TTPs_3_공격자의_악성코드_활용_전략_분석.pdf (4 MB)

The source analyzes attacker malware tradecraft through a MITRE ATT&CK-oriented lens, focusing on how malware is used after execution to retrieve additional scripts from command-and-control infrastructure, inject DLLs into privileged processes, and collect user account information through keylogging. It also highlights infection through shared content and the limits of IOC-only defenses, making the report useful for defensive mapping of post-compromise malware behavior.