Annual Cyber Threat Report 2025-26
The 2025-26 Annual Cyber Threat Report highlights key threats, responses and security advice for Australians.
Critical infrastructure
CI continues to be an attractive target for malicious cyber activity due to the valuable data it holds and the important role it plays in everyday life. Malicious cyber actors seek to exploit CI for various reasons, ranging from financial extortion to espionage. A cyber attack affecting CI could undermine key sectors’ functionality, including health and energy – causing operational disruptions and service shutdowns affecting millions of Australians.
In FY2025–26, CI incidents accounted for 10% of all incidents, similar with last year. ASD’s ACSC responded to 154 CI incidents, a decrease of almost 7% compared to the previous year.
The top 3 MITRE ATT&CK initial access techniques leading to CI-related incidents were:
- Phishing (36%) – Adversaries used malicious emails, messages or other communications to deceive users and gain initial access to systems or credentials.
- Valid Accounts (16%) – Adversaries obtained and misused legitimate user accounts to access networks and systems without triggering traditional security controls.
- Drive-by Compromise (10%) – Adversaries gained access when a user visited a compromised or malicious website, resulting in the unintended download or execution of malicious content.
Top 3 ANZSIC divisions for CI incidents:
- Financial and Insurance Services (30%)
- Public Administration and Safety (21%)
- Electricity, Gas, Water and Waste Services (17%)
Cybercriminals continue to opportunistically target CI operators. CI is an attractive target for cybercriminals seeking to extort victims due to the sensitivity of the data stored by these entities, and the criticality of their services.
State-sponsored cyber actors routinely target Australia’s CI networks, possibly to conduct espionage to gain a competitive and strategic advantage, or to pre-position for disruptive and destructive cyber effects against OT in the event of crisis or conflict. In crisis or conflict, access to an OT network could provide a malicious cyber actor with control over that infrastructure.
The following state-sponsored actors linked to the People’s Republic of China (PRC), Russia, and the Democratic People’s Republic of Korea (DPRK) have targeted Australia or its allies.
CI Fortify is ASD’s ACSC guidance for Australian CI operators to strengthen cyber resilience and prepare for cyber incidents, disruptions, and other threats to essential services. Building resilience is essential to protecting critical systems and maintaining the delivery of services that Australians rely on every day.
Effective cyber attacks on vital OT and enabling systems could incapacitate Australia
- APT40: PRC state-sponsored
Active since 2009: Targeting Australian networks - VOLT TYPHOON: PRC state-sponsored
Active since 2021: Targeting CI across the US and Asia Pacific - LAZARUS GROUP: DPRK state-sponsored
Active since 2009: Targeting CI worldwide - SALT TYPHOON: PRC state-sponsored
Active since 2019: Targeting 200 CI organisations across 80 countries - APT29: Russian intel-linked
Active since 2008: Targeting CI and western organisations
The cyber-attack response protocol (CART) helps coordinate the response to significant cyber incidents affecting Australia’s financial system by bringing together APRA, ASIC, the Reserve Bank of Australia and Treasury to share information, maintain situational awareness and support a common operating picture. The mechanism helps ensure that actions to maintain financial stability and the continuity of critical financial services are aligned across financial sector authorities.
During significant cyber incidents, CART supports coordination between financial sector response arrangements and broader Australian government cyber incident management frameworks. This helps align financial sector actions with national cyber response activities led by relevant agencies, including ASD’s ACSC and the Department of Home Affairs, ensuring regulatory, supervisory and operational responses are coordinated during incidents with potential cross-sector or national consequences.
By connecting financial sector authorities with broader government response arrangements, CART strengthens preparedness, supports timely decision-making and helps Australia respond more effectively to cyber incidents that could threaten critical financial services, financial stability or broader national interests.
In August 2025, a bank reported to ASD an incident involving two phone calls to its internal help desk, in which the callers impersonated staff members to obtain information.
The callers impersonated a Melbourne-based employee, using staff details such as the employee’s ID number, and claimed they were unable to connect with colleagues via Microsoft Teams. The calls indicated that the threat actor had conducted prior intelligence gathering on the organisation. Questions focused on a specialised financial services team located in Melbourne and Sydney and demonstrated insider knowledge.
The threat actors were manipulative, confrontational, and aggressive throughout the phone calls, employing a range of social engineering techniques to pressure help desk staff into compliance. They successfully obtained names, job titles, and corporate phone numbers for several staff members, potentially exposing employees to increased targeting by social media, and exposing the bank to an increased likelihood of follow-on attacks.
The bank noted that the targeted team and individuals were not public figures and this lack of visibility made it easier for the threat actors to manipulate help desk staff, as the staff did not immediately perceive the requests as suspicious.
During its investigation, the bank determined that the calls likely originated from a call centre or office environment, as multiple voices were audible in the background.
Furthermore, the calls were not made using Voice over IP (VoIP) technology and were confirmed to have originated from Hong Kong. Recent media coverage of vishing tactics targeting help desks prompted the bank to report the incident to ASD.
Since the incident, the bank’s cyber security team has led an awareness campaign and supported team leads with additional training. Incidents involving elements of social engineering remain common in reports to ASD as threat actors leverage vulnerabilities wherever they exist, technical or human.
Report a cybercrime or cyber security incident at cyber.gov.au/submit-a-report or call the 24/7 Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371)
In October 2025, ASD’s ACSC National Exercise Program delivered a national multi-sector operational cyber security exercise, Exercise Cyber Arrow (ECA). ECA involved multiple sectors from across Australia’s CI, including over 175 energy, communication, financial services and market sector organisations, and government entities.
The exercise provided technical and operational teams with the opportunity to get hands-on experience detecting and responding to a cyber incident, and enabled participants to validate and improve their cyber incident response plans and playbooks. Participants highlighted that the functional exercise environment enabled robust testing of protocols under conditions reflective of real-world operational complexity. The integration of adversary-modelled TTPs into the scenario strengthened participants’ capability to identify, mitigate, and proactively hunt for APT adversaries in real time, providing valuable insights into advanced detection and response practices.
ECA demonstrated how vital it is for CI sectors and government to work seamlessly together sharing intelligence, maintaining situational awareness, and responding decisively under pressure — to contain and manage a complex multi-sector cyber incident.
‘Cyber threats to Australian infrastructure require a coordinated national response, reinforcing the importance of initiatives like Exercise Cyber Arrow in driving continuous improvement in incident response. Through a practical, hands-on environment, Horizon Power was able to validate its detection and response capabilities and confirm the maturity of its incident response processes, while also identifying areas requiring further enhancement. Collaborative national exercises of this nature play a critical role in strengthening organisational readiness and contributing to a more resilient and prepared Australian cyber security ecosystem.’ Horizon Power.
‘ASD’s Cyber Arrow Exercise reinforced the importance of continued collaboration between government and industry to help strengthen Australia’s cyber resilience. It demonstrated the coordination and continued focus required to respond effectively to significant cyber events. ANZ supports initiatives that bring together cross-sector partners to enhance collective preparedness.’ ANZ
ASD encourages organisations to conduct cyber security exercises to validate and improve their plans, playbooks and technical capability to detect, respond to, and rapidly recover from a cyber incident.