{"id":103444,"date":"2023-07-02T15:17:00","date_gmt":"2023-07-02T12:17:00","guid":{"rendered":"https:\/\/kocaelikent.com\/casus-yazilimlarin-hedefi-whatsapp-yedeklemeleri\/"},"modified":"2023-07-10T00:47:03","modified_gmt":"2023-07-09T21:47:03","slug":"casus-yazilimlarin-hedefi-whatsapp-yedeklemeleri","status":"publish","type":"post","link":"https:\/\/kocaelikent.com\/casus-yazilimlarin-hedefi-whatsapp-yedeklemeleri\/","title":{"rendered":"Casus yaz\u0131l\u0131mlar\u0131n hedefi Whatsapp yedeklemeleri"},"content":{"rendered":"<p>ESET ara\u015ft\u0131rmac\u0131lar\u0131, Android tabanl\u0131 GravityRAT casus yaz\u0131l\u0131m\u0131n\u0131n BingeChat ve Chatico mesajla\u015fma uygulamalar\u0131 olarak da\u011f\u0131t\u0131lan g\u00fcncellenmi\u015f bir s\u00fcr\u00fcm\u00fcn\u00fc tespit etti.- <a href=\"https:\/\/kocaelikent.com\/\">kocaelikent<\/a><\/p>\n<p><strong>\u0130STANBUL (\u0130GFA) &#8211; <\/strong>Siber g\u00fcvenlik \u015firketi ESET,\u00a0 WhatsApp yedekleme dosyalar\u0131n\u0131 \u00e7alan ve dosyalar\u0131 silmek i\u00e7in komutlar alabilen Android GravityRAT casus yaz\u0131l\u0131m\u0131n\u0131n g\u00fcncellenmi\u015f bir s\u00fcr\u00fcm\u00fcn\u00fc analiz etti.<\/p>\n<p>Hindistan\u2019daki kullan\u0131c\u0131lar\u0131 hedef alan sald\u0131r\u0131larda kullan\u0131lan bir uzaktan eri\u015fim arac\u0131 olan GravityRAT\u2019in Windows, Android ve macOS s\u00fcr\u00fcmleri bulunuyor. GravityRAT\u2019in arkas\u0131nda kim oldu\u011fu bilinmiyor; ESET Research, SpaceCobra olarak bilinen grubu izliyor. B\u00fcy\u00fck olas\u0131l\u0131kla A\u011fustos 2022\u2019den beri aktif olan BingeChat kampanyas\u0131 hala devam ediyor. Yeni ke\u015ffedilen kampanyada GravityRAT, WhatsApp yedeklemelerine s\u0131zabiliyor ve dosyalar\u0131 silmek i\u00e7in komut alabiliyor. K\u00f6t\u00fc ama\u00e7l\u0131 uygulamalar ayr\u0131ca a\u00e7\u0131k kaynakl\u0131 OMEMO Instant Messenger uygulamas\u0131nda bulunan yasal sohbet i\u015flevselli\u011fi de sa\u011fl\u0131yor.<\/p>\n<p>K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131 ara\u015ft\u0131ran ESET ara\u015ft\u0131rmac\u0131s\u0131 Luk\u00e1\u0161 \u0160tefanko, \u201cUYGULAMAYI \u0130ND\u0130R&#8221; d\u00fc\u011fmesine dokunduktan sonra k\u00f6t\u00fc ama\u00e7l\u0131 uygulama yollayan bir web sitesi bulduklar\u0131n\u0131 ancak ziyaret\u00e7ilerin oturum a\u00e7mas\u0131n\u0131 gerektirdi\u011fini ifade ederek, &#8220;Kimlik bilgilerimiz yoktu ve kay\u0131t olamad\u0131k. Operat\u00f6rlerin kay\u0131tlar\u0131 yaln\u0131zca bekledikleri belirli bir kurban\u0131n, muhtemelen belirli bir IP adresi, co\u011frafi konum, \u00f6zel URL veya belirli bir zaman dilimi i\u00e7inde ziyaret etti\u011finde a\u00e7\u0131ld\u0131\u011f\u0131n\u0131 d\u00fc\u015f\u00fcn\u00fcyoruz. BingeChat uygulamas\u0131n\u0131 web sitesi \u00fczerinden indirememi\u015f olsak da, VirusTotal&#8217;da bir da\u011f\u0131t\u0131m URL\u2019si bulabildik.\u201d K\u00f6t\u00fc ama\u00e7l\u0131 uygulamaya Google Play store \u00fczerinden eri\u015fim sa\u011flanam\u0131yor&#8221; diye konu\u015ftu.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.igfhaber.com\/static\/16\/1687772170-figure-2-the-service-currently-doesn-t-provide-registrations-768x1621-1688288158-501.png\" width=\"646\" height=\"1363\" \/><\/p>\n<p><strong>POTANS\u0130YEL KURBANLAR HEDEF ALINIYOR<\/strong><\/p>\n<p>Facebook ara\u015ft\u0131rmac\u0131lar\u0131, Cisco Talos taraf\u0131ndan daha \u00f6nce tahmin edildi\u011fi gibi GravityRAT\u2019i Pakistan merkezli bir gruba ba\u011flasa da, k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131n arkas\u0131ndaki grup bilinmiyor. ESET bu grubu SpaceCobra ad\u0131yla izliyor.