한수원_사이버공격_사고_분석.pdf (4 MB)

The KHNP incident analysis describes the December 2014 cyberattack timeline, including thousands of phishing emails sent to more than 3,500 employees from hundreds of accounts, malicious Hangul documents, staged data leaks, and destructive malware activity. The malware used anti-VM logic, randomization, service registration filenames, time checks, network attack functions, file wiping, hard disk destruction, and MBR code. The slide deck compares KHNP malware with Kimsuky activity, including Korean document use, phishing emails, TeamViewer, C2 patterns, shellcode, and IP ranges, while recommending stronger controls around phishing, document malware, personal email storage, retirees, and suppliers.