Siber g\u00fcvenlik \u015firketi ESET, Ukraynal\u0131 bir tah\u0131l \u015firketine y\u00f6nelik y\u0131k\u0131c\u0131 bir siber sald\u0131r\u0131n\u0131n \u00f6n\u00fcn\u00fc a\u00e7an MythicRatatoskr adl\u0131 zararl\u0131 yaz\u0131l\u0131m\u0131 ortaya \u00e7\u0131kard\u0131. Siber sald\u0131rganlar\u0131n sisteme uzaktan eri\u015fmesini sa\u011flayan bu yaz\u0131l\u0131m, sald\u0131r\u0131y\u0131 y\u00f6nettikleri sunucuyu gizlemek i\u00e7in Yggdrasil adl\u0131 \u00f6zel bir a\u011f teknolojisinden yararlan\u0131yor. Rusya yanl\u0131s\u0131 UAC-0099 grubu \u015firkete ilk eri\u015fimi sa\u011flad\u0131ktan sonra kontrol\u00fc yine Rusya yanl\u0131s\u0131 Sandworm grubuna devretti. Sandworm ise sald\u0131r\u0131n\u0131n devam\u0131nda \u015firketin verilerini silerek sistemlerine zarar verdi.<\/p>\n
Yay\u0131mlanan raporda belgelenen bu devir teslim ilk de\u011fil: ESET Research, 2025 y\u0131l\u0131nda da Rusya yanl\u0131s\u0131 Gamaredon\u2019un, yine Rusya yanl\u0131s\u0131 bir tehdit akt\u00f6r\u00fc olan Turla ile i\u015f birli\u011fi yapt\u0131\u011f\u0131n\u0131 ortaya \u00e7\u0131karm\u0131\u015ft\u0131. Sandworm, GRU\u2019nun 74455 numaral\u0131 birimiyle ili\u015fkilendiriliyor. ESET, bilinen hedefleme \u00f6r\u00fcnt\u00fclerini g\u00f6z \u00f6n\u00fcnde bulundurarak UAC-0099\u2019un da Rusya\u2019n\u0131n \u00e7\u0131karlar\u0131yla uyumlu hareket etti\u011fini de\u011ferlendiriyor. ESET ayr\u0131ca UAC-0099\u2019un Sandworm i\u00e7in ilk eri\u015fim grubu olarak faaliyet g\u00f6sterebilece\u011fi g\u00f6r\u00fc\u015f\u00fcnde.<\/p>\n
Sald\u0131r\u0131y\u0131 inceleyen ESET ara\u015ft\u0131rmac\u0131s\u0131 Anton Cherepanov\u00a0 yapt\u0131\u011f\u0131 a\u00e7\u0131klamada \u015funlar\u0131 s\u00f6yledi: \u201cUAC-0099, 16 Temmuz 2025\u2019te Ukrayna\u2019daki bir tah\u0131l lojistik \u015firketine, zararl\u0131 ek i\u00e7eren bir hedefli kimlik av\u0131 (spear phishing) e-postas\u0131 arac\u0131l\u0131\u011f\u0131yla ilk eri\u015fimi sa\u011flad\u0131. Bu e-posta, MATCHWOK arka kap\u0131s\u0131n\u0131n y\u00fcr\u00fctme zincirini tetikledi. Bir g\u00fcn sonra sald\u0131rganlar, Yggdrasil mesh a\u011f\u0131 i\u00e7inde bar\u0131nd\u0131r\u0131lan bir komuta ve kontrol sunucusuyla ileti\u015fim kuran MythicRatatoskr\u2019\u0131 devreye ald\u0131. Bu arka kap\u0131n\u0131n ba\u015fka hi\u00e7bir yerde kullan\u0131ld\u0131\u011f\u0131n\u0131 g\u00f6rmedik; ayr\u0131ca bir Linux varyant\u0131n\u0131n da bulunabilece\u011fine dair i\u015faretler tespit ettik. Yggdrasil, deneysel bir y\u00f6nlendirme \u015femas\u0131 kullanan merkeziyetsiz bir mesh a\u011f\u0131; d\u00fc\u011f\u00fcmler aras\u0131ndaki IPv6 ileti\u015fimi u\u00e7tan uca korunur.\u00a0<\/p>\n
