U51

Episodes

Episode 17

Episode 17 artworkAll episodes
Episode 1718:11

Episode 17, Sunday Special: Australia's Cyber Threat Report 2025-26, 1 November 2026

SpotifyApple PodcastsPocket Casts

ASD's seventh Annual Cyber Threat Report, released this week, says AI has amplified and sped up existing threats rather than creating new ones. This Sunday Special draws out five messages: patch in days, attackers log in rather than break in, medium businesses are taking the biggest cost rise, incidents are up and more serious, and the answer is an assumed-breach mindset plus the basics, with a short look at critical infrastructure.

The report

  • ASD's ACSC Annual Cyber Threat Report 2025-26. The full report, including the "assumed breach" call and the Essentials series. https://www.cyber.gov.au/sites/default/files/2026-10/Annual%20Cyber%20Threat%20Report%202025-26.pdf
  • ASD release. https://www.asd.gov.au/news/2026-10-27-australian-signals-directorate-releases-seventh-annual-cyber-threat-report-2025-26
  • Last year's report (2024-25 summary), for comparison. https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2024-2025
  • business.gov.au summary for businesses. https://business.gov.au/news/annual-cyber-threat-report-2025-26

Key figures (not read on air)

ASD changed how it categorises incidents in 2025-26, so category comparisons with 2024-25 are not like for like. - More than 82,000 cybercrime reports to ReportCyber, about one every six minutes, down about 3% from 84,700. - 1,524 incidents responded to, up from 1,253 (ASD says "more than 20%"). - More than 4,400 notifications to entities, up almost 80% by ASD's comparison. This year's total includes collective notices (about 2,200 individual notifications, up 33%, plus collective notices to about 2,100 entities). - Hotline calls: 37,500, down 12%. - Extensive compromises: 40, from 26 (not like for like); extensive ransomware incidents 24, from 16; extensive DDoS (distributed denial of service) 7, from 1, while overall DoS and DDoS incidents fell more than 60% to 80+. - Ransomware steady at 139 incidents. - Data breach incidents: 98, up 66%, about 6% of incidents (as a share, data breaches have stayed steady: 7% in 2021-22, 6% now). - Published CVEs (Common Vulnerabilities and Exposures) up 30%. - ASD tip-offs led to 362 incidents being found; one cPanel notification to 340 entities led to 60+ confirmed incidents. - Health Care is now the top non-government reporting sector (7%). Manufacturing entered the top 10 and Transport left it. - Average self-reported cost per business report: $93,500, up 16% (from $80,850). Small $55,400 (about flat, from $56,600). Medium $141,300, up 45% from $97,200. Large $148,100, down 27% from $202,700, partly reversing last year's 219% rise. - Individuals: $33,000 average per report, unchanged (separate from the "overall" average of $38,130). - 55% of people reuse passwords (Act Now. Stay Secure. campaign research quoted in the report). - Some exploitation occurs within 48 hours of a patch or mitigation advice; most within two weeks. A flaw from 2008 was exploited successfully this year.

Critical infrastructure

  • What the report says. Critical infrastructure (CI) is an attractive target for extortion because of its sensitive data and critical services; ASD says state-sponsored actors "routinely target" Australian CI networks, possibly for espionage or to pre-position against operational technology (OT) in a crisis or conflict. https://www.cyber.gov.au/sites/default/files/2026-10/Annual%20Cyber%20Threat%20Report%202025-26.pdf
  • Figures. 154 CI incidents, 10% of all incidents (similar to last year), down almost 7%; category changes mean this is not like for like. Top ways in: phishing 36%, valid accounts 16%, drive-by compromise 10%. Top sectors: Financial and Insurance Services 30%, Public Administration and Safety 21%, Electricity, Gas, Water and Waste Services 17%.
  • OT and supply chain examples. Pro-Russia hacktivists reached OT through exposed VNC remote access (ASD and partners advisory, 10 December 2025). An Iranian group's claimed compromise of Stryker, a US-based company that imports surgical and pharmaceutical equipment into Australia, was a supply-chain exposure rather than a direct attack.
  • Guidance. ASD's CI Fortify guidance for operators is on cyber.gov.au.

Outside the report: ASD interviews this week

  • Amadey botnet disruption and stolen-data destruction (ABC). ASD disconnected one Amadey botnet from about 180,000 infected computers worldwide. In a separate operation it destroyed 5 TB of stolen data, including about 4.8 million files from Australians. https://www.abc.net.au/news/2026-10-27/australian-signals-directorate-ai-cybersecurity-hacking-threats/107309858
  • ABC AM interview. Includes ASD's comments on future disruption and incident-response protocols with frontier AI labs. https://www.abc.net.au/listen/programs/am/asd-warns-of-looming-cyber-disruptions/107312354
  • ESET tracks 53 Amadey botnets (The Hacker News). https://thehackernews.com/2026/10/australia-gets-into-amadey-malware.html

AI on offence: confirmed versus claimed

  • Anthropic's exploit chains (lab work, not attacks). Five chains (Chrome, Safari, Android, Windows, Linux); fixes confirmed and credited; "little human involvement" is Anthropic's own account; none seen in real attacks. https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html
  • PHP2Shell intrusions (Dream's assessment). 25 servers rooted according to Dream, three in a US government-affiliated environment; nearly 40 scripts judged AI-assisted; Dream says it has "no direct evidence" AI wrote the exploit. https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers ; https://thehackernews.com/2026/10/php2shell-attack-roots-25-servers.html
  • ARTEX, South Korea (police allegations). Seven suspects, more than 90 organisations, about 8.2 million records, 360 million won demanded in 38 incidents; not tested in court. https://www.bleepingcomputer.com/news/security/former-pentester-used-artex-ai-to-steal-82-million-data-records/
  • Warp (company disclosure). Agent logs and telemetry exposed via a third-party vendor, "roughly 1%" of users; the "agent swarm" description is the CEO's account only. https://www.bleepingcomputer.com/news/security/warp-discloses-breach-exposing-ai-agent-logs-user-telemetry-data/

What to do

Report cybercrime at https://www.cyber.gov.au or on 1300 CYBER1 (1300 292 371).