# Security Attack Behavioural Pattern Analysis for Critical Service Providers
## 4 Cyber Attacks
### Attack Target  
The study found that the fourth classifier specifically recognised cyber infrastructure components as potential targets for malicious activity, which also included incidents occurring within the supply chain of the reporting organisation. The predominant category of attacks reported involved the deliberate targeting of software or software systems. This phenomenon was observed in 47% of cases out of a total of 120 reported incidents. Out of the 96 reports, 38% of them documented cases where users were specifically targeted in attacks. Afterwards, there were 26 reported cases of assaults on network infrastructure. In seven instances, the specific cyber infrastructure that was targeted was categorised as \"Unknown\" due to a lack of adequate information in the IT incident report. According to Figure 3, websites were the target of 47% of reported cyberattacks, while emails and databases were targeted by 10% and 8% of the attacks, respectively.  
A further analysis revealed that 70% of attacks causing denial of service targeted software systems, while 39% targeted websites. Many incidents have not affected internal cyber infrastructure but had the potential to disrupt external access to website resources. Additionally, 64% were attributed to threat actors targeting processing or network ca  
Figure 3: Operational Impact.  
pacity, resulting in DDoS attacks. Approximately 16% of attacks, or 41 cases, involved organisations indirectly affected by the cyberattack via supply chain links. The organisations were affected due to a supply chain organisation being compromised. In 59% of cases, the incident targeted the organisation's software system, while 22% affected a network supplier.  
Figure 3 shows that attacks on various cyber infrastructure components have had a direct impact on various degrees. Out of the attacks targeting users, predominantly using social engineering, 39% have not had any direct impact. Approximately 4% of attacks on software systems directly have not had any direct impact. All the reported attacks on network infrastructure components have effectively caused direct impact.  
**Implication:** The prevalence of social engineering incidents suggests that various deceptive tactics are commonly employed to gain unauthorised access to critical service providers. Figure 3 demonstrates that there was an increase in social engineering cases during the periods of April 2019-2020 and April 2020-2021, based on the use of attack vectors. During these periods, social engineering techniques were employed in 44% and 49% of the reported malicious incidents. In the meantime, the occurrence of social engineering declined, representing a mere 15% of the reported cyberattacks during the period of 2022-2023. This suggests that malicious actors are progressively employing alternative methods of attack.  
On the other hand, the targeted organisations are improving their ability to defend against these attacks, resulting in fewer reported incidents. During the period from April 2022 to April 2023, there was a significant rise in the use of capacity limits as a method of attack. This method went from accounting for around 20 percent of cyberattacks in the period from April 2019 to April 2022, to representing 52 percent of cyberattacks. As shown in Figure 2 there has been a relative increase in attacks targeting software systems as well as relative decrease in attacks targeting users' accounts more specifically.