Chapter 01
사이버 범죄의 이해 1 1
사이버 범죄의 정의와 역사 ·····························································3

1-1 사이버(Cyber)의 기원 ································································3
1-2 사이버 범죄의 정의 ····································································3
1-3 사이버 범죄의 발전 과정 ·····························································4
2
사이버 범죄의 분류 ·········································································5

2-1 정보통신망 침해범죄 ··································································6
2-2 정보통신망 이용범죄 ··································································7
2-3 불법 콘텐츠 범죄 ········································································8
3
사이버 범죄의 특징 ·········································································9

3-1 비대면성 ····················································································9
3-2 익명성 ·····················································································10
3-3 광역성 ·····················································································10
3-4 초국경성 ··················································································12
3-5 전문성 ·····················································································12
3-6 확장성 ·····················································································12
4
사이버 범죄자와 피해자의 특성 ···················································13

4-1 사이버 범죄자의 특징 ·······························································13
4-2 사이버 범죄 피해자의 특징 ·······················································13
5
주요 국내 사례 연구(2023~2025년) ··········································14
6
네트워크와 사이버 범죄의 관계 ···················································16

6-1 네트워크 자체가 공격의 대상이 되는 경우 ·································16
6-2 범죄를 가능하게 하는 인프라로 활용되는 경우 ··························16
6-3 일반 범죄의 장소로 이용되는 경우 ············································16
7
사이버 범죄통계 및 동향 ······························································17

7-1 전체 발생 현황(2024년 기준) ····················································17
7-2 유형별 발생 통계 ······································································17
7-3 신종 범죄 유형의 출현 ······························································18
8
사이버 범죄의 사회적 · 경제적 영향 ·············································19

8-1 경제적 피해 ·············································································19
8-2 사회적 영향 ·············································································19

8-3 국제적 영향 ·············································································19
9
사이버 범죄 수사의 특징과 현황 ··················································21

9-1 사이버 범죄 수사의 특징 ···························································21
9-2 수사 역량 및 대응 현황 ·····························································22
10
결론 ·································································································23

Chapter 02
데이터 3법과 개인정보 보호법 27 1
데이터 3법의 이해 ·········································································29

1-1 데이터 3법 개정의 배경 ····························································29
1-2 데이터 3법의 구성과 핵심 개정 내용 ·········································30
1-3 가명정보 제도의 도입(개인정보 보호법 제2조, 제28조의2~7) ·········31
2
개인정보 보호법 2020년 개정 주요 내용 ··································33

2-1 개인정보보호위원회의 독립 중앙행정기관 격상 ·························33
2-2 정보통신망법 개인정보 규정의 이관 ··········································34
2-3 수사 실무에서의 적용 법령 식별 ················································35
3
개인정보 보호법 2023년 전면 개정 ············································36

3-1 2023년 개정의 배경과 개요 ······················································36
3-2 핵심 개정 사항 ①: 개인정보 전송 요구권 신설 ···························37
3-3 핵심 개정 사항 ②: 자동화된 결정에 대한 거부권 및 설명 요구권 ······························································38
3-4 핵심 개정 사항 ③: 개인정보 국외 이전 규제 정비 ······················39
3-5 핵심 개정 사항 ④: 과징금 부과 기준 강화 ·································40
3-6 정보통신 서비스 제공자 특례 조항의 일반 조항 통합 ··················41
4
개인정보 보호법의 주요 처벌 조항과 수사 실무 ························42

4-1 형사처벌 조항 체계 ··································································42
4-2 주요 범죄 유형별 수사 포인트 ···················································44
4-3 개인정보 침해 신고 · 처리 절차 ··················································45
5
사이버범죄 수사 관련 주요 법률 현황 ·········································46

5-1 사이버범죄 관련 법령 체계도 ····················································46
5-2 딥페이크 관련 처벌 규정(2024년 개정 반영) ·····························47
5-3 전기통신금융사기 관련 법령 ·····················································49
6
최신 판례 및 사례 분석 ·································································50

