{"id":34660,"date":"2026-09-18T14:38:37","date_gmt":"2026-09-18T11:38:37","guid":{"rendered":"https:\/\/akdenizolay.com.tr\/index.php\/2026\/09\/18\/eset-latin-amerika-hukumetlerini-hedef-alan-siber-casusluk-faaliyetlerini-ortaya-cikardi\/"},"modified":"2026-09-18T14:38:37","modified_gmt":"2026-09-18T11:38:37","slug":"eset-latin-amerika-hukumetlerini-hedef-alan-siber-casusluk-faaliyetlerini-ortaya-cikardi","status":"publish","type":"post","link":"https:\/\/akdenizolay.com.tr\/index.php\/2026\/09\/18\/eset-latin-amerika-hukumetlerini-hedef-alan-siber-casusluk-faaliyetlerini-ortaya-cikardi\/","title":{"rendered":"ESET, Latin Amerika h\u00fck\u00fcmetlerini hedef alan siber casusluk faaliyetlerini ortaya \u00e7\u0131kard\u0131"},"content":{"rendered":"<p> <strong>Siber g\u00fcvenlik \u015firketi ESET, \u00a0FamousSparrow \u00fczerinde s\u00fcrd\u00fcrd\u00fc\u011f\u00fc izleme \u00e7al\u0131\u015fmalar\u0131, \u00c7in ile ba\u011flant\u0131l\u0131 APT (Geli\u015fmi\u015f Kal\u0131c\u0131 Tehdit) \u00a0grubunun yeni bir arka kap\u0131 program\u0131 olan SparroWocky\u2019yi geli\u015ftirdi\u011fini ve en az\u0131ndan A\u011fustos 2025\u2019ten beri bunu Latin Amerika\u2019daki \u00e7e\u015fitli \u00fclkelerde da\u011f\u0131tt\u0131\u011f\u0131n\u0131 ortaya \u00e7\u0131kard\u0131.\u00a0<\/strong><\/p>\n<p><strong>Amerika Birle\u015fik Devletleri\u2019nin Latin Amerika\u2019ya artan ilgisine \u00c7in\u2019in verdi\u011fi tepki olarak, FamousSparrow\u2019un bu b\u00f6lgedeki devlet kurumlar\u0131n\u0131 hedef alan kapsaml\u0131 sald\u0131r\u0131lar\u0131n\u0131 art\u0131rd\u0131\u011f\u0131 d\u00fc\u015f\u00fcn\u00fcl\u00fcyor. ESET ara\u015ft\u0131rmac\u0131lar\u0131, toplanan ilk \u00f6rneklerin hepsinde \u0130ngiliz yazar, \u015fair ve matematik\u00e7i Lewis Carroll\u2019un (<em>Alice Harikalar Diyar\u0131nda\u2019n\u0131n<\/em> yazar\u0131) yazd\u0131\u011f\u0131 anlams\u0131z \u015fiir \u201cJabberwocky\u201dnin ilk k\u0131tas\u0131n\u0131n yer almas\u0131 nedeniyle bu arka kap\u0131ya SparroWocky ad\u0131n\u0131 verdiler.<\/strong><\/p>\n<p>FamousSparrow, 2019 y\u0131l\u0131ndan beri aktif oldu\u011fu d\u00fc\u015f\u00fcn\u00fclen, \u00c7in ile ba\u011flant\u0131l\u0131 bir siber casusluk grubu. ESET Research, grubu ilk olarak Eyl\u00fcl 2021\u2019de ProxyLogon g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131 istismar etti\u011fi s\u0131rada bir blog yaz\u0131s\u0131nda kamuoyuna duyurmu\u015ftu. Grup ba\u015flang\u0131\u00e7ta d\u00fcnya \u00e7ap\u0131ndaki otelleri hedef almas\u0131yla tan\u0131n\u0131yordu ancak daha sonra h\u00fck\u00fcmetleri, uluslararas\u0131 kurulu\u015flar\u0131, ticaret gruplar\u0131n\u0131, m\u00fchendislik \u015firketlerini ve hukuk