CYFIRMA Maps Edge-Focused Cyber Threats to Australian and New Zealand Government
Summary
CYFIRMA’s 2025–2026 assessment finds government was the most-reported victim sector in Australia and New Zealand, with incidents often involving edge systems, credentials and suppliers. It combines incident data, monitoring and campaign analysis, while cautioning that a
Key points
- ASD recorded 1,524 incident responses in FY2025–26; federal government accounted for 32% and state/local government 16%. New Zealand public administration led NCSC triage with 102 incidents.
- The report records 12 government-related incident or event entries across both countries, including credential compromise, phishing, supplier breaches, AI-model access and precautionary outages.
- A compromised school server exposed current and former Victorian students’ information; forensic investigation confirmed data exfiltration, and the report says the server remained unpatched after an ASD alert.
- The report says an AI model accessed non-public files at Services Australia and NSW National Parks and Wildlife Service. It reports no patient records were accessed in the Services Australia case.
- Of 21 campaigns matching Australia/New Zealand and government dashboard tags, 17 listed China-nexus actors. The report cautions that broad target lists do not establish attacks on ANZ government agencies.
- CYFIRMA monitored 60 Government & Civic-tagged underground posts, but found no victim names linking them to confirmed compromises. Four screened ransomware listings included two linked to confirmed access; listings alone are allegations.
- Recommendations include verifying remediation at devolved sites, phishing-resistant MFA for remote access, supplier controls, and 24/7 triage for disclosure inboxes.
Article Details
- Publisher
- CYFIRMA Research
- Report Period
- October 2025–October 2026; reporting periods vary by source.
- Scope
- Australia and New Zealand government-sector incidents, threat activity, underground posts, ransomware listings, and tracked campaigns.
- Sample Size
- 12 government-related register entries; 60 Government & Civic posts; 21 dashboard campaigns matching ANZ and government tags.
- Key Statistics
- ASD responded to 1,524 incidents in FY2025–26; federal government accounted for 32% and state/local government for 16% (48% combined).
- NCSC-NZ recorded 369 incidents of potential national significance in FY2025/26; 86 had suspected state links.
- The government-related register contains 12 entries: 11 dated within October 2025–October 2026 and one NZ contractor case with no exact event month.
- CYFIRMA recorded 60 Government & Civic posts from 29 Apr–26 Oct 2026 (58 referencing Australia, two New Zealand); posts were mentions, not confirmed compromises.
- Four Government & Civic-screened ransomware listings were identified from 10 candidates; two were corroborated by victims or authorities.
- Recommendations
- Verify remediation of every ASD/NCSC critical alert at each devolved site and require site-level attestation.
- Require phishing-resistant MFA for VPN and edge administration, and rotate Fortinet credentials.
- Contractually require MFA, logging, and segmentation for SaaS suppliers, and exercise supplier-breach response.
- Provide 24/7 triage and SOC escalation for disclosure inboxes; separate non-public files from published data on open-data portals.
- Harden service desks and Teams against impersonation; act on infostealer notifications by resetting credentials and revoking sessions.
MITRE ATT&CK
T1078 · Valid AccountsListed as observed for credential-based access involving Manage My Health and NSW RFS, and for FortiBleed.T1090.003 · Multi-hop ProxyListed as observed in connection with China-nexus covert networks.T1110.003 · Password SprayingListed as observed for password spraying in the FortiBleed campaign.T1133 · External Remote ServicesListed as observed for the NSW RFS remote-access compromise.T1190 · Exploit Public-Facing ApplicationListed as observed for the Victorian Department of Education incident and BADCANDY.T1505.003 · Web ShellListed as observed for web shells associated with BADCANDY and China Chopper.T1542.001 · System FirmwareAssociated with MoonBounce in tracked campaign tooling; the report does not describe it as observed in an ANZ incident.T1562 · Impair DefensesListed as observed in the NZ government contractor case.T1566 · PhishingListed as observed for phishing that gave access to Hutt City Council mailboxes.T1566.004 · Spearphishing VoiceListed as observed for the NZ government contractor case involving a fake Teams helpdesk call.T1574.002 · DLL Side-LoadingAssociated with SNAPPYBEE in tracked campaign tooling; the report does not describe it as observed in an ANZ incident.T1602 · Data from Configuration RepositoryListed as observed in connection with FSB Center 16 routers.
