{"id":24691,"date":"2023-06-12T15:30:05","date_gmt":"2023-06-12T15:30:05","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=24691"},"modified":"2026-04-17T18:07:41","modified_gmt":"2026-04-17T18:07:41","slug":"turkey-companies-targeted-by-redbeard-with-phishing-attacks","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\/","title":{"rendered":"Turkey Companies Targeted by RedBeard with Phishing Attacks"},"content":{"rendered":"\n

<\/p>\n\n\n\n

I. Summary<\/h1>\n\n\n\n

Recently, NSFOCUS Security Labs observed some phishing attacks targeting Turkish companies, including the Turkish industrial group Borusan Holding, communication operator Turkcell, bank Vakıf Katılım, and online lottery service company Nesine. The attacker placed different types of phishing documents and new Trojan programs in this group of activities to steal file data of the target companies and plan for long-term control of these companies’ devices.<\/p>\n\n\n\n

The attacker claimed to be The RedBeard in the malicious code. So in this report, RedBeard will be referred to as the attacker.<\/p>\n\n\n\n

II. About RedBeard<\/h1>\n\n\n\n

<\/p>\n\n\n\n

Through correlation analysis, NSFOCUS Security Labs determined that the RedBeard in this incident was a new threat actor group or individual, mainly targeting various companies in Turkey. It is speculated that its profit comes from selling they steal.<\/p>\n\n\n\n

The RedBeard uses simple and effective attacks, but also has some innovation in the choice of attack tools and attack ideas. It prefers to launch internal watering hole attacks using the target compromised website as a springboard.<\/p>\n\n\n\n

The RedBeard’s known tool library includes a macro document for collecting victim information, a CoblatStrike penetration framework, a stager loader, and a new Trojan horse GoBeard.<\/p>\n\n\n\n

Currently, the RedBeard has not disclosed any information related to its geographical location.<\/p>\n\n\n\n

III. Attack Activities<\/h1>\n\n\n\n

3.1 Attack Targeting Borusan Holding<\/h2>\n\n\n\n

The earliest traceable activity of the RedBeard began in November 2022, mainly targeting a company called Borusan Holding.<\/p>\n\n\n\n

The general attack process of the RedBeard in this activity is shown as below:<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 3.1 Attack process used by the RedBeard in activities targeting Borusan Holding<\/p>\n\n\n\n

In this activity, the RedBeard first intruded and controlled a network device belonging to Borusan Holding (the corresponding IP address is 5.252.4.51), and deployed a Trojan horse control terminal in the device to implement phishing attacks against this company.<\/p>\n\n\n\n

It has not been confirmed how the RedBeard invaded the network device.<\/p>\n\n\n\n

The RedBeard deployed Apache HTTP server version 2.4.41 on the invaded network device and forged the Google Drive download page as shown below:<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 3.2 Forged site by the RedBeard for watering hole attacks<\/p>\n\n\n\n

Looking at the source code of the webpage, we can find that the watering hole site was modified and generated from the corresponding Google Drive page in the Turkish language.<\/p>\n\n\n\n

After clicking the Download button on the page, a phishing file named borusan.xlsm will be downloaded from https[:]\/\/borusan.drive-myaccount.com\/?download=.<\/p>\n\n\n\n

The following content will be displayed when opening the phishing document:<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 3.3 Phishing document used by the RedBeard in activity targeting Borusan Holding<\/p>\n\n\n\n

The phishing document contained the trademark of Borusan Holding and blurred it, and deceive the victim to do as Turkish prompt information to run the macro code in the document.<\/p>\n\n\n\n

After the code in the phishing document is run, basic information and screenshots of the victim’s host will be collected and sent to the 5.252.4.51 network device controlled by the RedBeard.<\/p>\n\n\n\n

The above attack method is in line with the commonly used asset detection and information collection logic of threat actors in the post-penetration stage. It can be inferred that the direct target of the RedBeard is staff in Borusan Holding company. Using the staff device, the threat actor probed the target assets and got prepared for subsequent malicious behaviors.<\/p>\n\n\n\n

In this attack activity, a unique feature is that the RedBeard ultimately chose phishing documents to implement information collection operations, which may be to bypass firewalls and traffic detection devices.<\/p>\n\n\n\n

Judging from the status of the above watering hole sites this attack lasted more than 5 months.<\/p>\n\n\n\n

3.2 Attack against Turkcell<\/h2>\n\n\n\n

During the period from March to April 2023, the RedBeard used similar tactics to carry out attacks against Turkcell, a communication operator in Turkey.<\/p>\n\n\n\n

