\u00a0Siber g\u00fcvenlik \u015firketi ESET, Rusya yanl\u0131s\u0131 UAC-0099 APT grubu taraf\u0131ndan kullan\u0131lan \u00f6zel bir C# indirici olan MATCHBOIL k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131n\u0131n evrimini belgeledi. Bu k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m, grubun C&C sunucusundan bir y\u00fck indirmek, onu y\u00fcklemek ve kal\u0131c\u0131l\u0131\u011f\u0131n\u0131 sa\u011flamak i\u00e7in kullan\u0131l\u0131yor.\u00a0ESET’in telemetri verilerinde tespit etti\u011fi kurbanlar, Ukrayna’da \u00e7e\u015fitli sekt\u00f6rlerde faaliyet g\u00f6steriyor.\u00a0<\/p>\n
UAC-0099, Ukrayna\u2019daki devlet kurumlar\u0131n\u0131, finans kurulu\u015flar\u0131n\u0131 ve medya kurulu\u015flar\u0131n\u0131 hedef alan bir siber casusluk grubu. Hedefleme kriterlerine dayanarak ESET, grubun Rus \u00e7\u0131karlar\u0131yla uyumlu oldu\u011funu; UAC-0099\u2019un, Ukrayna\u2019daki y\u0131k\u0131c\u0131 sald\u0131r\u0131lar\u0131yla tan\u0131nan ve yine Rusya ile uyumlu bir ba\u015fka grup olan Sandworm i\u00e7in ilk eri\u015fim arac\u0131s\u0131 olarak hareket edebilece\u011fini d\u00fc\u015f\u00fcn\u00fcyor.<\/p>\n
MATCHBOIL\u2019i analiz eden\u00a0ESET ara\u015ft\u0131rmac\u0131s\u0131 Fernando Tavella\u00a0 yapt\u0131\u011f\u0131 a\u00e7\u0131klamada \u015funlar\u0131 payla\u015ft\u0131: \u201cK\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m, hedefli oltalama e-postalar\u0131ndaki k\u00f6t\u00fc ama\u00e7l\u0131 ba\u011flant\u0131lar arac\u0131l\u0131\u011f\u0131yla da\u011f\u0131t\u0131l\u0131yor. Ba\u011flant\u0131ya t\u0131kland\u0131\u011f\u0131nda, kurban\u0131n bilgisayar\u0131na MATCHBOIL\u2019i indirip \u00e7al\u0131\u015ft\u0131ran bir VBScript dosyas\u0131 y\u00fck\u00fc i\u00e7eren bir ar\u015fiv dosyas\u0131 indirilir. \u00a0MATCHBOIL, tek seferlik bir indiriciden her iki dakikada bir C&C sunucusuyla ileti\u015fim kurabilen bir indiriciye d\u00f6n\u00fc\u015fm\u00fc\u015ft\u00fcr; 2025 y\u0131l\u0131n\u0131n sonlar\u0131nda UAC-0099, kullan\u0131c\u0131 y\u00fck\u00fc \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131nda g\u00f6r\u00fcnen bir grafik kullan\u0131c\u0131 aray\u00fcz\u00fc eklemi\u015ftir. Bu aray\u00fcz, 2026 y\u0131l\u0131n\u0131n ba\u015flar\u0131nda daha az dikkat \u00e7eken bir versiyona d\u00f6n\u00fc\u015ft\u00fcr\u00fclm\u00fc\u015ft\u00fcr.\u201d\u00a0<\/p>\n
UAC-0099, C&C sunucular\u0131n\u0131 bar\u0131nd\u0131rmak i\u00e7in BitLaunch gibi sanal \u00f6zel sunucular\u0131 ve bunlar\u0131 gizlemek i\u00e7in Cloudflare gibi bulut hizmetlerini kullan\u0131yor. Bu sunucular hem HTTP hem de HTTPS kullan\u0131yor.\u00a0<\/p>\n
