Australia & New Zealand Government Sector Cyber Threat Landscape (2025–2026)

Published On : 2026-11-06

EXECUTIVE SUMMARY

Government is the most-reported sector – and its weakest points are at the edges

CYFIRMA Research finds that government is the most-reported victim sector in both countries. The incidents that hurt government most began at the public sector’s edges – a school server, a remote-access account, a supplier’s patient portal, a contractor’s Teams channel, and an AI agent – not in hardened departmental cores.

HEADLINE FINDINGS

48% – Most-reported victim: Federal (32%) and state/local (16%) government in ASD incident responses; NZ public administration tops NCSC triage (102).
12 – Government-related register entries: 11 dated within the reporting period and 1 NZ contractor case with no exact event month. Includes access cases, insider activity, QR fraud, and a precautionary outage.
4 – Government & Civic-tag-screened ransomware listings: 2 linked to victim-confirmed access and 2 listing-only. Related government-school activity appears outside this filter.
21 – Campaigns matching ANZ/government dashboard tags: 17 China-nexus; 5 linked to Salt or Volt Typhoon. Broad target lists – no confirmed agency intrusion.

RECOMMENDED ACTIONS

KEY THREAT FINDINGS AT A GLANCE

Government threat landscape – key figures

National agency data, verified incidents and CYFIRMA monitoring, each with its own reporting period

1,500+
Incidents responded to by ASD, up more than 20% (1,524 reported) · Reporting period: FY2025–26

32% / 16%
Federal and state/local government shares of ASD incident responses · Reporting period: FY2025–26

369
NZ incidents of potential national significance; 86 with suspected state links · Reporting period: FY2025/26

22%
Commonwealth entities at Essential Eight Maturity Level 2 · Reporting period: 2025

108 days
Average time for government bodies to notify the OAIC, vs 3 days for companies · Reporting period: 2022 –H1 2026

60
Underground posts tagged Government & Civic (58 AU, 2 NZ) –CYFIRMA monitoring · Reporting period: 29 Apr – 26 Oct 2026

4
Government & Civic-tag-screened ransomware listings from 10 candidates –2 with confirmed access · Reporting period: October 2025 –October 2026

21
Dashboard campaigns matching ANZ and government tags; 5 Salt/Volt-linked, 2 APT40 · Reporting period: Active in the assessment period

Reporting periods differ: figures from different sources should not be added together or compared directly.

KEY TAKEAWAYS

Six things government security leaders should take away

01
Most-reported victim on both sides of the Tasman
48% of ASD incident responses; NZ public administration top in NCSC triage.

02
Decisive weaknesses sat at the federated edge
School servers, remote access, supplier portals, and contractor channels.

03
Patching directives without verification failed
ASD alert relayed the same day in Victoria; a school server was still compromised.

04
AI changed the government incident model
An AI model accessed non-public Services Australia files; a second state case followed.

05
State actors target the infrastructure government depends on
Router and covert-network advisories co-sealed by ASD and NCSC-NZ; Salt Typhoon in NZ.

06
CYFIRMA monitoring confirms direction, not new victims
Chatter peaked in Oct 2026; 4 Government & Civic-tag-screened listings; Salt/Volt in 5 tracked campaigns.

ANZ GOVERNMENT THREAT LANDSCAPE

Government leads reported incidents in both countries

Reporting duties raise government counts – read as concentration of reported activity, not relative weakness

Assessment: Government is the largest reported victim group in both national datasets. NCSC states that public administration experienced “a third” of nationally significant incidents, while its chart shows 15% – both reported; no count derived.

GLOBAL VIEW, LOCAL IMPACT

Four drivers shaped the year – all global campaigns with a local footprint

Global activity: BADCANDY on Cisco IOS XE (400+ AU devices), FortiBleed credential campaign, PHP2Shell

ANZ government footprint: Precautionary outages of federal and council websites; NSW RFS breached via remote access

Global activity: Extortion groups and infostealers target sensitive records at scale

ANZ government footprint: Victorian and Queensland student data; Manage My Health with Health NZ held responsible

Global activity: Salt Typhoon, Volt Typhoon, FSB Center 16, and China-nexus covert networks

ANZ government footprint: Salt Typhoon observed in NZ; ASIO: probing of AU telecom and critical infrastructure

Global activity: Faster vulnerability discovery and exploit development; agentic AI misuse

ANZ government footprint: AI-model access to Services Australia and NSW NPWS services (Jun 2026)

Assessment (High confidence): the ANZ government threat is driven far more by global campaigns exploiting common technology and suppliers than by ANZ-specific targeting – so joint advisories are directly actionable, and exposure depends on how fast each agency closes the gaps they describe.