MythicRatatoskr\u2019\u0131 Cherepanov ile ke\u015ffeden ESET ara\u015ft\u0131rmac\u0131s\u0131 Peter Str\u00fd\u010dek ise \u015fu a\u00e7\u0131klamay\u0131 yapt\u0131: \u201c\u2018Yggdrasil\u2019, \u0130skandinav mitolojisinde evrenin farkl\u0131 \u00e2lemlerini birbirine ba\u011flayan kutsal a\u011fac\u0131n ad\u0131. Bu a\u011fa\u00e7ta, tepesi ile k\u00f6kleri aras\u0131nda mesaj ta\u015f\u0131yan Ratatoskr ad\u0131nda bir sincap ya\u015far. Arka kap\u0131 Yggdrasil a\u011f\u0131nda ko\u015fu\u015fturan bir haberci rol\u00fc \u00fcstlendi\u011fi i\u00e7in ona MythicRatatoskr ad\u0131n\u0131 verdik.\u201d<\/p>\n
S\u0131zma sonras\u0131 y\u00fcr\u00fctme zinciri, daha \u00f6nce UAC-0099\u2019la ili\u015fkilendirilen iki zararl\u0131 yaz\u0131l\u0131ma, MATCHBOIL indiricisine ve MATCHWOK arka kap\u0131s\u0131na dayan\u0131yordu. Bu nedenle ESET, sald\u0131r\u0131n\u0131n bu a\u015famas\u0131n\u0131 UAC-0099\u2019a atfediyor. ESET ara\u015ft\u0131rmac\u0131lar\u0131, iki ay sonra g\u00f6zlemlenen veri silme faaliyetini ise kullan\u0131lan TTP\u2019lere (taktik, teknik ve prosed\u00fcrler) dayanarak Sandworm\u2019la ili\u015fkilendiriyor. ESET telemetrisi, UAC-0099\u2019un elde etti\u011fi ilk eri\u015fimin daha sonra y\u0131k\u0131c\u0131 Sandworm operasyonunda kullan\u0131ld\u0131\u011f\u0131n\u0131 g\u00f6steriyor.<\/p>\n
MythicRatatoskr; komut \u00e7al\u0131\u015ft\u0131rma, dosya sisteminde gezinme, dosya aktar\u0131m\u0131, ekran g\u00f6r\u00fcnt\u00fcs\u00fc alma ve proxy gibi standart arka kap\u0131 i\u015flevlerini destekliyor. Arka kap\u0131 b\u00fcy\u00fck olas\u0131l\u0131kla, ba\u011flant\u0131lar\u0131 ele ge\u00e7irilen a\u011f \u00fczerinden y\u00f6nlendiren bir SOCKS5 sunucusu kurmak i\u00e7in kullan\u0131ld\u0131. UAC-0099, yaln\u0131zca Ukrayna\u2019daki devlet kurumlar\u0131n\u0131, finans ve medya kurulu\u015flar\u0131n\u0131 hedef alan bir siber casusluk grubudur. ESET, hedefleme \u00f6r\u00fcnt\u00fclerine dayanarak grubun Rusya\u2019n\u0131n \u00e7\u0131karlar\u0131yla uyumlu oldu\u011funu d\u00fc\u015f\u00fcn\u00fcyor. Sandworm ise y\u0131k\u0131c\u0131 sald\u0131r\u0131lar ger\u00e7ekle\u015ftiren Rusya yanl\u0131s\u0131 bir tehdit grubudur.<\/p>\n
ESET Research, MythicRatatoskr\u2019a ili\u015fkin bulgular\u0131n\u0131 18 Eyl\u00fcl 2026\u2019da LABScon\u2019da ve 16 Ekim 2026\u2019da Virus Bulletin konferans\u0131nda sundu.<\/p>\n
\u00a0<\/p>\n
Kaynak: (BYZHA) Beyaz Haber Ajans\u0131<\/p>\n","protected":false},"excerpt":{"rendered":"
Siber g\u00fcvenlik \u015firketi ESET, Ukraynal\u0131 bir tah\u0131l \u015firketine y\u00f6nelik y\u0131k\u0131c\u0131 bir siber sald\u0131r\u0131n\u0131n \u00f6n\u00fcn\u00fc a\u00e7an MythicRatatoskr adl\u0131 zararl\u0131 yaz\u0131l\u0131m\u0131 ortaya \u00e7\u0131kard\u0131. Siber sald\u0131rganlar\u0131n sisteme uzaktan eri\u015fmesini sa\u011flayan bu yaz\u0131l\u0131m, sald\u0131r\u0131y\u0131 y\u00f6nettikleri sunucuyu gizlemek i\u00e7in Yggdrasil\u2026<\/p>\n","protected":false},"author":1,"featured_media":3143,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-3142","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-teknoloji"],"yoast_head":"\n