Annual Cyber Threat Report 2025-26
The 2025-26 Annual Cyber Threat Report highlights key threats, responses and security advice for Australians.
- Published
-
- Last reviewed
-
State-sponsored actors
Great power competition and escalating geopolitical tensions are reflected in cyberspace. Over the 2025–26 financial year, Australia continued to experience persistent reconnaissance and testing of government and privately owned networks by state-backed actors.
State-sponsored actors have targeted Australian organisations, primarily to gain access to sensitive, or non-public information — not limited to government information. State-sponsored actors actively pursue information that can assist to fill their own intelligence gaps and to reduce their tactical, operational, strategic and commercial risk. This information can include data associated with individuals, operations, or organisational governance. This information is not exclusively held by governments and can almost certainly be gleaned from the networks of CI entities, private businesses, and individuals.
In the Indo-Pacific, state-sponsored actors are possibly preparing for eventualities, such as crisis or conflict, by pre-positioning capabilities for disruptive effects, or to access higher-value target networks to use at the time of their choosing. State-sponsored actors can use disruption to achieve strategic goals, such as limiting the ability to respond to an event or cause social unrest.
State-sponsored actors use a range of techniques to target Australian entities. State-sponsored actors will use low-effort or low-cost techniques to conduct opportunistic attacks and reserve advanced capabilities for high value targets.
In April 2026, ASD’s ACSC joined international partners in highlighting the major shift in the TTPs used by China-nexus cyber actors.
There has been a recent widespread change in the TTPs used by China-nexus cyber actors, moving away from the use of individually procured infrastructure, and towards the use of externally provisioned, large-scale networks of compromised devices.
Most China-nexus threat actors are believed to be using these covert networks. Multiple covert networks have been created and are regularly updated, and a single covert network could be used by multiple actors at one time. These networks are primarily made up of compromised Small Office Home Office routers, as well as Internet of Things (IoT) and smart devices.
Covert networks are used to connect across the internet in a low-cost, low-risk, deniable way, disguising the origin and attribution of malicious activity. These networks are used against targets of espionage and offensive cyber operations for each phase of the Cyber Kill Chain; from reconnaissance and malware delivery to command and control and data exfiltration.
Defending from attackers using covert networks will be different based on resourcing and the nature of the target organisation. All organisations should map and baseline their edge device traffic, especially VPN remote access connections, and adopt dynamic threat feed filtering that includes known covert network indicators. The advisory contains further specific guidance for small, medium and large organisations.
For more information, see Defending against China-nexus covert networks of compromised devices.