{"id":4281,"date":"2017-10-17T17:48:39","date_gmt":"2017-10-17T14:48:39","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=4281"},"modified":"2017-10-24T18:21:38","modified_gmt":"2017-10-24T15:21:38","slug":"blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit\/4281\/","title":{"rendered":"BlackOasis APT ve s\u0131f\u0131r g\u00fcn a\u00e7\u0131\u011f\u0131ndan yararlanan yeni hedefli sald\u0131r\u0131lar"},"content":{"rendered":"

Kaspersky Intelligence Reporting Service m\u00fc\u015fterileri, BlackOasis APT hakk\u0131nda daha fazla bilgi edinebilir. \u0130leti\u015fim: intelreports@kaspersky.com<\/p>\n

Giri\u015f<\/h2>\n

Kaspersky Lab, kullan\u0131c\u0131lar\u0131 korumak i\u00e7in her zaman sat\u0131c\u0131larla birlikte \u00e7al\u0131\u015fm\u0131\u015ft\u0131r. Yeni g\u00fcvenlik a\u00e7\u0131klar\u0131 buldu\u011fumuz anda sorumluluk bilinciyle sat\u0131c\u0131lar\u0131 bu konu hakk\u0131nda bilgilendirir ve onar\u0131m i\u00e7in gereken ayr\u0131nt\u0131lar\u0131 sa\u011flar\u0131z.<\/p>\n

10 Ekim 2017 tarihinde Kaspersky Lab\u2019in geli\u015fmi\u015f a\u00e7\u0131k (exploit) \u00f6nleme sistemleri, m\u00fc\u015fterilerimize kar\u015f\u0131 kullan\u0131lmakta olan yeni bir Adobe Flash s\u0131f\u0131r g\u00fcn a\u00e7\u0131\u011f\u0131 ke\u015ffetti. G\u00fcvenlik a\u00e7\u0131\u011f\u0131 bir Microsoft Office belgesi ile iletilmekteydi ve son zararl\u0131 y\u00fck de FinSpy k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131n\u0131n yeni s\u00fcr\u00fcm\u00fcyd\u00fc. Hatay\u0131 Adobe\u2019a bildirdik ve onlarda bu hatay\u0131 CVE-2017-11292 olarak atad\u0131 ve d\u00fcn sabah bir yama yay\u0131nlad\u0131<\/a>:<\/p>\n

\"\"<\/p>\n

M\u00fc\u015fteri veri taban\u0131m\u0131zda \u015fimdiye kadar yaln\u0131zca tek bir sald\u0131r\u0131 g\u00f6zlemlendi. Bu nedenle sald\u0131r\u0131 say\u0131s\u0131n\u0131n az oldu\u011funa ve son derece hedefli oldu\u011funa kanaat getirdik.<\/p>\n

Zararl\u0131 y\u00fck analizi, bu sald\u0131r\u0131y\u0131 \u201cBlackOasis\u201d ad\u0131yla takip etti\u011fimiz bir akt\u00f6rle ili\u015fkilendirmemizi sa\u011flad\u0131. Ayr\u0131ca BlackOasis\u2019in Eyl\u00fcl 2017\u2019de FireEye taraf\u0131ndan ke\u015ffedilen bir ba\u015fka s\u0131f\u0131r g\u00fcn a\u00e7\u0131\u011f\u0131ndan da (CVE-2017-8759) sorumlu oldu\u011fundan son derece eminiz. Son sald\u0131r\u0131larda (CVE-2017-11292) kullan\u0131lan FinSpy zararl\u0131 y\u00fck\u00fc, FireEye<\/a> taraf\u0131ndan ortaya \u00e7\u0131kar\u0131lan CVE-2017-8759\u2019da kullan\u0131lan zararl\u0131 y\u00fckle ayn\u0131 komuta ve kontrol (C2) sunucunusu payla\u015fmaktad\u0131r.<\/p>\n

BlackOasis Hakk\u0131ndaki Genel Bilgiler<\/h2>\n

BlackOasis\u2019in faaliyetlerini ilk kez May\u0131s 2016 tarihinde, ba\u015fka bir Adobe Flash s\u0131f\u0131r g\u00fcn a\u00e7\u0131\u011f\u0131n\u0131 ara\u015ft\u0131r\u0131rken fark ettik. 10 May\u0131s 2016 tarihinde, Adobe; Windows, Macintosh, Linux ve Chrome OS i\u00e7in Flash Player 21.0.0.226 ve daha \u00f6nceki s\u00fcr\u00fcmleri etkileyen bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131 (CVE-2016-4117) konusunda uyar\u0131larda bulundu<\/a>. G\u00fcvenlik a\u00e7\u0131\u011f\u0131ndan yararlan\u0131lmaya devam edilmekteydi.<\/p>\n

Kaspersky Lab, 8 May\u0131s 2016 tarihinde \u00e7oklu tarama sistemine y\u00fcklenen ve bu g\u00fcvenlik a\u00e7\u0131\u011f\u0131ndan yararlanan bir \u00f6rnek tespit etmeyi ba\u015farm\u0131\u015ft\u0131. RTF belgesi format\u0131ndaki bu \u00f6rnek, uzaktaki komuta ve kontrol sunucusundan bir program indirmek ve y\u00fcklemek i\u00e7in CVE-2016-4117 a\u00e7\u0131\u011f\u0131ndan yararlan\u0131yordu. Sald\u0131r\u0131n\u0131n zararl\u0131 y\u00fck\u00fc art\u0131k komuta ve kontrol sunucunda olmamas\u0131na ra\u011fmen ayn\u0131 sunucu birden \u00e7ok FinSpy y\u00fckleme paketini bar\u0131nd\u0131rmaktayd\u0131.<\/p>\n

Kaspersky Security Network\u2019den edindi\u011fimiz verilerinden yararlanarak Haziran 2015 tarihinde BlackOasis taraf\u0131ndan kullan\u0131lan iki adet benzer a\u00e7\u0131k zinciri tespit ettik. Bu zincirler de o d\u00f6nemde s\u0131f\u0131r g\u00fcn a\u00e7\u0131klar\u0131yd\u0131. Bunlar s\u0131ras\u0131yla Haziran 2015 ve \u015eubat 2016 tarihlerinde yama uygulanan CVE-2015-5119 ve CVE-2016-0984 a\u00e7\u0131klar\u0131yd\u0131. Bu a\u00e7\u0131k zincirleri de FinSpy y\u00fckleme paketleri i\u00e7eriyordu.<\/p>\n

BlackOasis\u2019in yararlanma a\u011f\u0131n\u0131n ke\u015ffedilmesinden bu yana faaliyetlerini ve hedeflerini daha iyi anlamak amac\u0131yla bu tehdit akt\u00f6r\u00fcn\u00fc takip etmeye ba\u015flad\u0131k ve baz\u0131 yeni sald\u0131r\u0131lar g\u00f6rd\u00fck. Bu sald\u0131r\u0131larda kullan\u0131lan baz\u0131 tuzak belgeler a\u015fa\u011f\u0131da g\u00f6sterilmi\u015ftir:<\/p>\n

\"\"<\/p>\n

\"\"

BlackOasis sald\u0131r\u0131lar\u0131nda kullan\u0131lan sahte belgeler<\/p><\/div>\n

\u00a0<\/p>\n

\u00d6zetle, BlackOasis\u2019in Haziran 2015 tarihinden bu yana en az be\u015f s\u0131f\u0131r g\u00fcn a\u00e7\u0131\u011f\u0131 kulland\u0131\u011f\u0131n\u0131 g\u00f6rd\u00fck.<\/p>\n