6-1 개인정보 보호법 관련 주요 판례(2023~2025) ···························50

6-2 수사 사례: 불법 개인정보 데이터베이스 유통 사건(2024년) ··········52
7
한계와 향후 과제 ···········································································53

7-1 데이터 3법 및 개인정보 보호법 개정의 한계 ······························53
7-2 수사기관의 개인정보 수집 · 처리와 법적 쟁점 ·····························54
8
결론 ·································································································55

Chapter 03
사이버 범죄의 유형과 분류 61 1
사이버 범죄 분류 체계의 개요 ······················································63

1-1 분류의 필요성 ··········································································63
1-2 한국 경찰청의 분류 체계 ···························································63
2
정보통신망 침해 범죄 ···································································64

2-1 정의 및 법적 근거 ·····································································64
2-2 해킹(Hacking) ········································································65
2-3 DDoS 공격(Distributed Denial of Service) ···························67
2-4 악성코드(Malicious Code) ······················································68
3
정보통신망 이용 범죄 ···································································70

3-1 정의 및 특징 ············································································70
3-2 사이버 사기 ·············································································71
3-3 사이버 금융 범죄 ······································································71
3-4 사이버 명예훼손 ·······································································74
4
불법 콘텐츠 범죄 ···········································································75

4-1 정의 및 특징 ············································································75
4-2 사이버 음란물 및 딥페이크 성착취물 ·········································75
4-3 사이버 도박 ·············································································76
4-4 사이버 저작권 침해 ··································································77
5
최신 사이버 범죄 동향(2024~2025) ··········································78

5-1 SK텔레콤 BPFDoor 해킹 사건(2025년 4월) ·····························78
5-2 KT · LG유플러스 침해사고 및 통신 3사 해킹 ······························79
5-3 쿠팡 내부자 범죄 사건(2025년) ················································79
5-4 공급망 공격(Supply Chain Attack) ·········································80
5-5 AI 기술 악용 범죄 ····································································80
5-6 통계로 보는 최신 동향 ······························································81
6
결론 ·································································································81

Chapter 04
컴퓨터와 네트워크 기초 87 1
컴퓨터 구조와 기억장치 ································································89

1-1 컴퓨터의 기본 구조 ··································································89
1-2 주기억장치 ··············································································91
1-3 보조기억장치 ···········································································92
1-4 모바일 저장장치 ·······································································93
2
컴퓨터 부팅 절차 ···········································································95

2-1 부팅의 개념 ·············································································95
2-2 부팅 절차의 6단계 ····································································96
2-3 BIOS와 UEFI 비교 ···································································98
3
네트워크의 기본 원리 ···································································99

3-1 네트워크의 개념 ·······································································99
3-2 OSI 7계층 모델 ········································································99
3-3 TCP/IP 프로토콜 스택 ···························································100
3-4 IP 주소와 MAC 주소 ······························································101
3-5 포트 번호 ···············································································104
3-6 DNS(Domain Name System) ···············································105
4
클라우드 컴퓨팅 ··········································································106

4-1 클라우드의 개념 ·····································································106
4-2 클라우드 서비스 모델 ·····························································106
4-3 클라우드 배포 모델 ································································107
4-4 클라우드 포렌식의 도전 과제 ··················································107
5
모바일 기술 ··················································································109

5-1 모바일 운영체제 ·····································································109
5-2 모바일 파일 시스템 ································································110
5-3 모바일 앱 데이터 구조 ····························································110
5-4 모바일 보안 기술과 포렌식 영향 ··············································111
6
네트워크와 사이버 범죄의 관계 ·················································112

6-1 네트워크를 이용한 주요 범죄 유형 ··········································112
6-2 네트워크 포렌식 ·····································································114
6-3 네트워크 포렌식의 한계와 대응 방안 ·······································115
7
결론 ·······························································································116