The attack process of this activity is shown in the figure below:<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 3.4 Attack process used by the RedBeard in activity targeting Turkcell<\/p>\n\n\n\n

In this activity, the RedBeard posted a phishing document:<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 3.5 Phishing document used by the RedBeard in activity targeting Turkcell<\/p>\n\n\n\n

This phishing document inherits RedBeard’s thinking of social engineering, and is composed of vague document pictures and deceptive information in Turkish language. Analyzing the blurry image reveals that the icon is the same as the Turkcell’s icons.<\/p>\n\n\n\n

The function of this phishing document is not the same as the document for Borusan company. The malicious macro in this document will download and decrypt a piece of data located at http:\/\/167.71.11[.]62\/res.txt, extract the Trojan horse program from it and run it.<\/p>\n\n\n\n

The Trojan horse program is a new Golang backdoor through which RedBeard can control the victim’s host to execute attack commands or download and run other Trojan horse files.<\/p>\n\n\n\n

NSFOCUS Security Labs has named the Trojan horse program GoBeard.<\/p>\n\n\n\n

3.3 Spear phishing targeting banks and Internet companies<\/h2>\n\n\n\n

From February to April 2023, the RedBeard also launched a phishing attack against companies located in Istanbul using a general bait document of social engineering.<\/p>\n\n\n\n

The bait content for such attacks is shown in the following figure:<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 3.6 Phishing documents used by the RedBeard in spear phishing against companies in Istanbul<\/p>\n\n\n\n

This document is disguised as a document of the Ministry of Justice transmitted by the National Electronic Notification System (UETS) of Turkey, and the target is required to view its contents.<\/p>\n\n\n\n

The table content in this document is empty, with the aim of tricking the victim to enable Office’s document editing function, thereby triggering malicious macro code within it.<\/p>\n\n\n\n

The RedBeard used this template to send phishing documents to multiple companies, and the company name at the header of the document was adjusted according to the target company. The currently known affected companies are shown in the table below: <\/p>\n\n\n\n

Table 3.1 Known victim companies in RedBeard spear phishing attack<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Since the above-affected companies are not directly related, it is speculated that the attack activity is a non-directional spear phishing mainly targeting companies or groups set up in Istanbul and Turkey.<\/p>\n\n\n\n

After running the above phishing documents, the GoBeard Trojan horse was also downloaded and run to control the victim host.<\/p>\n\n\n\n

IV. Attack Tools<\/h1>\n\n\n\n

4.1 GoBread Trojan horse<\/h2>\n\n\n\n

The RedBeard used a new type of Trojan horse in attacks against Turkcell and spear fishing attacks against multiple Istanbul companies. NSFOCUS Security Labs named the Trojan horse GoBeard according to the information in the file.<\/p>\n\n\n\n

The GoBeard Trojan horse is a malicious program written in Golang. The author compiles it with the Golang version 1.20.1 and uses UPX to shell the program. The main functions of this Trojan horse are to execute specified commands, download files from URI, inject specified ShellCodes, etc.
GoBeard uses TCP to communicate with CnC, and uses Base64 encoding for AES encryption of communication content, increasing the difficulty of being detected.<\/p>\n\n\n\n

4.1.1 Network analysis<\/h3>\n\n\n\n

The Trojan horse uses TCP protocol to communicate:<\/p>\n\n\n\n

After the program starts, the decrypted string gets “TCP”, which is passed in with the hard coded CnC IP named net_ Dial’s function, loop until the connection is successful:<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 4.1 GoBeard and CnC connection<\/p>\n\n\n\n

After successfully connecting, use the network function implemented by the author and wait for CnC to send instructions:<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 4.2 Waiting for CnC instruction<\/p>\n\n\n\n

This function first performs Base64 decoding on the received data, then decrypts the data using AES and parses the instructions to execute the function:<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 4.3 Operations on data in receiving functions<\/p>\n\n\n\n

4.1.2 Detailed analysis<\/h3>\n\n\n\n

4.1.2.1 Encryption method<\/h4>\n\n\n\n

The GoBeard Trojan horse encrypts key strings and APIs, and decrypts them when used.<\/p>\n\n\n\n

GoBeard uses the same encryption method for key strings and network communication data, using AES-256-CTR encryption and transcoding to base64 encoding.<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 4.4 AES encryption in GoBeard<\/p>\n\n\n\n

The key used for AES encryption is 42EA995F878C0EC96135EEAAA0CA4CDFEAF3F031F5C0AC917A36582ECC74083D, with Vi of 094A2DB87CA55321D3FBE7B7A8DB7421. <\/p>\n\n\n\n