firmalar\u0131n\u0131 da hedef ald\u0131. \u00a0ESET, bu arka kap\u0131n\u0131n kullan\u0131ld\u0131\u011f\u0131 ilk sald\u0131r\u0131lardan baz\u0131lar\u0131nda SparroWocky\u2019nin FamousSparrow\u2019a \u00f6zel SparrowDoor arac\u0131l\u0131\u011f\u0131yla da\u011f\u0131t\u0131lm\u0131\u015f olmas\u0131 nedeniyle son kampanyay\u0131 ve SparroWocky arka kap\u0131s\u0131n\u0131 FamousSparrow\u2019a atfediyor. Dahas\u0131, kurban profili FamousSparrow\u2019un \u00f6nceki hedefleriyle \u00f6rt\u00fc\u015fmekle kalm\u0131yor; ESET, daha \u00f6nce SparrowDoor ile hedef al\u0131nm\u0131\u015f olan bir\u00e7ok kurulu\u015fta SparroWocky\u2019yi kullanma giri\u015fimlerini de kaydetmi\u015ftir. FamousSparrow, SparrowDoor arka kap\u0131s\u0131n\u0131n bilinen tek kullan\u0131c\u0131s\u0131d\u0131r.\u00a0<\/p>\n<p>Mod\u00fcler bir C++ arka kap\u0131s\u0131 olan SparroWocky, mimarisi ve yazarlar\u0131 taraf\u0131ndan kullan\u0131lan teknikler, analiz \u00f6nleme hileleri ve Windows\u2019un i\u00e7 i\u015fleyi\u015fi konusunda derin bir bilgi birikimini g\u00f6steriyor. SparroWocky\u2019ye ge\u00e7i\u015fle birlikte FamousSparrow, a\u00e7\u0131k kaynakl\u0131 projelerden al\u0131nan kodlar\u0131 do\u011frudan k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131na d\u00e2hil etmeye ba\u015flad\u0131. ESET ara\u015ft\u0131rmac\u0131s\u0131 Alexandre C\u00f4t\u00e9 Cyr, d\u00fcnyaca \u00fcnl\u00fc \u015fiirden al\u0131nt\u0131 yaparak \u015fu a\u00e7\u0131klamay\u0131 yapt\u0131: \u201cNeyse ki SparroWocky\u2019nin i\u00e7 i\u015fleyi\u015fi, her ne kadar geli\u015fmi\u015f olsa da \u2018gyre and gimble in the wabe\u2019 kadar anla\u015f\u0131lmaz de\u011fil; bu sayede \u2018vorpal blade\u2019in ba\u015ftan a\u015fa\u011f\u0131 hareketi, bu arka kap\u0131n\u0131n ayr\u0131nt\u0131l\u0131 bir analizini sunmam\u0131z\u0131 sa\u011flad\u0131. Arjantin, Ekvador, Guatemala, Honduras, Panama, Peru, Porto Riko ve Venezuela\u2019daki devlet kurumlar\u0131na kar\u015f\u0131 yeni bir arka kap\u0131 yaz\u0131l\u0131m\u0131n\u0131n kullan\u0131ld\u0131\u011f\u0131n\u0131 tespit ettik. Bu durum, ESET\u2019in izledi\u011fi \u00c7in ba\u011flant\u0131l\u0131 APT gruplar\u0131 aras\u0131nda nadir g\u00f6r\u00fclen bir olay; \u00e7\u00fcnk\u00fc bu gruplar genellikle bu kadar uzun bir zaman diliminde d\u00fcnyan\u0131n \u00e7e\u015fitli b\u00f6lgelerinde g\u00f6zlemlenir.\u201d\u00a0<\/p>\n<p>Latin Amerika\u2019daki y\u00fcksek profilli hedeflere y\u00f6nelik bu siber casusluk e\u011filimi -en ge\u00e7- Temmuz 2025\u2019te ba\u015flam\u0131\u015f ve daha yak\u0131n zamanda SparroWocky\u2019nin devreye girmesiyle devam etmi\u015ftir. Asl\u0131nda, 2025 ortas\u0131ndan 2026\u2019ya kadar, ESET telemetrisinde kaydedilen grubun hedeflerinin y\u00fczde 90\u2019\u0131 bu b\u00f6lgede yer alm\u0131\u015ft\u0131r.