Chapter 05
AI 기반 사이버 범죄 121 1
AI 기술과 사이버 범죄 ································································123

1-1 인공지능 기술의 발전 개관 ·····················································123
1-2 AI 기반 범죄의 특징과 위험성 ·················································124
1-3 생성형 AI의 범죄 악용 ····························································124
1-4 다크웹의 범죄 특화 AI ····························································125
2
AI 기반 주요 공격 기법 ·······························································126

2-1 AI 기반 피싱 및 스피어 피싱 ···················································126
2-2 AI를 이용한 악성코드 생성 ·····················································127
2-3 딥페이크(Deepfake) 범죄 ······················································128
2-4 AI 기반 사회공학 공격 ····························································130
2-5 AI를 이용한 여론조작 및 허위정보 유포 ··································131
3
AI 기반 사이버 범죄 대응 ···························································132

3-1 딥페이크 탐지 기술 ································································132
3-2 수사기관의 AI 활용 ································································133
3-3 AI 범죄의 법적 쟁점과 과제 ····················································133
3-4 비판적 분석: 현행 대응 체계의 한계 ········································134
4
AI 기반 사이버 범죄 수사 실무 ··················································135

4-1 딥페이크 범죄 수사 절차 ·························································135
5
관련 판례 분석 ·············································································137

5-1 딥페이크 관련 주요 판례 ·························································137

Chapter 06
딥페이크 범죄 143 1
딥페이크 기술의 이해 ·································································145

1-1 딥페이크의 개념과 어원 ··························································145
1-2 핵심 기술: 생성적 적대 신경망(GAN) ······································145
1-3 딥페이크 기술의 발전 단계 ·····················································146
1-4 딥페이크의 합법적 활용과 범죄적 악용 ····································147
2
딥페이크 성범죄 ··········································································147

2-1 성폭력처벌법 제14조의2 전면 분석 ·········································147
2-2 몸캠피싱(Sextortion): 딥페이크와의 결합 ······························150

3
딥페이크를 이용한 금융사기 ······················································151
3-1 음성 딥페이크 사기(AI Voice Cloning) ··································151
3-2 화상 딥페이크 사기 - BEC(Business Email Compromise)의 진화 ·····················152
3-3 국내 딥페이크 관련 보이스피싱 현황 ·······································153
4
딥페이크 범죄 수사 실무 ····························································154

4-1 초동수사 단계 - 신고 접수 및 피해자 보호 ·····························154
4-2 디지털포렌식 분석 - 딥페이크 증거의 기술적 특성 ·················155
4-3 피의자 추적 및 증거 수집 ·······················································157
4-4 위장수사(위장수사관 활용) ·····················································157
5
비판적 분석 및 향후 과제 ···························································159

5-1 딥페이크 처벌 법제의 쟁점 ·····················································159
5-2 탐지 기술과 생성 기술의 군비경쟁 ··········································159
5-3 피해자 지원 체계의 미흡 ·························································160
6
관련 판례 분석 ·············································································161

6-1 국내 주요 판례 ·······································································161

Chapter 07
랜섬웨어 범죄 167 1
랜섬웨어의 개념과 역사 ······························································169

1-1 랜섬웨어의 정의 ·····································································169
1-2 랜섬웨어의 역사 ·····································································169
2
랜섬웨어의 진화와 작동 원리 ·····················································170

2-1 세대별 진화 ···········································································170
2-2 서비스형 랜섬웨어(RaaS) ·······················································171
2-3 주요 랜섬웨어 그룹(2024년 기준) ···········································172
3
국내 랜섬웨어 피해 현황 ····························································173

3-1 KISA 침해사고 통계(KISA 2024년 하반기 보고서) ··················173
3-2 국내 주요 피해 사례 ·······························································173
4
랜섬웨어 범죄의 법률 적용 ·························································175

