Siber g\u00fcvenlik \u00e7\u00f6z\u00fcmlerinde d\u00fcnya lideri olan ESET, \u00c7in ile ba\u011flant\u0131l\u0131 tehdit grubu PlushDaemon’un, ESET’in EdgeStepper ad\u0131n\u0131 verdi\u011fi, daha \u00f6nce belgelenmemi\u015f bir a\u011f cihaz\u0131 implant\u0131n\u0131 kullanarak ortadaki adam sald\u0131r\u0131lar\u0131 ger\u00e7ekle\u015ftirdi\u011fini ke\u015ffetti.\u00a0<\/p>\n
\u0130mplant, t\u00fcm DNS sorgular\u0131n\u0131, g\u00fcncellemeleri ele ge\u00e7iren ba\u015fka bir d\u00fc\u011f\u00fcm\u00fcn adresiyle yan\u0131t veren k\u00f6t\u00fc ama\u00e7l\u0131 bir harici DNS sunucusuna y\u00f6nlendiriyor. Yaz\u0131l\u0131m g\u00fcncelleme trafi\u011fini, hedef makinelere LittleDaemon ve DaemonicLogistics indiricilerini da\u011f\u0131tmak ve nihayetinde SlowStepper implant\u0131n\u0131 yaymak amac\u0131yla sald\u0131rganlar\u0131n kontrol\u00fcndeki altyap\u0131ya etkili bir \u015fekilde yeniden y\u00f6nlendiriyor.\u00a0SlowStepper, siber casusluk i\u00e7in kullan\u0131lan d\u00fczinelerce bile\u015fene sahip bir arka kap\u0131 ara\u00e7 setidir. Bu implantlar, PlushDaemon’a d\u00fcnyan\u0131n herhangi bir yerindeki hedefleri tehlikeye atma yetene\u011fi kazand\u0131r\u0131yor.<\/p>\n
\u00c7in ile ba\u011flant\u0131l\u0131 bu grup 2019’dan bu yana Amerika Birle\u015fik Devletleri, Yeni Zelanda, Kambo\u00e7ya, Hong Kong, Tayvan ve \u00c7in\u2019de sald\u0131r\u0131lar d\u00fczenliyor. Kurbanlar\u0131 aras\u0131nda Pekin’deki bir \u00fcniversite, elektronik \u00fcr\u00fcnler \u00fcreten bir Tayvanl\u0131 \u015firket, otomotiv sekt\u00f6r\u00fcnde faaliyet g\u00f6steren bir \u015firket ve imalat sekt\u00f6r\u00fcnde faaliyet g\u00f6steren bir Japon \u015firketinin \u015fubesi bulunuyor.\u00a0<\/p>\n
Sald\u0131r\u0131y\u0131 ortaya \u00e7\u0131karan ve analiz eden ESET ara\u015ft\u0131rmac\u0131s\u0131 Facundo Mu\u00f1oz \u015fu a\u00e7\u0131klamay\u0131 yapt\u0131:\u201d Ke\u015ffedilen sald\u0131r\u0131 senaryosunda, PlushDaemon \u00f6nce hedeflerinin ba\u011flanabilece\u011fi bir a\u011f cihaz\u0131n\u0131 ele ge\u00e7iriyor; bu ele ge\u00e7irme muhtemelen cihazda \u00e7al\u0131\u015fan yaz\u0131l\u0131mdaki bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131 veya zay\u0131f veya iyi bilinen varsay\u0131lan y\u00f6netici kimlik bilgilerini kullanarak ger\u00e7ekle\u015ftiriliyor ve sald\u0131rganlar\u0131n EdgeStepper’\u0131 (ve muhtemelen di\u011fer ara\u00e7lar\u0131) kullanmas\u0131na olanak tan\u0131yor. Ard\u0131ndan, EdgeStepper DNS sorgular\u0131n\u0131, DNS sorgu mesaj\u0131ndaki etki alan\u0131n\u0131n yaz\u0131l\u0131m g\u00fcncellemeleriyle ilgili olup olmad\u0131\u011f\u0131n\u0131 do\u011frulayan k\u00f6t\u00fc ama\u00e7l\u0131 bir DNS d\u00fc\u011f\u00fcm\u00fcne y\u00f6nlendirmeye ba\u015flar ve e\u011fer \u00f6yleyse ka\u00e7\u0131rma d\u00fc\u011f\u00fcm\u00fcn\u00fcn IP adresiyle yan\u0131t verir. Alternatif olarak, baz\u0131 sunucular\u0131n hem DNS d\u00fc\u011f\u00fcm\u00fc hem de ele ge\u00e7irme d\u00fc\u011f\u00fcm\u00fc oldu\u011funu da g\u00f6zlemledik; bu durumlarda, DNS d\u00fc\u011f\u00fcm\u00fc DNS sorgular\u0131na kendi IP adresiyle yan\u0131t verir. \u00a0Birka\u00e7 pop\u00fcler \u00c7in yaz\u0131l\u0131m \u00fcr\u00fcn\u00fcn\u00fcn g\u00fcncellemeleri, EdgeStepper arac\u0131l\u0131\u011f\u0131yla PlushDaemon taraf\u0131ndan ele ge\u00e7irildi.\u00a0<\/p>\n
PlushDaemon, en az 2018 y\u0131l\u0131ndan beri aktif olan ve Do\u011fu Asya-Pasifik ve Amerika Birle\u015fik Devletleri’ndeki birey ve kurulu\u015flara kar\u015f\u0131 casusluk faaliyetlerinde bulunan, \u00c7in ile ba\u011flant\u0131l\u0131 bir tehdit akt\u00f6r\u00fcd\u00fcr. ESET’in SlowStepper olarak izledi\u011fi \u00f6zel bir arka kap\u0131 kullan\u0131r. Ge\u00e7mi\u015fte, ESET Research bu grubun web sunucular\u0131ndaki g\u00fcvenlik a\u00e7\u0131klar\u0131 yoluyla eri\u015fim sa\u011flad\u0131\u011f\u0131n\u0131 g\u00f6zlemlemi\u015fti. \u00a0Grup 2023 y\u0131l\u0131nda bir tedarik zinciri sald\u0131r\u0131s\u0131 ger\u00e7ekle\u015ftirmi\u015fti.<\/p>\n
\u00a0<\/p>\n
Kaynak: (BYZHA) Beyaz Haber Ajans\u0131<\/p>\n","protected":false},"excerpt":{"rendered":"
Siber g\u00fcvenlik \u00e7\u00f6z\u00fcmlerinde d\u00fcnya lideri olan ESET, \u00c7in ile ba\u011flant\u0131l\u0131 tehdit grubu PlushDaemon’un, ESET’in EdgeStepper ad\u0131n\u0131 verdi\u011fi, daha \u00f6nce belgelenmemi\u015f bir a\u011f cihaz\u0131 implant\u0131n\u0131 kullanarak ortadaki adam sald\u0131r\u0131lar\u0131 ger\u00e7ekle\u015ftirdi\u011fini ke\u015ffetti.\u00a0<\/p>\n","protected":false},"author":1,"featured_media":35067,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[9279,8846,9278,244,9277],"class_list":["post-35066","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-saglik","tag-adresiyle","tag-baglantili","tag-edgestepper","tag-guvenlik","tag-plushdaemon"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t