Kaspersky K\u00fcresel Acil M\u00fcdahale Ekibi (GERT), \u015firketlerin ortak altyap\u0131lar \u00fczerinde birden fazla sunucu ve i\u015f y\u00fck\u00fcn\u00fc \u00e7al\u0131\u015ft\u0131rmak ve y\u00f6netmek i\u00e7in kulland\u0131\u011f\u0131 ESXi ve Proxmox sanalla\u015ft\u0131rma ortamlar\u0131na y\u00f6nelik son fidye yaz\u0131l\u0131m\u0131 sald\u0131r\u0131lar\u0131n\u0131n, sanal makine izolasyonunun a\u015f\u0131lmas\u0131na dayanmad\u0131\u011f\u0131n\u0131 tespit etti. Sald\u0131rganlar\u0131n bunun yerine zay\u0131f y\u00f6netim kontrollerinden, birden fazla sistemde kullan\u0131lan root hesap bilgilerinden ve izleme sistemleri ile y\u00f6netici i\u015f istasyonlar\u0131ndaki yetersiz g\u00fcvenlik uygulamalar\u0131ndan yararlanarak sanalla\u015ft\u0131r\u0131lm\u0131\u015f altyap\u0131lara eri\u015fti\u011fi ve bu altyap\u0131lar\u0131 \u015fifreledi\u011fi belirlendi.<\/p>\n
Kaspersky uzmanlar\u0131, Ekim 2025’te ESXi ortam\u0131nda ger\u00e7ekle\u015fen BlackNevas fidye yaz\u0131l\u0131m\u0131 sald\u0131r\u0131s\u0131n\u0131 ve A\u011fustos 2026’da Proxmox ortam\u0131nda ya\u015fanan The Gentlemen fidye yaz\u0131l\u0131m\u0131 sald\u0131r\u0131s\u0131n\u0131 inceledi. Ara\u015ft\u0131rmalar, her iki olayda da sald\u0131rganlar\u0131n hiperviz\u00f6r\u00fcn g\u00fcvenlik s\u0131n\u0131rlar\u0131n\u0131 a\u015fmak yerine hatal\u0131 yap\u0131land\u0131rmalardan ve kimlik bilgilerinin a\u00e7\u0131\u011fa \u00e7\u0131kmas\u0131ndan yararland\u0131\u011f\u0131n\u0131 ortaya koydu. Zay\u0131f eri\u015fim kontrolleri, yetersiz a\u011f segmentasyonu, d\u0131\u015far\u0131dan eri\u015fime a\u00e7\u0131k y\u00f6netim hizmetleri ve ayr\u0131cal\u0131kl\u0131 hesap bilgilerinin g\u00fcvenli olmayan bi\u00e7imde y\u00f6netilmesi, sald\u0131rganlar\u0131n destek sistemlerinden sanalla\u015ft\u0131rma katman\u0131na ilerlemesine ve birden fazla ana sunucuyu etkilemesine olanak tan\u0131d\u0131.<\/p>\n
\u0130zleme sistemlerindeki g\u00fcvenlik a\u00e7\u0131\u011f\u0131. Kaspersky uzmanlar\u0131, kullan\u0131c\u0131 kimlik do\u011frulama ve eri\u015fim s\u00fcre\u00e7lerinin y\u00f6netildi\u011fi sanalla\u015ft\u0131r\u0131lm\u0131\u015f etki alan\u0131 denetleyicisi segmentindeki bir Windows sistemiyle ba\u011flant\u0131l\u0131 BlackNevas fidye yaz\u0131l\u0131m\u0131 faaliyetlerini inceledi. Windows sistemlerinde hangi uygulamalar\u0131n \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131\u011f\u0131n\u0131 ortaya koyabilen UserAssist kay\u0131tlar\u0131, uzaktan eri\u015fim arac\u0131 AnyDesk’in ve d\u00fc\u015f\u00fck seviyeli sistem faaliyetlerini incelemek i\u00e7in s\u0131kl\u0131kla kullan\u0131lan GMER program\u0131na ait bir \u00e7al\u0131\u015ft\u0131r\u0131labilir dosyan\u0131n kullan\u0131ld\u0131\u011f\u0131n\u0131 g\u00f6sterdi. S\u00f6z konusu altyap\u0131da ayr\u0131ca sanal makinelerin \u00e7al\u0131\u015ft\u0131\u011f\u0131 ESXi ana sunucular\u0131na geni\u015f eri\u015fim yetkilerine sahip PRTG Network Monitor adl\u0131 altyap\u0131 izleme platformu kullan\u0131l\u0131yordu.<\/p>\n