4-1 정보통신망법 제48조 - 핵심 조문 해설 ·································175
4-2 랜섬웨어 단계별 법률 적용표 ··················································175
5
랜섬웨어 범죄 수사 실무 ····························································176

5-1 초동 대응 체크리스트 ·····························································176
5-2 디지털포렌식 - 랜섬웨어 증거 분석 ·······································177
5-3 국제 공조 - 크로노스 작전(Operation Cronos) ···················177
6
몸값 지불의 법적 · 실무적 쟁점 ··················································178

6-1 몸값 지불 찬반 쟁점 ·······························································178
7
비판적 분석 및 향후 과제 ···························································179

7-1 현행 법제의 한계 ····································································179
7-2 제도적 개선 방향 ····································································179

Chapter 08

암호화폐 관련 범죄 183 1
블록체인 기술의 원리 ·································································185

1-1 블록체인의 개념과 구조 ··························································185
1-2 합의 메커니즘 ········································································186
1-3 스마트 컨트랙트 ·····································································186
1-4 퍼블릭 블록체인과 프라이빗 블록체인 ·····································187
2
주요 가상자산 유형 ·····································································188

2-1 비트코인(Bitcoin, BTC) ·························································188
2-2 이더리움(Ethereum, ETH) ····················································188
2-3 프라이버시 코인 ·····································································189
2-4 기타 주요 가상자산 ································································189
3
가상자산 지갑의 구조 ·································································190

3-1 지갑의 개념과 키 쌍 구조 ·······················································190
3-2 계층 결정성 지갑(HD Wallet)과 니모닉 시드 ··························190
3-3 지갑 유형 분류 ·······································································190
4
믹싱 · 텀블링 서비스 ····································································191

4-1 개념과 작동 원리 ····································································191
4-2 주요 수사 사례 ·······································································192
4-3 크로스체인 브릿지 악용 ··························································193
5
암호화폐 관련 주요 범죄 유형 ····················································193

5-1 현황 및 통계 ··········································································193
5-2 가상자산 거래소 해킹 ·····························································193
5-3 암호화폐 투자사기 ·································································194
5-4 NFT 사기 및 DeFi 해킹 ·························································196
5-5 다크웹 불법 거래 ····································································196

6
수사 기법과 절차 ·········································································197
6-1 온체인 분석(On-chain Analysis) ··········································197
6-2 오프체인 추적(Off-chain Analysis) ·······································198
6-3 국제 공조 수사 ·······································································199
7
법적 근거와 판례 ·········································································200

7-1 가상자산 이용자 보호 등에 관한 법률 ······································200
7-2 특정 금융거래정보의 보고 및 이용 등에 관한 법률 ···················200
7-3 가상자산 압수 및 몰수의 법적 근거 ·········································200
7-4 가상자산 압수 실무 절차 ·························································202
8
제도적 한계와 향후 과제 ····························································203

8-1 현행 제도의 한계 ····································································203
8-2 향후 과제 ···············································································204
9
결론 ·······························································································204

Chapter 09

초동수사 및 범인 추적 209 1
초동수사의 의의 및 원칙 ····························································212

1-1 초동수사의 개념 ·····································································212
1-2 초동수사의 중요성 - 단서의 휘발성 ·······································212
1-3 초동수사 체크리스트 ······························································213
2
도메인 주소의 조사 ·····································································214

2-1 도메인 주소의 개념 ································································214
2-2 도메인 정보 조회(WHOIS) 해설 ··············································214
2-3 도메인 주소의 IP 변환과 유의점 ·············································215
3
IP 주소에 대한 초동수사 ·····························································215

3-1 IP 주소의 개념 및 식별 한계 ···················································215
3-2 IP 주소 할당 체계 ··································································215
3-3 IP 등록정보 확인(IP WHOIS)과 해석 ······································216
3-4 통신이용자정보 및 통신사실확인자료 요청 절차 ······················216
4
접속기록 보존을 위한 조치 ·························································218

