Australia

This page covers cyber threats to Australia. It brings together official Australian texts, government advisories led or co-signed by Australian agencies, MITRE ATT&CK, and Brandefense research. Australia is a market we follow, and its agencies write many of the joint advisories that other countries rely on.

Threat groups that official sources link to Australia

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

APT40: a joint advisory (AA24-190A) released on 8 July 2024 and authored by the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) with partner agencies says APT40 has repeatedly targeted Australian networks, and government and private sector networks in the region, and that the threat is ongoing. The advisory describes a PRC state-sponsored group. MITRE ATT&CK, which calls the group Leviathan, lists a campaign named Leviathan Australian Intrusions from April 2022 to September 2022, and says the group has been attributed to the Ministry of State Security’s Hainan State Security Department and an affiliated front company.

LockBit: the joint advisory AA23-165A of 14 June 2023, with the ACSC among its authors, says LockBit made up 18 percent of reported Australian ransomware incidents from April 2022 to March 2023, and that the earliest documented LockBit 3.0 case in Australia was in early August 2022.

Lazarus Group: advisory AA21-048A lists Australia among the countries where threat actors targeted organizations with AppleJeus malware since January 2020. The agencies attribute Lazarus Group to North Korean state-sponsored actors.

Two more official statements do not name a group with a profile here. Advisory AA24-038A on Volt Typhoon (7 February 2024) says ASD’s ACSC and New Zealand’s NCSC assessed that Australian and New Zealand critical infrastructure could be vulnerable to similar activity from PRC state-sponsored actors. Advisory AA25-239A says a cluster of cyber threat activity, which we cover on our Salt Typhoon incident page, was observed in the United States, Australia, Canada, New Zealand, the United Kingdom and elsewhere.

Incidents on record

The incidents listed below are the major ones that Australian organizations or authorities reported, with national impact, plus one global campaign whose advisory names Australia. Where sources differ, the incident page says so. Small incidents are not listed.

What the OAIC reports

The Office of the Australian Information Commissioner (OAIC) received 518 data breach notifications from January to June 2024 and 595 from July to December 2024. For July to December 2024, health service providers made the most notifications (121, 20 percent), then the Australian Government (100, 17 percent), finance including superannuation (54, 9 percent), legal, accounting and management services (36, 6 percent) and retail (34, 6 percent). Among malicious or criminal attacks it counted 247 cyber incident notifications and 115 social engineering or impersonation notifications. Within the cyber incidents, 84 were phishing that exposed credentials and 60 were ransomware.

How attackers target Australia: Brandefense research

Our own research mentions Australia in several posts. In summary, as our posts report:

Ransomware and data theft: our Medibank post says criminals accessed personal data of about 9.7 million current and former customers of the Australian health insurer in an October 2022 ransomware attack, and that Medibank refused to pay. The top data breaches post says Qantas made public in July 2025 that millions of customers were affected, with names, emails, dates of birth and loyalty program details exposed. The Medusa analysis lists Australia among six countries where Medusa buys access, and the AvosLocker summary lists Australia among its targets. The DragonForce post says the Australian arm of a dairy-drink brand has been mentioned in open reporting among its targets. The Q3 2023 ransomware trends report says Australia saw fewer ransomware attacks than in the previous quarter but remained a target, and our LockBit leader post says the US, UK and Australia sanctioned the named leader on 7 May 2024.

Credential theft, banking and fraud: our credential stuffing post describes coordinated attacks on five major Australian superannuation funds on 29 and 30 March 2025 that stole AUD 500,000, and our account takeover guide covers the same case. The OCTO trojan post lists Australia among countries whose financial institutions it targets. The first-half 2023 news archive reports the Chameleon Android trojan targeting users in Poland and Australia, imitating the CoinSpot app and an Australian government agency. The AiTM phishing post describes a campaign against finance, insurance, accounting and energy firms serving the USA, England, New Zealand and Australia.

State-linked and hacktivist: the Mythic Leopard profile, the Ocean Lotus profile and the GALLIUM post list Australia among targeted countries, the last citing MITRE ATT&CK. The Anonymous Sudan review lists Australia among countries reached by its DDoS attacks.

Older warnings: our post on repeat ransomware targets notes a 2016 warning from Australian police about USB drives, disguised as a Netflix application, that arrived in mailboxes.

How Brandefense helps

Brandefense says its threat intelligence platform watches dark web forums and marketplaces, credential trading, phishing infrastructure and threat actor activity. In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins are for sale, which matters given the credential attacks above, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

The Australian Government released the 2023-2030 Australian Cyber Security Strategy in November 2023. Its vision is to become a world leader in cyber security by 2030. It runs in three horizons (2023-25, 2026-28 and 2029-30) and is built on six cyber shields, one of which is protected critical infrastructure. The Department of Home Affairs supports the Minister’s work on cyber security policy, including this strategy.

The Cyber Security Act 2024, dated 29 November 2024, has parts on security standards for smart devices, on reporting a ransomware payment, and on a Cyber Incident Review Board. The Security of Critical Infrastructure Act 2018 is administered by Home Affairs, where the Cyber and Infrastructure Security Centre runs an all-hazards critical infrastructure regime with owners and operators.

How incident response is organized

Australia’s national technical contact is the Australian Cyber Security Centre, part of the Australian Signals Directorate. The LockBit advisory tells Australian organizations hit by ransomware to contact the ACSC on 1300 CYBER1 or through cyber.gov.au. The Australian Federal Police works on cybercrime and says cybercriminal groups can target thousands of Australians at once from anywhere in the world, and that it works to disrupt anonymous criminals who use the dark web.

Personal data

Under the Privacy Act 1988, an organization or agency it covers must notify affected people and the OAIC when a data breach involving personal information is likely to result in serious harm. The OAIC publishes half-yearly statistics on these notifications.

The Australian government pages we opened give no overall attack counts for Australia. The groups and incidents on this page come from joint government advisories, MITRE ATT&CK, regulator reports and official statements. Figures for Australia will come from Brandefense Atlas.