Annual Cyber Threat Report 2025-26
The 2025-26 Annual Cyber Threat Report highlights key threats, responses and security advice for Australians.
- Published
-
- Last reviewed
-
Programs
Partnership and collaboration with ASD’s ACSC
ASD’s ACSC works closely with government and private enterprises to identify and disrupt malicious cyber activity and helps entities improve their cyber defence through a range of programs.
In FY2025–26, ASD’s Cyber Security Partnership Program grew to over 149,500 partners. ASD’s ACSC briefed board and executive leadership team representatives from 29% of the ASX100.
ASD’s Cyber Security Partnership Program is a national program delivered through ASD’s state offices, located around Australia. The program enables eligible Australian organisations to engage with ASD’s ACSC and industry and government partners, drawing on collective understanding, experiences, skills and capabilities to enhance understanding of the cyber threat, and uplift cyber resilience across the Australian economy.
The Cyber Hygiene Improvement Programs (CHIPs) is an open-source intelligence capability that discovers, identifies and regularly measures the cyber posture and hygiene of internet-facing systems, using objective and data-driven approaches. The program relies on a mixture of open-source, commercial and directly collected data.
CHIPs helps to improve cyber hygiene, particularly in attack surface reduction, by providing entities with regular reports that identify the extent of their internet-facing systems as well as any identified weaknesses or vulnerabilities in those systems.
CHIPs also responds to critical vulnerabilities and other significant cyber events, providing entities with timely, actionable intelligence to help them protect themselves in rapidly changing situations.
The Critical Infrastructure Uplift Program (CI-UP) assists Australian Cl organisations to improve their resilience against cyber attacks, with a focus on hardening against attack pathways to Cl assets and OT environments. A voluntary, nationwide threat-driven program, CI-UP focuses on improving Cls cyber security in a range of areas, including:
- enhancing visibility of malicious cyber activity and awareness of vulnerabilities
- enhancing the ability to contain and respond to an incident
- furthering a cyber security culture.
CI-UP leads this work through a series of programs that share uplift and hardening advice and provide technical assistance. These include:
- 1:1 Uplift activities – invitation-only activities focused on uplifting the cyber security of Cl assets most important to Australia’s national security.
- Sprint Uplift activities – invitation-only cyber uplift engagements delivering rapid uplift services to a broad cross-section of Australian Cl.
- Operational Technology Information Exchanges (OT-IEs) – forums for ASD’s ACSC partners in Cl sectors with OT capability to discuss the OT cyber threat landscape in a neutral and trusted environment.
- CI-UP presentations, briefings and workshops – provide sector-specific insights and trends across a range of Cl partners.
The Government Uplift Program assists prioritised government entities to strengthen their cyber resilience. The program provides technical assessment and remediation based on current and emerging threats, as well as training, engagement and guidance for those in critical IT and management roles within government. The program of work includes:
- Government Cyber Assessment Team (GovCAT) – a threat-led and hands-on technical assessment of priority entity environments and systems that provides actionable insights for immediate cyber security uplift.
- The Cyber Uplift Remediation Program (CURP) – hands-on technical implementation and remediation activities with prioritised government entities to uplift their cyber security resilience.
- Training and support –for cyber security staff across government. This includes targeted training for 9,955 privileged users as well as uplifting the skills of 93 cyber defenders responsible for cyber visibility.
- Engagement and guidance – supporting both executives and cyber technical practitioners with situational awareness, threat assessments, specialised tools, and technical assistance.
- Targeted projects – seeking to measure and improve priority government web apps, improve the configuration of commonly used products and test new models of cyber defence and visibility across government.
Threat sharing and threat blocking is a key initiative under the 2023-2030 Australian Cyber Security Strategy: Shield 3 - World Class Threat Sharing and Blocking.
ASD’s ACSC has continued its partnership with the Department of Home Affairs to align its existing bodies of work on threat sharing and blocking, working to enhance ASD’s ACSC’s capabilities by providing the backbone of the Threat Blocking and Threat Sharing Scheme.
ASD’s ACSC is enhancing the ability of banks and telecommunication providers to share lOCs with actionable intelligence, blocking cyber threats with precision, speed, and scale.
ASD’s ACSC analysts successfully identified and mitigated a large-scale malicious traffic redirection campaign impacting Australian organisations known as HelloTDS, demonstrating the value of proactive threat intelligence sharing and collaboration.
During the investigation, analysts uncovered extensive infrastructure consisting of over 20,000 Traffic Direction System (TDS) domains. These domains were cleverly designed to funnel users who had clicked on an advertisement toward a relatively small set of 30 malicious command domains, enabling malicious actors to efficiently manage and scale their operations while evading detection.
ASD’s ACSC played a critical role in disrupting the campaign by:
- sharing the full list of malicious domains, infrastructure, and IOCs with partners via ASD’s ACSC CTIS
- blocking malicious domains via Australian Protective Domain Name System (AUPDNS)
- issuing domain take downs to remove the malicious domains via ASD’s ACSC’s takedown service.
This coordinated response resulted in the rapid containment and disruption of the campaign’s infrastructure, reducing exposure and limiting the potential compromise of Australian organisations. It also armed ASD’s ACSC partners to defend their own networks.
In December 2025, ASD’s ACSC identified a large-scale Business Email Compromise (BEC) campaign after receiving reports of domains impersonating Australian construction companies. Further analysis revealed over 400 look-alike domains being used to send fraudulent emails.
Unlike traditional BEC attacks, this campaign did not involve compromised accounts. Instead, attackers used look-alike domains and email infrastructure to impersonate trusted businesses and trick victims into making urgent payments.
ASD’s ACSC responded by:
- sharing 423 confirmed malicious domains via CTIS block feeds
- providing cyber threat intelligence to help partners proactively defend their networks.
ASD’s ACSC identified many domains in this campaign that were staged for malicious activity but were not yet active. Sharing these with partners and blocking them via AUPDNS enabled ASD’s ACSC to disrupt the threat before widespread impact.
ASD’s ACSC identified the ClickFix attack vector that targeted Australian networks by injecting malicious domains into websites that belonged to legitimate Australian businesses. The ClickFix attack vector tricked users into executing malicious commands delivering malware via deceptive verification prompts like fake CAPTCHAs (Completely Automated Public Turing test to tell Computers and Humans Apart).
ASD’s ACSC responded by:
- advising Australian businesses of their website compromises
- sharing 125 IOCs via CTIS
- blocking the malicious domains on AUPDNS
- disseminating a public cyber advisory.
The sharing of the ClickFix attack vector via CTIS and public advisory has limited its effectiveness and helped Australian organisations, from governments to small businesses, to protect their own networks.