Kaspersky uzmanlar\u0131, en y\u00fcksek d\u00fczeyde y\u00f6netici yetkisi sa\u011flayan ayn\u0131 root parolas\u0131n\u0131n birden fazla sunucuda kullan\u0131ld\u0131\u011f\u0131n\u0131 tespit etti. \u0130zleme ortam\u0131n\u0131 ele ge\u00e7iren sald\u0131rgan, bu hesap bilgilerini kullanarak standart bir uzaktan y\u00f6netim protokol\u00fc olan SSH \u00fczerinden ESXi ana sunucular\u0131na ba\u011fland\u0131. Ard\u0131ndan esx adl\u0131 bir dosyay\u0131 sisteme y\u00fckleyerek \u00e7al\u0131\u015ft\u0131rmay\u0131 denedi. \u0130lk giri\u015fim, “Execution of non-installed file prevented” (Y\u00fckl\u00fc olmayan dosyan\u0131n \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131 engellendi) hata mesaj\u0131yla durduruldu. Ancak root eri\u015fimine sahip olan sald\u0131rgan, sistem ayarlar\u0131n\u0131 de\u011fi\u015ftirerek zararl\u0131 yaz\u0131l\u0131m\u0131 \u00e7al\u0131\u015ft\u0131rmay\u0131 ba\u015fard\u0131. Sald\u0131r\u0131 kapsam\u0131nda ayr\u0131ca adli bili\u015fim incelemelerinde tespit edilebilecek izleri azaltmak ve olay\u0131n sonradan ara\u015ft\u0131r\u0131lmas\u0131n\u0131 zorla\u015ft\u0131rmak amac\u0131yla sistem g\u00fcnl\u00fckleri silindi.<\/p>\n
A\u00e7\u0131kta b\u0131rak\u0131lan kimlik bilgileri. The Gentlemen fidye yaz\u0131l\u0131m\u0131n\u0131n kullan\u0131ld\u0131\u011f\u0131 ayr\u0131 bir Proxmox sald\u0131r\u0131s\u0131nda da benzer bir y\u00f6ntem izlendi. Bu olayda sald\u0131rgan, temel BT altyap\u0131s\u0131n\u0131n y\u00f6netiminde kullan\u0131lan ve ele ge\u00e7irilmi\u015f bir y\u00f6netici i\u015f istasyonunda saklanan notlardan y\u00f6netici hesap bilgilerini ve eri\u015fim ayr\u0131nt\u0131lar\u0131n\u0131 elde etti. Bu bilgiler sayesinde Proxmox’a en y\u00fcksek yetki d\u00fczeyine sahip root hesab\u0131yla giri\u015f yapan sald\u0131rgan, sanal makinelerle taray\u0131c\u0131 \u00fczerinden etkile\u015fim kurulmas\u0131n\u0131 sa\u011flayan uzaktan konsol ba\u011flant\u0131s\u0131 VNC WebSocket’i etkinle\u015ftirdi. Ard\u0131ndan bu eri\u015fimi kullanarak birlikte y\u00f6netilen ba\u011flant\u0131l\u0131 sunuculardan olu\u015fan k\u00fcme genelinde fidye yaz\u0131l\u0131m\u0131n\u0131 indirdi ve \u00e7al\u0131\u015ft\u0131rd\u0131. Sald\u0131r\u0131 sonucunda sanalla\u015ft\u0131r\u0131lm\u0131\u015f ortam \u015fifrelendi.<\/p>\n
