Cyberattacks on business: 10 basic defences

Cyberattacks stopped being a problem only for the state and large corporations long ago. According to the review by Ukraine’s National Cybersecurity Coordination Center, CERT-UA handled 5,927 cyber incidents in 2025 — 37.4% more than a year earlier. The most frequent targets include not only state bodies and energy, but also healthcare, IT, electronic communications, transport and logistics.

Most attacks start with a few typical steps. Below is how companies are actually attacked and ten basic measures that close those steps.

How businesses are attacked

According to the review, the main initial access vectors in 2025 were social engineering, exploitation of vulnerabilities, compromised RDP and VPN accounts, supply chain attacks and unlicensed software with built-in backdoors. In practice it looks like this:

• Phishing posing as a counterparty. Emails imitating correspondence with partners: invoices, contracts, payment instructions. The goal is access to the online banking system and unauthorised payments. Such emails are often sent from hacked mailboxes of real companies, with malicious files hidden in password-protected archives, disk images or links to legitimate cloud services.
• Personalised phishing and messengers. Attackers pose as a manager, a colleague or a state agency, using real names and job titles. Increasingly they call first and then send a file via a messenger.
• Stolen passwords. Information stealers collect passwords, VPN configurations and session tokens. Corporate email, including Microsoft 365, is under attack too.
• Unprotected remote desktop. One group that encrypted the data of local authorities got in through RDP and deleted shadow copies before encrypting, to prevent recovery.
• Contractors. To send malware to utility companies, attackers used the hacked mailboxes of an equipment supplier.
• Data destruction. In the attack on Ukrzaliznytsia (Ukrainian Railways) in March 2025, the virtualisation and backup systems were destroyed at both the primary and the backup site.

10 basic defences

1. Multi-factor authentication for everything reachable from outside

VPN, email, cloud services, remote desktop, admin panels. The #StopRansomware Guide by the US agencies CISA, NSA and FBI recommends phishing-resistant multi-factor authentication for all services. Start with administrators and remote access.

2. No unnecessary entry points from the internet

RDP must not be exposed to the internet: remote access only via VPN with multi-factor authentication. Check what is published externally: mail servers, web applications, management panels. Web applications are worth protecting with a WAF.

3. Updates and vulnerability management

Update internet-facing systems first: VPN gateways, firewalls, mail servers. Regular scanning reveals weak spots before they are exploited — more on vulnerability management.

4. Email protection

Filter attachments and links; block password-protected archives and disk images if work does not require them. Set up SPF, DKIM and DMARC for your domain — this makes it harder for attackers to send email in your name.

5. The “check through another channel” rule

Confirm any change of bank details, urgent payment or access request with a call to a known number, not a reply to the same email. A few minutes of checking protect against the “phishing as a counterparty” scenario.

6. Workstation protection

Centralised endpoint protection with one console and reports. Separately — a ban on unlicensed software: the review names it as one of the entry vectors.

7. Least privilege, segmentation and contractor access

Separate admin accounts, rights only to what is needed, accounts blocked on the day an employee leaves. Split the network into segments — servers, accounting, guest Wi-Fi — so that one infected computer does not open access to everything; a next-generation firewall helps here. Contractors connect only with multi-factor authentication, with time-limited and logged access.

8. Backups an attack cannot reach

The 3-2-1 rule, with at least one copy offline or immutable, protected by separate credentials not reachable from the main domain. CISA recommends keeping offline, encrypted backups of critical data and testing them regularly. The Ukrzaliznytsia case shows that backup systems reachable from the same network can be destroyed together with the primary ones. How we build backup: IT infrastructure.

9. Monitoring and logging

Collect and analyse logs from network equipment, servers, email, endpoints and cloud services: an attack is easier to stop while it is being prepared than after encryption. If you have no monitoring team of your own, SOC as a Service takes this on.

10. A response plan and trained people

Decide in advance who makes decisions, how affected systems are isolated and whom to notify. CERT-UA advises establishing contact with the team before an incident. Train employees regularly to recognise phishing — with examples similar to the real emails your company receives. What the law requires for cyber protection is covered in “Ukrainian cybersecurity law: a guide for business”.

If an attack has already happened

1. Isolate affected systems from the network. This is the first step recommended by both CERT-UA and CISA. If a device cannot be disconnected, CISA advises powering it down.
2. Don’t delete or reinstall systems straight away. Logs and suspicious files are needed for analysis — CERT-UA asks organisations to be ready to provide them.
3. Change passwords from a clean device — administrators and remote access first.
4. Notify CERT-UA (incidents@cert.gov.ua) and, if money was affected, the cyber police.
5. Restore from verified backups — and only after the attackers’ way in has been closed.

If you need help, email contact@beregit.com with the subject INCIDENT — we handle these requests first. A first-steps guide is on the “Security incident” page.

Checklist

• Multi-factor authentication for VPN, email, cloud and administrators
• RDP is not exposed to the internet, the list of externally published services is up to date
• Internet-facing systems are updated first, vulnerabilities are scanned regularly
• Email is filtered, SPF, DKIM and DMARC are set up for the domain
• Bank detail changes and urgent payments are confirmed through another channel
• Endpoints are centrally protected, unlicensed software is banned
• Separate admin accounts, a segmented network, restricted contractor access
• There is an offline or immutable backup, restores are tested
• Event logs are collected and analysed
• A response plan, contact with CERT-UA and regular staff training

How Bereg-IT can help

Start with a consultation or an audit: we assess the risks and protection and draw up a prioritised roadmap. We implement and support protection — NGFW, WAF, endpoint protection, vulnerability management, DLP — and build backup that survives an attack. And SOC as a Service covers collecting and analysing security events, investigation, notification and response according to an agreed playbook.

The first consultation is free. Send a request and an information security specialist will get in touch.

Sources

1. National Cybersecurity Coordination Center at the NSDC of Ukraine, Review of the National Cybersecurity System of Ukraine 2025 (in Ukrainian) — CERT-UA statistics, entry vectors, attack examples: https://www.rnbo.gov.ua/files/2026/NATIONAL_CYBER_SCC/kiber_2025.pdf
2. CISA, MS-ISAC, NSA, FBI, #StopRansomware Guide (September 2023) — protective measures and response steps: https://www.cisa.gov/stopransomware/ransomware-guide
3. Government Portal of Ukraine, “SSSCIP: How CERT-UA responds to cyber incidents — from report to recovery” (10.02.2025, in Ukrainian) — first steps and CERT-UA contacts: https://www.kmu.gov.ua/news/derzhspetszviazku-iak-cert-ua-reahuie-na-kiberintsydenty-vid-povidomlennia-do-likvidatsii-naslidkiv
4. RFC 7489, Domain-based Message Authentication, Reporting, and Conformance (DMARC): https://www.rfc-editor.org/rfc/rfc7489