\u00a0<\/p>\n<p>ESET, bu kesintisiz odaklanman\u0131n tesad\u00fcf olmad\u0131\u011f\u0131n\u0131 ve muhtemelen \u00c7in\u2019in b\u00f6lgede son d\u00f6nemde ABD\u2019nin \u00e7e\u015fitli giri\u015fimlerine verdi\u011fi tepkiyi yans\u0131tt\u0131\u011f\u0131n\u0131 d\u00fc\u015f\u00fcn\u00fcyor. Nitekim, ABD Ba\u015fkan\u0131 Donald Trump\u2019\u0131n ikinci d\u00f6nemi, Latin Amerika\u2019daki ABD \u00e7\u0131karlar\u0131n\u0131n agresif bir \u015fekilde yeniden teyit edilmesine yol a\u00e7m\u0131\u015ft\u0131. Bu durum, \u00c7in\u2019in son on y\u0131lda k\u0131tan\u0131n genelinde enerji, madencilik ve telekom\u00fcnikasyon gibi alanlarda geli\u015ftirdi\u011fi \u00e7e\u015fitli uzun vadeli yat\u0131r\u0131mlar\u0131 tehdit etmektedir. FamousSparrow\u2019un faaliyetleri, muhtemelen \u00c7in\u2019in yerel h\u00fck\u00fcmetlerin mevcut ABD bask\u0131lar\u0131na verece\u011fi tepkiyi daha iyi izlemesine ve \u00f6ng\u00f6rmesine yard\u0131mc\u0131 olmay\u0131 ama\u00e7lamaktad\u0131r. Baz\u0131 durumlarda, belirli unsurlar bu hipotezi a\u00e7\u0131k\u00e7a do\u011fruluyor gibi g\u00f6r\u00fcn\u00fcyor. \u00d6rne\u011fin, hedef al\u0131nan Panamal\u0131 kurulu\u015flardan biri, kanal b\u00f6lgesinde bulunan ve yak\u0131n zamana kadar \u00c7in merkezli bir \u015firket taraf\u0131ndan i\u015fletilen iki b\u00fcy\u00fck limanla ilgili devam eden ticari anla\u015fmazl\u0131\u011fa do\u011frudan d\u00e2hildir.\u00a0<\/p>\n<p>SparroWocky\u2019nin dikkat \u00e7eken \u00f6zellikleri aras\u0131nda, rastgele dosyalar\u0131 \u00e7al\u0131\u015ft\u0131rma, TCP proxy\u2019si olarak i\u015flev g\u00f6rme ve komutlar\u0131 y\u00fcr\u00fctme yetenekleri bulunuyor. Bu arka kap\u0131 ayr\u0131ca bilgisayar ad\u0131, kullan\u0131c\u0131 ad\u0131, etki alan\u0131 ad\u0131, Windows s\u00fcr\u00fcm\u00fc ve a\u011f aray\u00fczlerinin IP adresleri gibi, ele ge\u00e7irilen makineye ili\u015fkin genel bilgileri de topluyor. SparroWocky ayr\u0131ca dosyalar\u0131 d\u0131\u015far\u0131 s\u0131zd\u0131rma ve periyodik olarak ekran g\u00f6r\u00fcnt\u00fcs\u00fc alma yetene\u011fine de sahip. D\u0131\u015far\u0131 s\u0131zd\u0131r\u0131lan bilgiler RC4 kullan\u0131larak \u015fifrelenir ve TLS protokol\u00fc \u00fczerinden g\u00f6nderilir. Yap\u0131land\u0131rmas\u0131na ba\u011fl\u0131 olarak SparroWocky, \u00f6zel bir hizmet olu\u015fturarak veya kay\u0131t defterindeki Run anahtar\u0131na bir giri\u015f ekleyerek kal\u0131c\u0131l\u0131k sa\u011flayabilir.