{"id":5967,"date":"2019-05-21T13:47:47","date_gmt":"2019-05-21T10:47:47","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=5967"},"modified":"2019-11-15T14:28:53","modified_gmt":"2019-11-15T11:28:53","slug":"fin7-still-exists","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/fin7-still-exists\/5967\/","title":{"rendered":"FINY7 tutuklamalar\u0131na ra\u011fmen k\u00f6t\u00fc ama\u00e7l\u0131 faaliyet devam ediyor"},"content":{"rendered":"<p>Ge\u00e7ti\u011fimiz y\u0131l Europol ve ABD Adalet Bakanl\u0131\u011f\u0131, FIN7 ve Carbanak siber su\u00e7lu gruplar\u0131n\u0131n lideri olduklar\u0131ndan \u015f\u00fcphelenilen birka\u00e7 siber su\u00e7luyu tutuklad\u0131. Haber b\u00fcltenleri bu siber \u00e7etelerin yenilgisini ilan etti ancak uzmanlar\u0131m\u0131z h\u00e2l\u00e2 faaliyetlerinin belirtilerini tespit ediyorlar. Ayr\u0131ca benzer ara\u00e7 tak\u0131mlar\u0131 ve ayn\u0131 altyap\u0131y\u0131 kullanan birbirine ba\u011fl\u0131 gruplar\u0131n say\u0131s\u0131 art\u0131yor. \u0130\u015fte bu gruplar\u0131n as\u0131l ara\u00e7lar\u0131n\u0131n ve hilelerinin listesiyle beraber i\u015fletmelerinizi nas\u0131l g\u00fcvende tutaca\u011f\u0131n\u0131z \u00fczerine biraz tavsiye.<\/p>\n<h2>FIN7<\/h2>\n<p>FIN7, finansal verilere veya PoS altyap\u0131s\u0131na eri\u015fmek i\u00e7in i\u015fletmelere sald\u0131rmak konusunda uzmanla\u015fm\u0131\u015ft\u0131r. Grup, sofistike bir sosyal m\u00fchendislikle birlikte hedef odakl\u0131 kimlik av\u0131 sald\u0131r\u0131lar arac\u0131l\u0131\u011f\u0131yla \u00e7al\u0131\u015f\u0131yor. \u00d6rne\u011fin, k\u00f6t\u00fc niyetli belgeler g\u00f6ndermeden \u00f6nce dikkatleri ba\u015fka y\u00f6ne \u00e7ekmek i\u00e7in kurbanlar\u0131yla d\u00fczinelerce normal mesaj al\u0131\u015fveri\u015finde bulunabilirler.<\/p>\n<p>\u00c7o\u011fu olayda, sald\u0131r\u0131lar kurban\u0131n bilgisayar\u0131na k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m y\u00fcklemek i\u00e7in makro i\u00e7eren k\u00f6t\u00fc ama\u00e7l\u0131 belgeler ve bunlar\u0131 kal\u0131c\u0131 hale getirmek i\u00e7in zamanlanm\u0131\u015f g\u00f6revler kullan\u0131yordu. Daha sonra mod\u00fclleri al\u0131p sistem belle\u011finde \u00e7al\u0131\u015ft\u0131r\u0131yordu. \u00d6zellikle, bilgi toplamak, k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m indirmek, ekran g\u00f6r\u00fcnt\u00fcleri almak ve (e\u011fer ilki tespit edilirse) ayn\u0131 k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131n bir ba\u015fka \u00f6rne\u011fini kay\u0131t defterinde saklamak i\u00e7in kullan\u0131lan mod\u00fcller g\u00f6rd\u00fck. Do\u011fal olarak, siber su\u00e7lular istedikleri zaman ek mod\u00fcller yaratabilirler.<\/p>\n<h2>CobaltGoblin\/Carbanak\/EmpireMonkey grubu<\/h2>\n<p>Di\u011fer siber su\u00e7lular da yaln\u0131zca hedefleri farkl\u0131l\u0131k g\u00f6steren (bu olayda, bankalar, bankac\u0131l\u0131k geli\u015ftiricileri ve para i\u015fleme yaz\u0131l\u0131mlar\u0131) benzer ara\u00e7lar ve teknikler kullan\u0131yorlar. Carbanak (veya CobaltGoblin veya EmpireMonkey) grubunun as\u0131l stratejisi, kurbanlar\u0131n a\u011flar\u0131nda bir yer edinmek ve daha sonra paraya \u00e7evirebilecekleri bilgileri i\u00e7eren ilgin\u00e7 u\u00e7 noktalar bulmakt\u0131r.