An attacker has begun an operation by exploiting a vulnerability in a public-facing web server of a Ukrainian infrastructure entity, seeking initial access to the network. The attacker used a known exploit targeting a web application flaw, allowing them to initiate a connection from a suspicious external IP address.