\u00a0<\/p>\n<p>K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m, analizini zorla\u015ft\u0131rmak ve mevcut olabilecek g\u00fcvenlik yaz\u0131l\u0131mlar\u0131ndan ka\u00e7\u0131nmak i\u00e7in birka\u00e7 teknik kullan\u0131r. Arka kap\u0131, tespit edilmekten ka\u00e7\u0131nmak amac\u0131yla bellekteki d\u00fc\u015f\u00fck seviyeli yap\u0131lar\u0131 manip\u00fcle eder ve \u00e7al\u0131\u015fma zaman\u0131nda kodu yamalar. FamousSparrow, kendi k\u00f6t\u00fc ama\u00e7l\u0131 hedefleri i\u00e7in h\u00e2l\u00e2 a\u00e7\u0131k kaynakl\u0131 sald\u0131r\u0131 ara\u00e7lar\u0131n\u0131 kullan\u0131yor. Daha \u00f6nce bu ara\u00e7lar, esas olarak grubun arka kap\u0131s\u0131 ile birlikte kullan\u0131l\u0131yordu. ESET ara\u015ft\u0131rmac\u0131lar\u0131, SparroWocky\u2019nin a\u00e7\u0131k kaynak kodunu kendi \u00f6zel arka kap\u0131s\u0131na do\u011frudan entegre etme geli\u015ftirme yeteneklerine de sahip oldu\u011funu g\u00f6zlemledi. SparroWocky, bir\u00e7ok k\u0131rm\u0131z\u0131 tak\u0131m ve s\u0131zma testi arac\u0131 taraf\u0131ndan desteklenen \u00f6zel bir y\u00fcr\u00fct\u00fclebilir dosya t\u00fcr\u00fc olan Beacon Object Files\u2019\u0131 y\u00fckleme ve \u00e7al\u0131\u015ft\u0131rma yetene\u011fine sahip.<\/p>\n<p>\u00a0<\/p>\n<p>Kaynak: (BYZHA) Beyaz Haber Ajans\u0131<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Siber g\u00fcvenlik \u015firketi ESET, \u00a0FamousSparrow \u00fczerinde s\u00fcrd\u00fcrd\u00fc\u011f\u00fc izleme \u00e7al\u0131\u015fmalar\u0131, \u00c7in ile ba\u011flant\u0131l\u0131 APT (Geli\u015fmi\u015f Kal\u0131c\u0131 Tehdit) \u00a0grubunun yeni bir arka kap\u0131 program\u0131 olan SparroWocky\u2019yi geli\u015ftirdi\u011fini ve en az\u0131ndan A\u011fustos 2025\u2019ten beri bunu Latin Amerika\u2019daki \u00e7e\u015fitli \u00fclkelerde da\u011f\u0131tt\u0131\u011f\u0131n\u0131 ortaya \u00e7\u0131kard\u0131.<\/p>\n","protected":false},"author":1,"featured_media":34661,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-34660","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-teknoloji"],"_links":{"self":[{"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/posts\/34660","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/comments?post=34660"}],"version-history":[{"count":1,"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/posts\/34660\/revisions"}],"predecessor-version":[{"id":34662,"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/posts\/34660\/revisions\/34662"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/media\/34661"}],"wp:attachment":[{"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/media?parent=34660"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/categories?post=34660"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/akdenizolay.com.tr\/index.php\/wp-json\/wp\/v2\/tags?post=34660"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}