<\/p>\n<h2>AveMaria botnet<\/h2>\n<p>AveMaria bilgi \u00e7almak i\u00e7in kullan\u0131lan yeni bir botnet\u2019tir. Bir makineye vir\u00fcs bula\u015ft\u0131\u011f\u0131nda, olas\u0131 t\u00fcm kimlik bilgilerini \u00e7e\u015fitli yaz\u0131l\u0131mlardan toplamaya ba\u015flar: taray\u0131c\u0131lar, e-posta istemcileri, messenger\u2019lar vb. Ayn\u0131 zamanda tu\u015f kaydedici gibi de \u00e7al\u0131\u015f\u0131r.<\/p>\n<p>\u0130\u00e7eri\u011fi iletmek i\u00e7in, k\u00f6t\u00fc niyetli ki\u015filer hedef odakl\u0131 kimlik av\u0131, sosyal m\u00fchendislik ve k\u00f6t\u00fc niyetli ekler kullan\u0131r. Uzmanlar\u0131m\u0131z, metotlar\u0131ndaki ve komuta ve kontrol (C&amp;C) altyap\u0131s\u0131ndaki benzerliklerden dolay\u0131 Fin7 ile ba\u011flant\u0131lar\u0131 olmas\u0131ndan \u015f\u00fcpheleniyor. Ba\u011flant\u0131lar\u0131 oldu\u011funun bir ba\u015fka g\u00f6stergesi de hedef da\u011f\u0131l\u0131m\u0131d\u0131r: Hedeflerin %30\u2019u daha b\u00fcy\u00fck oyuncular i\u00e7in tedarik\u00e7i veya hizmet sa\u011flay\u0131c\u0131 olan k\u00fc\u00e7\u00fck ve orta \u00f6l\u00e7ekli \u015firketler, % 21\u2019i ise \u00e7e\u015fitli imalat \u015firketleriydi.<\/p>\n<h2>CopyPaste<\/h2>\n<p>Uzmanlar\u0131m\u0131z bir Afrika \u00fclkesindeki finansal varl\u0131klar\u0131 ve \u015firketleri hedef alan CopyPaste kod adl\u0131 bir dizi faaliyet ke\u015ffetti. Akt\u00f6rler Fin7\u2019nin kulland\u0131klar\u0131na benzer birka\u00e7 y\u00f6ntem ve ara\u00e7 kullan\u0131yorlard\u0131. Ancak bu siber su\u00e7lular\u0131n yak\u0131n zamanda a\u00e7\u0131k kaynak yay\u0131nlar kullanm\u0131\u015f olmas\u0131 ve FIN7 ile ger\u00e7ek bir ba\u011flar\u0131n\u0131n bulunmamas\u0131 m\u00fcmk\u00fcn.<\/p>\n<p><a href=\"https:\/\/securelist.com\/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities\/90703\/\" target=\"_blank\" rel=\"noopener noreferrer\">Securelist.com<\/a>\u2018da ortakl\u0131k g\u00f6stergeleri de dahil olmak \u00fczere teknik detaylara ula\u015fabilirsiniz.<\/p>\n<h2>G\u00fcvenli\u011finizi nas\u0131l sa\u011flayabilirsiniz?<\/h2>\n<ul>\n<li>Hedef odakl\u0131 kimlik av\u0131 giri\u015fimlerini alg\u0131lamay\u0131 ve engellemeyi ama\u00e7layan \u00f6zel i\u015flevlere sahip g\u00fcvenlik \u00e7\u00f6z\u00fcmleri kullan\u0131n. \u0130\u015fletmeler \u015firket i\u00e7i e-posta sistemlerini <a href=\"https:\/\/www.kaspersky.com.tr\/small-to-medium-business-security?icid=tr_kdailyplacehold_acq_ona_smm__onl_b2b_kasperskydaily_wpplaceholder_______\" target=\"_blank\" rel=\"noopener\">Kaspersky Endpoint Security for Business<\/a> paketindeki hedeflenen uygulamalarla koruyabilir.<\/li>\n<li>G\u00fcvenlik bilinci e\u011fitimi verin ve pratik becerileri \u00f6\u011fretin. <a href=\"https:\/\/www.kaspersky.com\/small-to-medium-business-security\/security-awareness-platform\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Kaspersky Automated Security Awareness Platform<\/a>gibi programlar becerilerin g\u00fc\u00e7lendirilmesine ve sim\u00fcle edilmi\u015f kimlik av\u0131 sald\u0131r\u0131lar\u0131 ger\u00e7ekle\u015ftirilmesine yard\u0131mc\u0131 olacakt\u0131r.