# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 2 Attack Cases by Malicious Codes
Nevertheless, these solutions did not effectively defend against this attack. This is because these types of defense systems can effectively prevent intrusion by known malicious codes, but unknown attacks are difficult to defend against. The vulnerabilities that were exploited in the 3.20 cyber terror attack include the acquisition of administrator authentication authority, the absence of non-repudiation and integrity check in distribution of general software files, and the lack of a protection function in the agent itself. These vulnerabilities prevented the detection and treatment of malicious code. Therefore, the attacker was able to remotely connect to the system, which allowed forremote control and communication of the infected system. Then, after additional malicious code was injected through the dropper and downloader function, the system and MBR were destroyed [11; 12; 13]. In addition, the private information of about 1.75 million customers was leaked from H company in April 2011 in the 6.25 hacking incident, and there were also attacks on the opening ceremony of the 2018 PyeongChang Olympics [11; 13; 14; 15; 16; 18]. International attack cases include Red October, eBay, Night Dragon, GhostNet, Operation Aurora, Duku, Stuxnet, RSA, Flame, TARGET, etc. [10; 11; 12; 13]. Red October is an APT attack that has been active since 2007; in this attack, malicious code has attacked governmental, research, energy, and nuclear organizations in several countries. The attacker sent an e-mail containing malicious code that exploited vulnerabilities in Microsoft Office and Excel to penetrate the target system, and the malicious code infected the victim's system. The infected system leaked sensitive information such as stored information, deleted information, and network equipment setting information that was stolen through modules. It leaked data from mobile devices such as smart phones as well as PCs [10]. Night Dragon was an APT attack that occurred from 2009 to 2011. In Night Dragon, Chinese servers leaked information about gas and oil production systems, oil exploration documents, and industrial control systems in Kazakhstan, Taiwan, Greece, and the United States. The attacker used social engineering techniques, Windows vulnerabilities, the Active Directory, and Remote Administration Tools (RATs), and they attempted to infect malicious code after uploading that malicious code through an SQL injection attack on a web server. After obtaining the account information to access the system, the attacker tried to access and collect sensitive information such as the account information of users in the system [10]. Another attack, the Operation Aurora APT attack, was discovered in January 2010. It took over software source code and critical data for telecommunications companies. In addition to social engineering techniques, the attacker used spy phishing to link to a malicious Web site using MS-10-002, a zero-day vulnerability in Internet Explorer. When the victim accessed the web site, the attacker gained access to the internal system through malicious JavaScript files, through which they could steal the source code and important data [10; 12]. The Stuxnet APT attack was discovered in June 2010. It aimed to destroy the system of a nuclear power plant. The attacker remotely manipulated the remote monitoring and control system in the power plant. To this end, the attacker exploited Windows shell LNK, Windows server service, Windows print spooler, and shared network service vulnerabilities. Moreover, this attack used a rootkit to hide itself and propagated malicious code in a self-replicating manner. In a more concerning APT attack, a USB storage device was used as an attack tool to physically penetrate into a separate network [10; 11; 13]. Duku, another APT attack that was similar to Stuxnet, was discovered in September 2011, but its purpose was to spy on users instead of destroying the system.