Among the main trends of the second half of 2023:

• Attacks on telecommunications and Internet service providers as an attempt to maintain the initiative and presence in Ukrainian information infrastructure facilities;
• Attacks on military systems to access, control, and extract intelligence from specialized situational awareness systems - a strategic military objective of the enemy;
• Attacks on users of mobile devices, including the distribution of fake software versions and hacking of messengers used by the military.

While the first half of 2023 was dominated by attempts to exploit vulnerabilities and compromise accounts, in the second half of the year we are seeing a shift to phishing attacks and attempts to infect the CSP. This is due to a significant decrease in the enemy's presence in networks, clearing of implants, installation and connection of sensors, and qualitative analysis of telemetry.

Financially motivated hacker groups also became more active against Ukrainian businesses and organizations. In the second half of 2023, 40% of reported incidents were related to theft of funds.

The most common primary compromise vectors were:

• Known vulnerabilities (PHP, MS Exchange, FortiGate, Zimbra)
• Compromised accounts (-> VPN -> LAN)
• Spear phishing
• Self-infection (installation of operating systems and software downloaded from unofficial sources and trackers).

Given the current situation, the Cyber Center of the State Special Communications Service of Ukraine urges organizations to take professional help and use all necessary resources to ensure protection during martial law, including

• Reducing the attack surface
• Multi-factor authentication
• Network segmentation
• Restriction of administrative accounts
• Filtering of outgoing “Egress” information flows
• Functioning software protection: on PCs and servers
• Control of programs, including legitimate utilities.