An Analysis of the Behavior of APT Attack in the Ngay Campaign

The behavior of APT attack has been the hot topic in recent network security study. It is critical to understand the implementation principle of APT attack. In this paper, we analyze the behavior of APT attack in the Ngay campaign from two aspects: network traffic and code implementation. We first set up the attack chain by using network traffic analysis. Then, the vulnerability exploitation process is detailed through reverse code analysis. After that, we illustrate the process of building back door. Lastly, we introduce the obfuscation technology applied in the APT malware samples.