<\/p>\n<p>BingeChat ve Chatico kampanyalar\u0131n\u0131 bu gruba ba\u011fl\u0131yor.<\/p>\n<p>Uygulaman\u0131n yasal i\u015flevselli\u011finin bir par\u00e7as\u0131 olarak, bir hesap olu\u015fturma ve oturum a\u00e7ma se\u00e7ene\u011fi sunuluyor. Kullan\u0131c\u0131 uygulamaya giri\u015f yapmadan \u00f6nce GravityRAT, C&amp;C sunucusuyla etkile\u015fime ge\u00e7erek cihaz kullan\u0131c\u0131s\u0131n\u0131n verilerine s\u0131zmaya ba\u015fl\u0131yor ve komutlar\u0131n y\u00fcr\u00fct\u00fclmesini bekliyor.<\/p>\n<p>GravityRAT arama kay\u0131tlar\u0131, ki\u015fi listesi, SMS mesajlar\u0131, cihaz konumu, temel cihaz bilgileri ve resimler, foto\u011fraflar ve belgeler i\u00e7in belirli uzant\u0131lara sahip dosyalara s\u0131zabiliyor.<\/p>\n<p>GravityRAT\u2019in bu versiyonu, GravityRAT\u2019in bilinen \u00f6nceki s\u00fcr\u00fcmlerine k\u0131yasla iki g\u00fcncellemeye sahip: WhatsApp yedeklemelerine s\u0131zma ve dosyalar\u0131 silmek i\u00e7in komut alma.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.igfhaber.com\/static\/16\/1687772172-gravityrat-1688288200-758.png\" width=\"750\" height=\"260\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>ESET ara\u015ft\u0131rmac\u0131lar\u0131, Android tabanl\u0131 GravityRAT casus yaz\u0131l\u0131m\u0131n\u0131n BingeChat ve Chatico mesajla\u015fma uygulamalar\u0131 olarak da\u011f\u0131t\u0131lan g\u00fcncellenmi\u015f bir s\u00fcr\u00fcm\u00fcn\u00fc tespit etti.- kocaelikent \u0130STANBUL (\u0130GFA) &#8211; Siber g\u00fcvenlik \u015firketi ESET,\u00a0 WhatsApp yedekleme dosyalar\u0131n\u0131 \u00e7alan ve dosyalar\u0131 silmek i\u00e7in komutlar alabilen Android GravityRAT casus yaz\u0131l\u0131m\u0131n\u0131n g\u00fcncellenmi\u015f bir s\u00fcr\u00fcm\u00fcn\u00fc analiz etti. Hindistan\u2019daki kullan\u0131c\u0131lar\u0131 hedef alan sald\u0131r\u0131larda kullan\u0131lan bir uzaktan eri\u015fim &hellip;<\/p>\n","protected":false},"author":1,"featured_media":103445,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9500],"tags":[13516,13514,13515,13521,13090,13001,13512,13002,13088,38,13003,12964,13518,13005,12785,13513,13520,13089,13006,13519,13517],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/kocaelikent.com\/wp-json\/wp\/v2\/posts\/103444"}],"collection":[{"href":"https:\/\/kocaelikent.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kocaelikent.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kocaelikent.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kocaelikent.com\/wp-json\/wp\/v2\/comments?post=103444"}],"version-history":[{"count":2,"href":"https:\/\/kocaelikent.com\/wp-json\/wp\/v2\/posts\/103444\/revisions"}],"predecessor-version":[{"id":105899,"href":"https:\/\/kocaelikent.com\/wp-json\/wp\/v2\/posts\/103444\/revisions\/105899"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kocaelikent.com\/wp-json\/wp\/v2\/media\/103445"}],"wp:attachment":[{"href":"https:\/\/kocaelikent.com\/wp-json\/wp\/v2\/media?parent=103444"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kocaelikent.com\/wp-json\/wp\/v2\/categories?post=103444"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kocaelikent.com\/wp-json\/wp\/v2\/tags?post=103444"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}