4-1 보존 조치의 목적 ····································································218
4-2 보존 · 제출 요청서 설계 ···························································218
5
범인 추적의 의의 ·········································································219

5-1 범인 추적의 목표: 신원 특정 + 소재 파악 ································219
5-2 다중 단서 결합(Multi-source Correlation) 접근법 ················219
6
IP 주소 추적 ·················································································220

6-1 웹 접속 기록(Access Log)과 게시판 DB 기록 ··························220
6-2 로그인 접속 기록(관리용 서비스 포함) ·····································220
7
E-mail 주소 추적 ·········································································221

7-1 E-mail 헤더 분석(개념 중심) ··················································221
7-2 웹메일 서비스 수사(자료 확보 관점) ········································221
8
VPN 및 익명화 도구 추적 ···························································221

8-1 VPN의 개념과 수사상 문제점 ·················································221
8-2 Tor 네트워크의 기본 구조(입구-중계-출구) ····························222
8-3 익명화 환경에서의 수사 원칙 ··················································222
9
다크웹 수사 ··················································································223

9-1 다크웹의 개념과 특성 ·····························································223
9-2 다크웹 범죄의 양상 ································································223
9-3 수사 방법의 주요 방향 ····························································224
10
법적 근거 ······················································································224

10-1 정보통신망법 - 범행 행위 규율 ···········································224
10-2 통신비밀보호법 · 전기통신사업법 - 자료 요청 절차 ···············225
11
결론 ·······························································································226

Chapter 10

압수 · 수색 229 1
압수 · 수색의 법적 기초 ·······························································231

1-1 형사소송법상 압수 · 수색의 의의 ··············································231
1-2 영장주의와 예외 ·····································································232
1-3 디지털 증거 압수의 특수성 ·····················································233
1-4 영장 청구 및 발부 절차 ···························································234
2
현장 압수 · 수색 ············································································235

2-1 압수 · 수색 사전 준비 ······························································235
2-2 현장 도착 및 초기 조치 ···························································237
2-3 유형별 현장 압수 · 수색 ···························································238
3
원격 압수 · 수색 ············································································240

3-1 원격 압수의 개념과 현황 ·························································240
3-2 법적 쟁점과 비교법적 검토 ·····················································241
3-3 원격 압수 집행 절차 및 주의 사항 ···········································242
3-4 네트워크 증거 유형별 수집 근거 ··············································242
4
특수한 상황의 압수 ·····································································243

4-1 암호화된 저장매체 대응 ··························································243
4-2 비밀번호 미제공 시 법적 대응과 쟁점 ······································244
4-3 다수 저장매체의 처리 ·····························································245
4-4 압수물 관리와 연계 보관성(Chain of Custody) ······················246
5
피의자 조사 ··················································································247

5-1 사이버 범죄 피의자의 심리적 · 행동적 특성 ······························247
5-2 조사 전 준비 ··········································································248
5-3 효과적인 조사 기법 ································································249
5-4 디지털 증거 제시와 진술 확보 ·················································250
6
결론 ·······························································································252

Chapter 11

디지털포렌식 기초 257 1
디지털포렌식 개요 ······································································259

1-1 디지털포렌식의 정의 ······························································259
1-2 디지털 증거의 특성 ································································260
1-3 디지털 증거의 증거능력 ··························································265
1-4 포렌식 4대 원칙 ·····································································267
2
증거물 수집 절차 ·········································································270

2-1 증거 수집의 법적 기초 ····························································270
2-2 현장 트리아지(Live Forensics) ··············································272
2-3 이미징 기법 ···········································································274
2-4 해시값 생성 및 검증 ·······························································276
2-5 증거물 인계인수 - Chain of Custody ··································276
3
컴퓨터 포렌식 ··············································································277