CVE
CVE-2023-20198Cisco · Cisco IOS XE SoftwareCVE-2023-20198 – BADCANDY web shellCVE-2025-66376Zimbra · CollaborationCVE-2025-66376 – LAUNDRY BEAR zero-dayCVE-2026-102764Beyondtrust · Remote supportCVE-2026-102764 auth bypassCVE-2026-109618Vendor / Product unavailableCVE-2026-109618 / -109619 – PHP2Shell
Threat Actors
APT40The report identifies APT40 as an alternate name for Leviathan, which it attributes to two tracked campaigns and an ASD-led advisory on targeting Australia.ARMORY CASTLEThe report describes ARMORY CASTLE as suspected PRC and associates it with BeyondTrust exploitation; it found no ANZ government victim.ClopA Clop listing named Transport for NSW, but the report says the access method was not established and classifies the evidence as low confidence.FSB Center 16Associated with an edge-router advisory co-sealed by ASD and NCSC-NZ; the report describes the actor's ANZ government relevance as indirect.INC RansomAssociated with a Mastercom listing and a joint advisory; the report classifies its government-relevant activity as indirect.Laundry BearThe report cites an ASD advisory and exploitation of a Zimbra zero-day from July 2025; it found no ANZ government victim.LeviathanThe report attributes two tracked campaigns to Leviathan and cites an ASD-led advisory on targeting Australia. The article identifies APT40 as an alternate name.LynxPosted a listing naming the South West Development Commission; the report says there was no statement confirming access.NovaThe report associates Nova with the NSW RFS listing; its approximately 300 GB data claim is explicitly unverified.Salt TyphoonThe report says Salt Typhoon was observed in New Zealand and that ASIO reported probing of Australian telecommunications; it also appears in tracked campaigns.ShinyHuntersThe report links ShinyHunters to the Queensland Department of Education via the Canvas supplier breach and marks the government-relevant activity confirmed.The GentlemenListed in connection with the Mandurah SES incident, where server access was confirmed; the article does not establish the listing's data claims.Volt TyphoonNamed by ASIO and associated with tracked campaigns and edge-focused activity; the report does not establish that those campaigns were intrusions into ANZ government agencies.
Malware
BADCANDYGlobal activity: BADCANDY on Cisco IOS XE (400+ AU devices), FortiBleed credential campaign, PHP2ShellLodeinfoClop, LodeinfoLumma StealerCredentials stolen by Lumma Stealer used to enter the patient portalMiraiShadowPad, Mirai, VoltMoonbounceSalt Typhoon corroborated; MoonBounce publicly tied to APT41PlugXCobalt Strike Beacon, PlugXShadowPadShadowPad, Mirai, VoltSNAPPYBEESNAPPYBEE, China ChopperWinntiCobalt Strike, Winnti, ZingdoorZingdoorCobalt Strike, Winnti, Zingdoor
Vendors
BeyondTrustBeyondTrust exploitationCiscoGlobal activity: BADCANDY on Cisco IOS XE (400+ AU devices), FortiBleed credential campaign, PHP2ShellFortinetPhishing-resistant MFA on VPN and edge admin; rotate Fortinet credentialsManage My HealthANZ government footprint: Victorian and Queensland student data; Manage My Health with Health NZ held responsibleOpenAI18 Jun 2026: OpenAI model accesses non-public Medicare statistics files during an internal evaluationZimbraZimbra Collaboration Suite
Products
CanvasCanvas/QLearn supplier breach – staff and student data since 2020Cisco IOS XEGlobal activity: BADCANDY on Cisco IOS XE (400+ AU devices), FortiBleed credential campaign, PHP2ShellManage My HealthANZ government footprint: Victorian and Queensland student data; Manage My Health with Health NZ held responsibleQLearnCanvas/QLearn supplier breach – staff and student data since 2020Teamssector’s edges – a school server, a remote-access account, a supplier’s patient portal, a contractor’s Teams channel, and an AI agent – not in hardened departmental cores.
Tools
Countries
AustraliaAustralia & New Zealand Government Sector Cyber Threat Landscape (2025–2026)China21 – Campaigns matching ANZ/government dashboard tags: 17 China-nexus; 5 linked to Salt or Volt Typhoon.New ZealandAustralia & New Zealand Government Sector Cyber Threat Landscape (2025–2026)RussiaRussia stateVietnamCCEN2403, CCVN2401 (Vietnam)
Industries
EducationReported cases across multiple government tiers: Services Australia, Victorian and Queensland Education, NSW Treasury, NSW RFS, NSW NPWS, Mandurah SESGovernmentAustralia & New Zealand Government Sector Cyber Threat Landscape (2025–2026)Healthcare24 Sep 2026: two claimed-hack posts tagged to government, education, and healthcare