4.1.2.2 Execution process<\/h4>\n\n\n\n

GoBeard first decrypts the string and then connects to CnC (if the connection is not successful, it loops for the connection). After the connection is successful, it waits for the CnC command to be received. After the command is parsed, it compares the functional commands to execute subsequent functions. If the command program that does not exist in the Trojan horse is sent, it sends “COMMAND NOT FOUND” to CnC:<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 4.5 GoBeard execution process<\/p>\n\n\n\n

4.1.2.3 Major functions<\/h4>\n\n\n\n

The main functions of GoBeard include executing specified commands, injecting specified shellcode, and downloading files from URLs.<\/p>\n\n\n\n

The Trojan horse executes the specified command. It encrypts the key string and API, and decrypts them when used, increasing the difficulty of being detected.<\/p>\n\n\n\n

By sending a packet, It is proved that the program is running on the target system, and the packet contains the encrypted string ‘Hello C&C’:<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 4.6 Send online packets<\/p>\n\n\n\n

After successfully executing the specified command, the command for execution is sent to CnC while an error message is sent when failed:<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 4.7 Send specified command<\/p>\n\n\n\n

Table 4.1 GoBeard Command Function Comparison Table<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

GoBeard’s shell code execution capability enables it to load mainstream Trojan horses such as CobaltStrike stager to help attackers execute tasks in the post-penetration phase.<\/p>\n\n\n\n

4.2 Stager loader<\/h2>\n\n\n\n

The RedBeard used a special shell code loader during its attack in December 2022, mainly to load the stager shell code payload generated by running the CobaltStrike penetration framework.<\/p>\n\n\n\n

The loader program used the common dynamic loading Windows API technology of shellcode, and encrypts each string used by the program using different XOR keys.<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 4.8 String encryption strategy in the Stager Loader used by the RedBeard<\/p>\n\n\n\n

This program runs the stager payload within it by injecting itself. It has been found that the CnC of the stager carried in the sample is 167.71.11.62, which is consistent with the CnC address used in the RedBeard’s attack against Turkcell.<\/p>\n\n\n

\n
\"Red<\/a><\/figure>\n<\/div>\n\n\n

Figure 4.9 The stager information carried in the stager loader used by the RedBeard<\/p>\n\n\n\n

V. Conclusion<\/h1>\n\n\n\n

NSFOCUS Security Labs observed that phishing attacks against Turkey have continuously been increasing since 2022. The RedBeard attack disclosed this time is a representative of such events.<\/p>\n\n\n\n

The attack tactics of the RedBeard are simple and effective. The events that have occurred show that the tactic of watering hole sites in the white list that RedBeard relies on is the key to its successful lateral movement.<\/p>\n\n\n\n

In response to such attack ideas, how to avoid the abuse of vulnerable devices and how to defend against secondary infiltration behavior carried out through internal devices should become the focus of attention for companies when building a defense system.<\/p>\n\n\n\n

VI. IoCs<\/h1>\n\n\n\n

Phishing documents:<\/strong><\/p>\n\n\n\n

461a297aad0cc43ae86dcb3347615b224778e86fb57ad3eb781cc0A863438326<\/p>\n\n\n\n

7fefbddf11970fea1dec8c2618f8c3819544c79309bf595207f6f601d1861ef5<\/p>\n\n\n\n

E61ad1ca19a69d4c85b91d8b7b69cf08413fd78fd7df1c878a10a4c5b4497b9e<\/p>\n\n\n\n

7986f166a864c4b19bac2ccacdd91cecf46b95f073ecc78ed521e8b4fa307053<\/p>\n\n\n\n

E4aa4ba8503fac18dcbed4285d3186d5b4fc80f5584b5eacde2bf3026f068f49<\/p>\n\n\n\n

Stager loader Trojan horse:<\/p>\n\n\n\n

1f7c495e77ffcc0b160ff675bc9b8c774fe3fbc2acb416ecae60dcae2fcb7ca3<\/p>\n\n\n\n

GoBeard Trojan horses:<\/strong><\/p>\n\n\n\n

063edf9cb113941Eb73b3db4a34ac0c9f82a756ded9b0dc974dc9a85b466c169<\/p>\n\n\n\n

1e27243ac8e2edff7d5be32a012530add1bae71ad5452064dfcd35e69d95f313<\/p>\n\n\n\n

GoBeard CnC:<\/strong><\/p>\n\n\n\n

146.190.207.64:8080<\/p>\n\n\n\n

167.71.11.62:8080<\/p>\n\n\n\n

Site used for watering hole attack<\/strong><\/p>\n\n\n\n

5.252.4.51<\/p>\n<\/body><\/html>\n","protected":false},"excerpt":{"rendered":"