Kaspersky K\u00fcresel Acil M\u00fcdahale Ekibi (GERT) Uzman\u0131 Rauf Johari\u00a0konuyla ilgili \u015funlar\u0131 s\u00f6yledi: “Bu vakalar, kurumlar\u0131n izleme platformlar\u0131n\u0131, y\u00f6netici i\u015f istasyonlar\u0131n\u0131 ve y\u00f6netim a\u011flar\u0131n\u0131 da sanalla\u015ft\u0131rma altyap\u0131s\u0131n\u0131n sald\u0131r\u0131 y\u00fczeyinin bir par\u00e7as\u0131 olarak de\u011ferlendirmesi gerekti\u011fini g\u00f6steriyor. Ayn\u0131 zamanda g\u00fcvenlik yamalar\u0131n\u0131 uygulaman\u0131n neden tek ba\u015f\u0131na yeterli olmad\u0131\u011f\u0131n\u0131 da ortaya koyuyor. T\u00fcm g\u00fcvenlik yamalar\u0131 uygulanm\u0131\u015f bir hiperviz\u00f6r bile sald\u0131rgan\u0131n ortak kullan\u0131lan bir paroladan, gere\u011finden fazla yetkilendirilmi\u015f bir izleme hesab\u0131ndan, a\u00e7\u0131k bir SSH ba\u011flant\u0131s\u0131ndan veya genel sunucu a\u011f\u0131ndan eri\u015filebilen bir y\u00f6netim aray\u00fcz\u00fcnden yararlanmas\u0131 durumunda ele ge\u00e7irilebilir. ESXi vakas\u0131nda sistemin yerle\u015fik \u00e7al\u0131\u015ft\u0131rma kontrol\u00fc ba\u015flang\u0131\u00e7ta beklendi\u011fi gibi \u00e7al\u0131\u015ft\u0131. Ancak sald\u0131rgan, sahip oldu\u011fu y\u00fcksek eri\u015fim yetkileri sayesinde bu korumay\u0131 devre d\u0131\u015f\u0131 b\u0131rakabildi. Bu nedenle i\u015fletmelerin sanalla\u015ft\u0131r\u0131lm\u0131\u015f altyap\u0131lar\u0131n\u0131 korumak i\u00e7in y\u00f6netici eri\u015fimlerini s\u0131k\u0131la\u015ft\u0131rmas\u0131, y\u00f6netim sistemlerini izole etmesi ve ayr\u0131cal\u0131kl\u0131 hesap bilgilerinin a\u00e7\u0131\u011fa \u00e7\u0131kma riskini azaltmas\u0131 temel g\u00fcvenlik \u00f6ncelikleri aras\u0131nda yer almal\u0131.”<\/p>\n
Kaspersky, kurulu\u015flar\u0131n bu t\u00fcr siber tehditlere kar\u015f\u0131 g\u00fcvenliklerini g\u00fc\u00e7lendirmeleri i\u00e7in \u015fu \u00f6nerilerde bulunuyor:<\/p>\n
\tSanalla\u015ft\u0131rma y\u00f6netim sistemlerini genel sunucu a\u011f\u0131ndan izole edin.\u00a0Y\u00f6netim aray\u00fczleri, izleme platformlar\u0131 ve y\u00f6netim a\u011flar\u0131, a\u011f segmentasyonu yoluyla ayr\u0131\u015ft\u0131r\u0131lmal\u0131 ve bu sistemlere yaln\u0131zca s\u0131k\u0131 g\u00fcvenlik kontrollerine tabi cihazlardan eri\u015fim sa\u011flanmal\u0131d\u0131r.
\n\tOrtak kullan\u0131lan veya yeniden kullan\u0131labilir ayr\u0131cal\u0131kl\u0131 hesap bilgilerinin rutin kullan\u0131m\u0131na ve saklanmas\u0131na son verin.\u00a0Root ve di\u011fer y\u00fcksek yetkili hesaplar s\u0131k\u0131 bi\u00e7imde kontrol edilmeli, parolalar\u0131 d\u00fczenli olarak de\u011fi\u015ftirilmeli ve bu bilgiler hi\u00e7bir zaman \u015fifrelenmemi\u015f d\u00fcz metin bi\u00e7iminde veya kolayca eri\u015filebilen kurum i\u00e7i sistemlerde saklanmamal\u0131d\u0131r.
\n\tY\u00f6netici eri\u015fimlerini gerekli olan en d\u00fc\u015f\u00fck yetki d\u00fczeyiyle s\u0131n\u0131rland\u0131r\u0131n.\u00a0\u0130zleme hesaplar\u0131nda, y\u00f6netici i\u015f istasyonlar\u0131nda ve hizmet eri\u015fimlerinde en az ayr\u0131cal\u0131k ilkesi uygulanmal\u0131d\u0131r. B\u00f6ylece destek sistemlerinden birinin ele ge\u00e7irilmesi durumunda sald\u0131rganlar\u0131n do\u011frudan hiperviz\u00f6r ana sunucular\u0131na ula\u015fmas\u0131 \u00f6nlenebilir.
