And also in this timeline, cyber espionage operations played an important role, confirming their growth (25% vs 18%), once again ahead of cyber warfare, stable to 5% from 6%) and hacktivism, which confirmed its tiny 3%. Apparently the geopolitical tensions that characterize this period are showing a modest impact so far.

In terms of attack techniques, the first two techniques confirmed their leadership in the chart, with malware preceding again account takeovers (up to 20% from 14%). This fortnight, the third place is taken by the generic exploitation of vulnerabilities (10%) meaning that in these case it was not possible to determine exactly which technique was used to carry on the attack.

And similarly to the previous timeline, in the second half of April, the technique T1190 – exploitation of public-facing applications leads the initial access with 25%, very close to 23%. Phishing continues to characterize the initial access as well, with generic phishing (T1566) at number two with 17% and spearphishing attachments (T1566.001) at number three with 10%.

Even in this fortnight if we aggregate the parent categories we have 37 events for phishing (corresponding to 32%) and 12 events for supply chain compromises (corresponding to 10%). In turn the exploitation of vulnerabilities, phishing and supply chain compromises dominate the initial access.

And finally, even in this timeline, targets belonging to the Information an Communication sector were hit the most with 34%, a consequence of the growth of supply chain attacks, once again ahead of targets in the Public Administration, stable at 23%, and Finance and Insurance down to 13% from 21%.

Besides these trends, this timeline in particular is rich of interesting events, such as additional mega breaches , so my final suggestion does not change: browse the timeline for the details of all the events collected in this fortnight.