I. Summary Recently, NSFOCUS Security Labs observed some phishing attacks targeting Turkish companies, including the Turkish industrial group Borusan Holding, communication operator Turkcell, bank Vakıf Katılım, and online lottery service company Nesine. The attacker placed different types of phishing documents and new Trojan programs in this group of activities to steal file data of the […]<\/p>\n","protected":false},"author":1,"featured_media":24728,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","footnotes":""},"categories":[3,20],"tags":[582],"class_list":["post-24691","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","category-uncategorized","tag-phishing"],"acf":[],"yoast_head":"\nTurkey Companies Targeted by RedBeard with Phishing Attacks - NSFOCUS<\/title>\n<meta name=\"description\" content=\"Recently, NSFOCUS Security Labs observed some phishing attacks targeting Turkish companies, including the Turkish industrial group Borusan Holding, communication operator Turkcell, bank Vak\u0131f Kat\u0131l\u0131m, and online lottery service company Nesine.\" \/>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Turkey Companies Targeted by RedBeard with Phishing Attacks - NSFOCUS\" \/>\n<meta property=\"og:description\" content=\"Recently, NSFOCUS Security Labs observed some phishing attacks targeting Turkish companies, including the Turkish industrial group Borusan Holding, communication operator Turkcell, bank Vak\u0131f Kat\u0131l\u0131m, and online lottery service company Nesine.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nsfocusglobal.com\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\/\" \/>\n<meta property=\"og:site_name\" content=\"NSFOCUS\" \/>\n<meta property=\"article:published_time\" content=\"2023-06-12T15:30:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-04-17T18:07:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2023\/06\/phishing.jpg\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Turkey Companies Targeted by RedBeard with Phishing Attacks - NSFOCUS\" \/>\n<meta name=\"twitter:description\" content=\"Recently, NSFOCUS Security Labs observed some phishing attacks targeting Turkish companies, including the Turkish industrial group Borusan Holding, communication operator Turkcell, bank Vak\u0131f Kat\u0131l\u0131m, and online lottery service company Nesine.\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2023\/06\/phishing.jpg\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\\\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#\\\/schema\\\/person\\\/fd9ab61c9c77a81bbd870f725cc0c61d\"},\"headline\":\"Turkey Companies Targeted by RedBeard with Phishing Attacks\",\"datePublished\":\"2023-06-12T15:30:05+00:00\",\"dateModified\":\"2026-04-17T18:07:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\\\/\"},\"wordCount\":1878,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2023\\\/06\\\/phishing.jpg\",\"keywords\":[\"Phishing\"],\"articleSection\":[\"Blog\",\"Uncategorized\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\\\/\",\"name\":\"Turkey Companies Targeted by RedBeard with Phishing Attacks - NSFOCUS\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2023\\\/06\\\/phishing.jpg\",\"datePublished\":\"2023-06-12T15:30:05+00:00\",\"dateModified\":\"2026-04-17T18:07:41+00:00\",\"description\":\"Recently, NSFOCUS Security Labs observed some phishing attacks targeting Turkish companies, including the Turkish industrial group Borusan Holding, communication operator Turkcell, bank Vak\u0131f Kat\u0131l\u0131m, and online lottery service company Nesine.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\\\/#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\\\/#primaryimage\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2023\\\/06\\\/phishing.jpg\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2023\\\/06\\\/phishing.jpg\",\"width\":400,\"height\":300,\"caption\":\"Red phishing symbol on computer keyboard.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/nsfocusglobal.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Turkey Companies Targeted by RedBeard with Phishing Attacks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#website\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/\",\"name\":\"NSFOCUS\",\"description\":\"Security Made Smart and Simple\",\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#organization\",\"name\":\"NSFOCUS\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"width\":248,\"height\":36,\"caption\":\"NSFOCUS\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#\\\/schema\\\/person\\\/fd9ab61c9c77a81bbd870f725cc0c61d\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\\\/\\\/nsfocusglobal.com\"],\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/author\\\/admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Turkey Companies Targeted by RedBeard with Phishing Attacks - NSFOCUS","description":"Recently, NSFOCUS Security Labs observed some phishing attacks targeting Turkish companies, including the Turkish industrial group Borusan Holding, communication operator Turkcell, bank Vak\u0131f Kat\u0131l\u0131m, and online lottery service company Nesine.","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"pt_BR","og_type":"article","og_title":"Turkey Companies Targeted by RedBeard with Phishing Attacks - NSFOCUS","og_description":"Recently, NSFOCUS Security Labs observed some phishing attacks