3-1 Windows 시스템 포렌식 ························································277
3-2 SSD 포렌식 ············································································281
3-3 삭제 파일 복구 ·······································································282
4
메모리 포렌식 ··············································································283

4-1 메모리 포렌식의 중요성 ··························································283
4-2 메모리 덤프 수집 ····································································285
4-3 Volatility를 이용한 메모리 분석 ·············································286
5
클라우드 포렌식 ··········································································287

5-1 클라우드 포렌식의 특수성 ······················································287
5-2 법적 절차 - 원격지 서버 압수수색 ·········································288
5-3 주요 클라우드 서비스 포렌식 ··················································289
6
결론 ·······························································································290

6-1 전자정보 압수 · 수색 4원칙(판례 종합) ·····································290
6-2 주요 포렌식 도구 요약 ····························································291

Chapter 12

고급 포렌식 기법 295 1
모바일 포렌식 ··············································································297

1-1 모바일 포렌식 개요 ································································297
1-2 iOS 포렌식 ············································································298
1-3 Android 포렌식 ·····································································300
1-4 메신저 포렌식 ········································································301
2
클라우드 포렌식 ··········································································303

2-1 클라우드 포렌식의 특성과 과제 ···············································303
2-2 주요 클라우드 서비스 포렌식 ··················································304
3
네트워크 포렌식 ··········································································305

3-1 네트워크 포렌식 개요 ·····························································305
3-2 패킷 캡처 및 분석 ···································································306
3-3 네트워크 로그 분석과 침입 탐지 ··············································307
4
악성코드 분석 ··············································································307

4-1 악성코드 분석 환경 구축 ·························································307
4-2 정적 분석 기법 ·······································································308
4-3 동적 분석 기법 ·······································································309
4-4 랜섬웨어 분석과 APT 악성코드 ··············································309
5
암호 해독 ······················································································310

5-1 패스워드 크래킹 기법 ·····························································310
5-2 암호화 파일 분석 ····································································311
6
포렌식 보고서 작성 ·····································································312

6-1 포렌식 보고서의 의의와 작성 원칙 ··········································312
6-2 보고서 구성 ···········································································312
6-3 시각화 자료 활용 ····································································313
7
결론 ·······························································································314

Chapter 13

공판 대응과 사이버 범죄 수사의 미래 319 1
공판중심주의와 디지털 증거의 증거능력 ·································321

1-1 공판중심주의의 법적 근거 ······················································321
1-2 디지털 증거의 개념과 법적 지위 ··············································322
1-3 증거능력의 3대 요건 ······························································323
2
전문법칙과 디지털 증거 ······························································325

2-1 전문법칙의 적용 체계 ·····························································325
2-2 디지털 증거와 형사소송법 제313조 ·········································326
2-3 형사소송법 제315조와 전자기록 ·············································327
3
법정 증거 제출 및 검증 절차 ······················································329

3-1 공판 전 증거 제출 준비 ···························································329
3-2 증거조사 절차 ········································································329
3-3 전자기록의 무결성 입증 ··························································330
4
법정 증언 실무 ·············································································331

4-1 증언 준비 ···············································································331
4-2 주신문(主訊問) 대응 ································································332
4-3 반대신문(反對訊問) 대응 ·························································332
4-4 기술적 내용의 효과적 전달 ·····················································333
5
주요 판례 심층 분석 ····································································335

5-1 디지털 증거 압수 · 수색 관련 판례 ············································335
5-2 전문법칙 관련 판례 ································································336
5-3 위법수집증거 관련 판례 ··························································337
5-4 통신비밀 관련 판례 ································································337
6
사이버 범죄 수사의 미래와 AI 활용 ···········································338

6-1 AI 기반 사이버 범죄 수사 기법 ···············································338
6-2 신종 사이버 범죄와 미래 수사 과제 ·········································339
6-3 국제 공조와 제도적 과제 ·························································340
7
결론 ·······························································································343