# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 2 Attack Cases by Malicious Codes  
Known APT attack cases rely on using several types of malicious code. In South Korea, there have been many major hacking attempts, such as the IceFog, H company, N company, S company, 3.20 cyber terror, and 6.25 hacking incidents [10; 11; 12; 13; 14; 15; 16]. IceFog was an APT attack that was detected in 2011 and which targeted research institutes, the defense industry, and mobile service companies, from which it stole information. This information included basic system information such as folder lists, adapter lists, IP configurations, and network information, along with sensitive information such as Windows address book (WAB) files, documents, user account credentials, etc. Spear phishing emails were used, which induced recipients to connect to malicious codes or malicious websites by clicking the links in the emails. Then, the malicious code sent in the emails infected the target systems by exploiting vulnerabilities in programs such as Microsoft Office. After infecting a system, the characteristics of the system were examined and investigated. If the system was a virtual machine or a fake system, the malicious code did not perform any malicious behaviors. However, if it was an actual system, the target information was captured [10]. In April 2011, N company suffered an APT attack, which resulted in the deletion of a large amount of data and paralysis of the target network. The attacker inserted malicious code into the target system by distributing free download coupons from websites engaged in malicious behaviors. After inserting 81 additional malicious codes into the laptop of the subcontractor who maintained the server, the attacker stole sensitive information that could be used to access the internal network, such as the administrator password. Malicious codes for eavesdropping and receiving attack commands via remote control were also installed in the same manner, and the server inside the N company was destroyed by the installed malicious code after receiving commands transmitted from the outside. The attacker deleted files with 31 specific extensions, then destroyed the hard disk. Many hard disks were attacked, and ultimately, 275 internal servers, 45 of 98 web servers, 180 internal servers, and 48 of 49 test servers were destroyed in this attack [11; 12]. A malicious attack in July 2011 resulted in the leakage of the personal data of 35 million individuals from S company. The leaked information included the ID, encrypted password, personal number, name, date of birth, sex, e-mail address, telephone number, and address of the individuals. The attacker hacked a public software update server to install malicious code, then collected internal information related to the database manager of any insider who downloaded this malicious code. After that, the attacker used this information to steal data stored in the database from a remote location [11; 12; 13]. The 3.20 cyber terror attack in March 2013 caused paralysis of the target network by erasing data from major broadasters and financial institutions. In this attack, the attacker hacked the web server and infected it with malicious code. Next, the malicious code was distributed to the PCs connected to this web server. Then, the attacker stole the administrator account of the antivirus software distribution server. In total, 89 malicious codes were placed on PCs, antivirus software distribution servers, and ATMs, and the hard disks of these machines were destroyed after files in a specific folder were deleted. The attacker damaged 48,862 hard disks in total, thus resulting in network paralysis. More importantly, anti-virus software and security solutions were running on these systems, and measures such as deployment of United Threat Management (UTM) have been taken to prevent intrusions from the outside. Here, UTM means a comprehensive management tool that includes various security tools such as Intrusion Detection System (IDS), Intrusion Prevention System (IPS), firewall, etc. [17].