<\/li>\n<li>Yukar\u0131da belirtilen gruplar\u0131n t\u00fcm\u00fc kurumsal ortamlardaki d\u00fczeltme eki olmayan sistemlerden b\u00fcy\u00fck fayda sa\u011fl\u0131yorlar. Yeteneklerini s\u0131n\u0131rland\u0131rmak i\u00e7in sa\u011flam bir d\u00fczeltme eki stratejisi ve Kaspersky Endpoint Security for Business gibi kritik yaz\u0131l\u0131mlar\u0131 otomatik olarak d\u00fczeltebilen bir g\u00fcvenlik \u00e7\u00f6z\u00fcm\u00fc kullan\u0131n.<\/li>\n<\/ul>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"kesb-trial-leadgen\">\n<p><!--Snippet: FINY7 ve di\u011fer siber \u00e7eteler, k\u00f6t\u00fc ama\u00e7l\u0131 faaliyetlerine devam ediyor. Blog yaz\u0131m\u0131zda bu su\u00e7lular\u0131n kulland\u0131\u011f\u0131 ara\u00e7lar\u0131 ve bunlardan nas\u0131l korunabilece\u011finizi inceliyoruz.--><\/p>\n","protected":false},"excerpt":{"rendered":"<p>FIN7 siber \u00e7etesinin \u015f\u00fcpheli lideri tutuklanmas\u0131na ra\u011fmen, k\u00f6t\u00fc niyetli faaliyet bir \u015fekilde devam ediyor.<\/p>\n","protected":false},"author":40,"featured_media":5969,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1194,1727],"tags":[1887,493,1931,337,1908],"class_list":{"0":"post-5967","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-business","8":"category-smb","9":"tag-thesas2019","10":"tag-apt","11":"tag-fin7","12":"tag-sas","13":"tag-sas-2019"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/fin7-still-exists\/5967\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/fin7-still-exists\/14529\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/fin7-still-exists\/18404\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/fin7-still-exists\/17302\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/fin7-still-exists\/22727\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/fin7-still-exists\/26904\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/fin7-still-exists\/11707\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/fin7-still-exists\/11796\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/fin7-still-exists\/10702\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/fin7-still-exists\/19196\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/fin7-still-exists\/23195\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/fin7-still-exists\/18376\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/thesas2019\/","name":"#thesas2019"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/5967","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/40"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=5967"}],"version-history":[{"count":2,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/5967\/revisions"}],"predecessor-version":[{"id":6786,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/5967\/revisions\/6786"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/5969"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=5967"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=5967"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=5967"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}