targeting Turkish companies, including the Turkish industrial group Borusan Holding, communication operator Turkcell, bank Vak\u0131f Kat\u0131l\u0131m, and online lottery service company Nesine.","og_url":"https:\/\/nsfocusglobal.com\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\/","og_site_name":"NSFOCUS","article_published_time":"2023-06-12T15:30:05+00:00","article_modified_time":"2026-04-17T18:07:41+00:00","og_image":[{"url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2023\/06\/phishing.jpg","type":"","width":"","height":""}],"author":"admin","twitter_card":"summary_large_image","twitter_title":"Turkey Companies Targeted by RedBeard with Phishing Attacks - NSFOCUS","twitter_description":"Recently, NSFOCUS Security Labs observed some phishing attacks targeting Turkish companies, including the Turkish industrial group Borusan Holding, communication operator Turkcell, bank Vak\u0131f Kat\u0131l\u0131m, and online lottery service company Nesine.","twitter_image":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2023\/06\/phishing.jpg","twitter_misc":{"Escrito por":"admin","Est. tempo de leitura":"12 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nsfocusglobal.com\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\/#article","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\/"},"author":{"name":"admin","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#\/schema\/person\/fd9ab61c9c77a81bbd870f725cc0c61d"},"headline":"Turkey Companies Targeted by RedBeard with Phishing Attacks","datePublished":"2023-06-12T15:30:05+00:00","dateModified":"2026-04-17T18:07:41+00:00","mainEntityOfPage":{"@id":"https:\/\/nsfocusglobal.com\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\/"},"wordCount":1878,"commentCount":0,"publisher":{"@id":"https:\/\/nsfocusglobal.com\/pt-br\/#organization"},"image":{"@id":"https:\/\/nsfocusglobal.com\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2023\/06\/phishing.jpg","keywords":["Phishing"],"articleSection":["Blog","Uncategorized"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/nsfocusglobal.com\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/nsfocusglobal.com\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\/","url":"https:\/\/nsfocusglobal.com\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\/","name":"Turkey Companies Targeted by RedBeard with Phishing Attacks - NSFOCUS","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/pt-br\/#website"},"primaryImageOfPage":{"@id":"https:\/\/nsfocusglobal.com\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\/#primaryimage"},"image":{"@id":"https:\/\/nsfocusglobal.com\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2023\/06\/phishing.jpg","datePublished":"2023-06-12T15:30:05+00:00","dateModified":"2026-04-17T18:07:41+00:00","description":"Recently, NSFOCUS Security Labs observed some phishing attacks targeting Turkish companies, including the Turkish industrial group Borusan Holding, communication operator Turkcell, bank Vak\u0131f Kat\u0131l\u0131m, and online lottery service company Nesine.","breadcrumb":{"@id":"https:\/\/nsfocusglobal.com\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\/#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nsfocusglobal.com\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\/"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\/#primaryimage","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2023\/06\/phishing.jpg","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2023\/06\/phishing.jpg","width":400,"height":300,"caption":"Red phishing symbol on computer keyboard."},{"@type":"BreadcrumbList","@id":"https:\/\/nsfocusglobal.com\/turkey-companies-targeted-by-redbeard-with-phishing-attacks\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nsfocusglobal.com\/"},{"@type":"ListItem","position":2,"name":"Turkey Companies Targeted by RedBeard with Phishing Attacks"}]},{"@type":"WebSite","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#website","url":"https:\/\/nsfocusglobal.com\/pt-br\/","name":"NSFOCUS","description":"Security Made Smart and Simple","publisher":{"@id":"https:\/\/nsfocusglobal.com\/pt-br\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nsfocusglobal.com\/pt-br\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#organization","name":"NSFOCUS","url":"https:\/\/nsfocusglobal.com\/pt-br\/","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#\/schema\/logo\/image\/","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","width":248,"height":36,"caption":"NSFOCUS"},"image":{"@id":"https:\/\/nsfocusglobal.com\/pt-br\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#\/schema\/person\/fd9ab61c9c77a81bbd870f725cc0c61d","name":"admin","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/nsfocusglobal.com"],"url":"https:\/\/nsfocusglobal.com\/pt-br\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/24691","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/comments?post=24691"}],"version-history":[{"count":0,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/24691\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media\/24728"}],"wp:attachment":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media?parent=24691"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/categories?post=24691"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/tags?post=24691"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}