14 million suspicious information security events in 3 months: report by the Cyber Rapid Response Team of the State Cyber Defense Center

 

Report by the Cyber Rapid Response Team of the State Cyber Defense Center – Q1 analytics, May 27, 2022

UKRAINIAN CYBERHUB

The largest since World War II, war on the European continent continues not only on the land and in the air, but also in cyberspace. The State Service of Special Communication and Information Protection of Ukraine is responsible for the standards of cybersecurity in the country and takes an active part in its defense. The lessons of this war are extremely important for enhancing the protection of democratic states attacked by aggressive countries like russia.

In this regard, the SSSCIP initiates making available a public analytical report on the state and means of cyber defense. The SSSCIP CyberHub will make public its data and conclusions that may be used by the global cyber community for their own defense.

The Cyber Rapid Response Team of the SSSCIP State Cyber Defense Center published a REPORT ON THE PERFORMANCE OF THE VULNERABILITY DETECTION AND CYBER INCIDENT RESPONSE SYSTEM in Q1 2022.

In the first three months of the current year, the system recorded 14 million suspicious cybersecurity events, of which 78 thousand were treated as critical. 40 cyber incidents were reported in total. 63% of the suspicious events were detected within ministries and organizations, 35% affected regional government administrations.

The most widespread categories of events included:

• Malware
• Phishing
• Intrusion attempt

The most active groups that attacked Ukraine in Q1 2022 were representatives of the russian federation, some of them are military-related:

• UAC-0010 (Armageddon)
• UAC-0098 (IcedID/Trickbot (?) group)
• UAC-0082 (Sandworm)
• UAC-0028 (APT28)
• UAC-0029 (APT29)
• UAC-0064 (SunSeed, Asylum Ambuscade)
• UAC-0035 (InvisiMole)
• UAC-0108 (KillNet)