Annual Cyber Threat Report 2025-26
The 2025-26 Annual Cyber Threat Report highlights key threats, responses and security advice for Australians.
- Published
-
- Last reviewed
-
Cyber in modern conflict
Australia continues to face a complex set of strategic circumstances. New conflicts in the Middle East and ongoing conflict in Ukraine are fueling international instability – contributing to economic uncertainty and supply chain shock.
A range of actors, including state-sponsored actors, can use cyber means to achieve geostrategic, political or military effects during crisis or conflict. Malicious actors can conduct cyber operations at scale, which allows them to lay low in networks and generate effects across borders. These characteristics are increasingly valuable during a period of global instability.
The distinction between state-sponsored and cybercriminal activity continues to blur. Despite differing objectives, both often exploit the same vulnerabilities and use similar TTPs to compromise systems and extract data. This includes the use of AI.
As the 2026 National Defence Strategy identifies, threat deteriorating trends in Australia’s strategic environment have broadened and intensified. The international system is under greater strain than at any time since the end of the Cold War. New strategic challenges have emerged that further threaten Australia’s security and complicate the pursuit of Australia’s interests. The global rules-based order, which has underpinned Australia’s security and prosperity for decades, is in transition.
Intense competition between major powers – principally the US and China – will be an enduring feature of our strategic environment. Authoritarian regimes are also becoming more willing and able to disrupt CI, conduct cyber intrusions and engage in misinformation and disinformation campaigns. Malicious state and non-state-sponsored actors are continuing to improve their cyber capabilities, increasing the risk of disruptions to Australia’s critical systems, infrastructure and networks.
State-sponsored actors in modern conflict
State-sponsored actors have demonstrated both their capability and intent to use cyber as a disruptive and destructive tool in crisis or conflict. Modern conflicts have highlighted how militaries incorporate cyber effects to enable or facilitate operations. They also use cyber as a tool to shape or influence conditions in their area of operations to better suit their desired outcome.
State-sponsored actors are investing in disruptive cyber capabilities for future use in conflict. They can commit the necessary time and resources to gain access to a victim’s network and pre-position for future operations.
Hacktivists in modern conflict
Hacktivists are increasingly likely to pose a disruptive cyber threat to government and private sectors during crisis or conflict. While hacktivists are non-state-sponsored actors, they can also be patriotically motivated – targeting those whom they perceive as a threat to their own nation’s geopolitical objectives. The increasingly unpredictable and volatile international environment is motivating hacktivists to target entities or states whom they deem are adversarial to their ambitions.
Hacktivists are becoming increasingly willing to engage in disruption activities that pose a threat to Australia, regardless of whether hacktivists deliberately target the Australian entity itself. Australia’s geographical position in the Indo-Pacific places us at the forefront of many emerging global issues. Like other actors, hacktivists will likely benefit from emerging technologies, such as AI, to grow their capabilities and pose a bigger disruption threat to Australian sectors. Additionally, as Australia is heavily reliant on international supply chains, hacktivist disruption can affect Australia even if we are not the direct target.
- On 11 March 2026, Iranian hackers claimed responsibility for compromising Stryker, a US-based company that regularly imports surgical and pharmaceutical equipment into the Australian market. The group claimed this attack was in response to a US military strike in Iran. Although Australia was not directly targeted or impacted by this activity, the example highlights how Australia’s complex supply chain nevertheless exposes it to hacktivist activity, even if that activity does not directly target Australia.
- On 10 December 2025, ASD’s ACSC, alongside international partners, released an advisory assessing that pro-Russia hacktivist groups were targeting CI. They exploited insecure internet-facing virtual network computing (VNC) connections to infiltrate, or gain access to, operational technology (OT) systems. While these groups are generally less sophisticated and impactful than Advanced Persistent Threat (APT) actors, their activities have resulted in operational disruptions – including physical damage. Targeted sectors include water and wastewater systems, food and agriculture, and energy.