MATCHBOIL, ilk olarak A\u011fustos 2025\u2019te CERT-UA taraf\u0131ndan belgelenmi\u015f olsa da ESET ara\u015ft\u0131rmalar\u0131, yaz\u0131l\u0131m\u0131n en az\u0131ndan 2024 y\u0131l\u0131ndan beri geli\u015ftirilmekte oldu\u011funu g\u00f6steriyor. ESET Ara\u015ft\u0131rma ekibinin analiz etti\u011fi k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131n en eski s\u00fcr\u00fcmleri Nisan 2024\u2019e, en yenileri ise Nisan 2026\u2019ya aittir; indiricinin her yeni s\u00fcr\u00fcm\u00fc bir \u00f6ncekinden daha geli\u015fmi\u015ftir. ESET\u2019in telemetri verilerinde tespit etti\u011fi MATCHBOIL siber casusluk sald\u0131r\u0131lar\u0131n\u0131n t\u00fcm kurbanlar\u0131, Ukrayna\u2019da \u00e7e\u015fitli sekt\u00f6rlerde faaliyet g\u00f6steren kurulu\u015flard\u0131. Temmuz-A\u011fustos 2025 aras\u0131nda ESET, bir\u00e7ok ula\u015ft\u0131rma \u015firketinde bu indiricinin \u00f6rneklerini tespit etti. Ayn\u0131 y\u0131l\u0131n Aral\u0131k ay\u0131nda ise bir imalat \u015firketinde g\u00f6r\u00fcld\u00fc. Daha sonra, Haziran 2026\u2019da ESET telemetri verileri, bu kez enerji sekt\u00f6r\u00fcndeki bir \u015firkette yeni MATCHBOIL \u00f6rneklerini kaydetti.\u00a0<\/p>\n
ESET Research\u2019\u00fcn Nisan 2024\u2019ten Nisan 2026\u2019ya kadar MATCHBOIL \u00f6rnekleri \u00fczerinde yapt\u0131\u011f\u0131 inceleme, kod d\u00fczeyindeki yap\u0131dan .NET Reactor gizleme arac\u0131n\u0131n kullan\u0131m\u0131na kadar bir\u00e7ok de\u011fi\u015fikli\u011fi ortaya \u00e7\u0131kard\u0131; bunlar\u0131n t\u00fcm\u00fc nispeten k\u0131sa bir s\u00fcrede hayata ge\u00e7irildi. Bu durum, UAC-0099 operat\u00f6rlerinin indirme arac\u0131n\u0131 geli\u015ftirmeye b\u00fcy\u00fck ilgi duyduklar\u0131n\u0131 g\u00f6stermektedir; bu ilgi, yaln\u0131zca g\u00fcvenlik \u00e7\u00f6z\u00fcmleri taraf\u0131ndan tespit edilmekten ka\u00e7\u0131nmakla kalmay\u0131p, gelecekteki sald\u0131r\u0131larda ara\u00e7 setlerinin \u00f6nemli bir par\u00e7as\u0131 olarak kullanmak amac\u0131yla da ortaya \u00e7\u0131kmaktad\u0131r.<\/p>\n
\u00a0<\/p>\n
Kaynak: (BYZHA) Beyaz Haber Ajans\u0131<\/p>\n","protected":false},"excerpt":{"rendered":"
\u00a0Siber g\u00fcvenlik \u015firketi ESET, Rusya yanl\u0131s\u0131 UAC-0099 APT grubu taraf\u0131ndan kullan\u0131lan \u00f6zel bir C# indirici olan MATCHBOIL k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131n\u0131n evrimini belgeledi. Bu k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m, grubun C&C sunucusundan bir y\u00fck indirmek, onu y\u00fcklemek ve\u2026<\/p>\n","protected":false},"author":1,"featured_media":1246,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1245","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-saglik"],"yoast_head":"\n