\n\tSanalla\u015ft\u0131rma ana sunucular\u0131na eri\u015febilen sistemlerin g\u00fcvenli\u011fini g\u00fc\u00e7lendirin ve bu sistemleri s\u00fcrekli izleyin.\u00a0\u0130zleme sunucular\u0131, y\u00f6netici u\u00e7 noktalar\u0131 ve SSH eri\u015fim yollar\u0131 sald\u0131r\u0131 y\u00fczeyinin bir par\u00e7as\u0131 olarak ele al\u0131nmal\u0131d\u0131r. Daha g\u00fc\u00e7l\u00fc eri\u015fim kontrolleri, s\u00fcrekli izleme ve \u015f\u00fcpheli faaliyetlerin h\u0131zla tespit edilmesini sa\u011flayan mekanizmalar devreye al\u0131nmal\u0131d\u0131r.
\n\t\u00d6zelle\u015fmi\u015f g\u00fcvenlik \u00e7\u00f6z\u00fcmlerinden yararlan\u0131n. Kaspersky Cloud Workload Security, Kaspersky Hybrid Cloud Security ve Kaspersky Container Security \u00fcr\u00fcnlerini bir araya getirerek sanalla\u015ft\u0131r\u0131lm\u0131\u015f ortamlar\u0131n kar\u015f\u0131 kar\u015f\u0131ya oldu\u011fu g\u00fcvenlik risklerine y\u00f6nelik kapsaml\u0131 koruma sa\u011flar.
\n\t\u00c7ok katmanl\u0131 g\u00fcvenlik \u00e7\u00f6z\u00fcmlerini tercih edin.\u00a0\u00a0Kaspersky Next\u00a0gibi \u00e7\u00f6z\u00fcmler, ger\u00e7ek zamanl\u0131 koruma, tehdit g\u00f6r\u00fcn\u00fcrl\u00fc\u011f\u00fc, olay inceleme ve EDR ile XDR m\u00fcdahale yeteneklerini b\u00fct\u00fcnle\u015fik bir yap\u0131da sunar.
\n\tGeli\u015fmi\u015f siber g\u00fcvenlik hizmetlerinden destek al\u0131n.\u00a0Kaspersky Compromise Assessment,\u00a0Managed Detection and Response\u00a0ve\u00a0Incident Response\u00a0hizmetleri, tespit edilmesi g\u00fc\u00e7 siber sald\u0131r\u0131lara kar\u015f\u0131 korunmaya, g\u00fcvenlik olaylar\u0131n\u0131n ara\u015ft\u0131r\u0131lmas\u0131na ve kurum i\u00e7i siber g\u00fcvenlik uzmanl\u0131\u011f\u0131n\u0131n yetersiz oldu\u011fu durumlarda ek uzman deste\u011fi sa\u011flanmas\u0131na yard\u0131mc\u0131 olur.
\n\tSiber g\u00fcvenlik uzmanlar\u0131n\u0131n g\u00fcncel tehdit istihbarat\u0131na eri\u015fmesini sa\u011flay\u0131n.\u00a0Kaspersky Threat Intelligence\u00a0gibi hizmetlerden yararlanarak g\u00fcvenlik ekiplerinin sald\u0131rganlar\u0131n kulland\u0131\u011f\u0131 en yeni teknikler, taktikler ve prosed\u00fcrler hakk\u0131nda g\u00fcncel bilgi sahibi olmas\u0131 sa\u011flanabilir.<\/p>\n
\u00a0<\/p>\n
Kaynak: (BYZHA) Beyaz Haber Ajans\u0131<\/p>\n","protected":false},"excerpt":{"rendered":"
Kaspersky K\u00fcresel Acil M\u00fcdahale Ekibi (GERT), \u015firketlerin ortak altyap\u0131lar \u00fczerinde birden fazla sunucu ve i\u015f y\u00fck\u00fcn\u00fc \u00e7al\u0131\u015ft\u0131rmak ve y\u00f6netmek i\u00e7in kulland\u0131\u011f\u0131 ESXi ve Proxmox sanalla\u015ft\u0131rma ortamlar\u0131na y\u00f6nelik son fidye yaz\u0131l\u0131m\u0131 sald\u0131r\u0131lar\u0131n\u0131n, sanal makine izolasyonunun a\u015f\u0131lmas\u0131na\u2026<\/p>\n","protected":false},"author":1,"featured_media":4213,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-4212","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-teknoloji"],"yoast_head":"\n