fcld\u00fc\u011f\u00fcnde, di\u011fer b\u00f6lgelerin g\u00fcvenli oldu\u011fu anlam\u0131na gelmiyor.<\/p>\n<p>\u015eirketinizin bu Truva At\u0131n\u0131n kurban\u0131 olmas\u0131n\u0131 \u00f6nlemek i\u00e7in internet ba\u011flant\u0131s\u0131 olan t\u00fcm cihazlar\u0131 <a href=\"https:\/\/www.kaspersky.com.tr\/small-to-medium-business-security?icid=tr_kdailyplacehold_acq_ona_smm__onl_b2b_kasperskydaily_wpplaceholder_______\" target=\"_blank\" rel=\"noopener\">y\u00fcksek kaliteli bir g\u00fcvenlik \u00e7\u00f6z\u00fcm\u00fc<\/a> ile donatman\u0131z\u0131 \u00f6neriyoruz. Ayr\u0131ca, \u015firket altyap\u0131s\u0131ndaki \u015f\u00fcpheli etkinli\u011fin tespiti i\u00e7in <a href=\"https:\/\/www.kaspersky.com\/enterprise-security\/managed-detection-and-response?icid=tr_kdailyplacehold_acq_ona_smm__onl_b2b_kasperskydaily_wpplaceholder_______\" target=\"_blank\" rel=\"noopener nofollow\">siber tehdit izleme hizmeti<\/a> kullanmak da iyi bir fikirdir.<\/p>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"mdr\">\n","protected":false},"excerpt":{"rendered":"<p>Son be\u015f y\u0131lda Trickbot bankac\u0131l\u0131k Truva At\u0131, siber su\u00e7lular i\u00e7in olduk\u00e7a i\u015flevsel bir araca d\u00f6n\u00fc\u015ft\u00fc.<\/p>\n","protected":false},"author":2581,"featured_media":10185,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1726,1194],"tags":[597,591,616,1986],"class_list":{"0":"post-10184","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-enterprise","8":"category-business","9":"tag-bankacilik-truva-ati","10":"tag-fidye-yazilimi","11":"tag-siber-casusluk","12":"tag-truva-atlari"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/trickbot-new-tricks\/10184\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/trickbot-new-tricks\/23505\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/trickbot-new-tricks\/18989\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/trickbot-new-tricks\/25590\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/trickbot-new-tricks\/23654\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/trickbot-new-tricks\/23134\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/trickbot-new-tricks\/26285\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/trickbot-new-tricks\/25818\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/trickbot-new-tricks\/31757\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/trickbot-new-tricks\/42622\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/trickbot-new-tricks\/17922\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/trickbot-new-tricks\/18323\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/trickbot-new-tricks\/15426\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/trickbot-new-tricks\/27612\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/trickbot-new-tricks\/31837\/"},{"hreflang":"nl","url":"https:\/\/www.kaspersky.nl\/blog\/trickbot-new-tricks\/27745\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/trickbot-new-tricks\/24497\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/trickbot-new-tricks\/29857\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/trickbot-new-tricks\/29659\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/truva-atlari\/","name":"Truva Atlar\u0131"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/10184","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/2581"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=10184"}],"version-history":[{"count":1,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/10184\/revisions"}],"predecessor-version":[{"id":10186,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/10184\/revisions\/10186"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/10185"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=10184"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=10184"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=10184"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}