ANALYSIS OF CYBER ATTACKS AND THE ACTIVITIES OF APT GROUPS IN UKRAINE

Abstract

The article is devoted to the analysis of cyberattacks and the activities of the APT (Advanced Persistent Threat) group in Ukraine, which significantly intensified the trend of the last decade in the context of the growing globalization of information warfare and political conflicts. The paper takes an in-depth look at the methods, tactics, and procedures (TTP) used by known APT groups such as Sandworm, Fancy Bear (APT28), and Gamaredon to carry out targeted cyber-attacks against Ukraine. The main focus of the article is the identification of patterns in the activities of APT groups and the formation of recommendations for the development of effective cyber protection strategies. The work uses data from open sources, CERT-UA reports, and analytical materials of international companies to assess the current state of cyber security and identify existing vulnerabilities that can be used by attackers. The article details various cyber-attack techniques that include the use of polymorphic and metamorphic malware, supply chain attacks, and methods, tactics, and procedures according to the Mitre framework. Considerable attention is paid to strategies for protection against APT attacks, with a special focus on zero trust architecture (Zero Trust) and defense in depth (Defense in Depth), which includes the application of multi-level protection systems to minimize risks and ensure recovery after incidents. Also discussed are tactics to counter attackers, the use of advanced network and endpoint security solutions, and the widespread adoption of multi-factor authentication and methods to protect against phishing attacks. The article emphasizes the importance of a comprehensive approach to the construction of a protection system, which includes both technical and organizational aspects. The results of the study emphasize ensuring the constant updating of technologies and methods of threat analysis for an adequate response to modern and future cyber-attacks.