Abstract
This study aims to simulate the tactics and techniques of APT38 (Lazarus), one of the prominent cyber threat actors, as defined within the MITRE ATT&CK framework, in a virtualized corporate network environment, and to analyze the detection capabilities of existing security solutions against these attacks. During the simulation, the attacker gains access to the system by exploiting a vulnerability on the web server (web shell), then performs privilege escalation by leveraging a PrintSpooler vulnerability, and finally achieves lateral movement within the network using the compromised account to access sensitive data. The virtual infrastructure consists of DMZ and LAN segments and includes security solutions such as PfSense, Suricata, Splunk, and Carbon Black. Each step in the scenario is documented to correspond with relevant MITRE ATT&CK techniques. This study demonstrates the extent to which APT38's attack methods can be detected by security systems and presents improvements for activities that are not detected.