AUSTRALIA GOVERNMENT ASSESSMENT

The gap between central policy and local execution

DOES THIS AFFECT ME?

Reported cases across multiple government tiers: Services Australia, Victorian and Queensland Education, NSW Treasury, NSW RFS, NSW NPWS, Mandurah SES
ASD calls AI “the defining force” of the year
Three of four leak-site events hit state emergency or regional bodies

HOW EXPOSED AM I?

ASD alert relayed the same day in Victoria – a school server was still compromised
Only 22% of Commonwealth entities at Essential Eight ML2
Government averages 108 days to notify the OAIC
Edge devices exposed: BADCANDY, FortiBleed; NSW RFS breached via remote access

WHAT SHOULD I DO NOW?

Track every ASD critical alert to verified remediation at each devolved site
Phishing-resistant MFA on VPN and edge admin; rotate Fortinet credentials
Rehearse 72-hour breach notification
Watch leak sites for agency and supplier names

KEY FIGURES

32% + 16% federal and state/local share of ASD responses
8 Australian incident/event entries within the period
58 underground Government & Civic posts (6 months)
4 Government & Civic-tag-screened listings (2 corroborated access)

NEW ZEALAND GOVERNMENT ASSESSMENT

Supplier platforms and identity compromise dominated

DOES THIS AFFECT ME?

Four C2 incidents – the first cybercrime C2s in five years
NCSC: suspected state activity targeted government agencies, health, education, and MSPs
Only 1 of 21 tracked APT campaigns lists New Zealand

HOW EXPOSED AM I?

Manage My Health: 99,000+ patients; Health NZ and operator both in breach
Contractor to government compromised via fake Teams helpdesk call
Hutt City Council phishing; fake QR codes on council meters
No qualifying NZ government leak-site listing – supplier routes may be missed

WHAT SHOULD I DO NOW?

Mandate MFA on supplier portals holding citizen data – by contract
Harden service desks and Teams against impersonation
Act on infostealer notifications: reset and revoke sessions
Inspect council payment assets

KEY FIGURES

369 nationally significant incidents (+11.5%)
102 public administration triage incidents – top sector
3 NZ in-period incident/event entries; 1 case date unspecified
2 underground posts mentioning NZ government (6 months)

MAJOR GOVERNMENT CYBER INCIDENTS

Government-related register: 11 in-period entries and one FY-undated case

Of 12 entries, 11 are placed within October 2025 – October 2026; the NZ contractor case is reported for FY2025/26 without an exact event date. Entries include access incidents, insider activity, fraud, and precautionary patching.

Event date	Entity	Country	What happened	Status
By 6 Nov 2025	Victorian Department of Education	AU	Unpatched school server used to reach a database of current and former students	Confirmed
Late Dec 2025	Manage My Health / Health NZ	NZ	Stolen Lumma credentials; 99,000+ patients; Health NZ and operator in breach (C2)	Confirmed
Mar 2026	Hutt City Council	NZ	Phishing gave access to a small number of mailboxes; up to 732 people affected	Confirmed
Apr 2026	NSW Treasury	AU	Alleged insider transfer to an external server; no external compromise	Confirmed
Apr–May 2026	Queensland Department of Education	AU	Canvas/QLearn supplier breach – staff and student data since 2020	Confirmed
18 Jun 2026	Services Australia	AU	AI model accessed non-public Medicare statistics files; no patient records	Confirmed
Jun 2026	NSW National Parks and Wildlife Service	AU	AI model gathered non-public summary fire statistics	Confirmed
Jun 2026	NSW Rural Fire Service	AU	Compromised account via remote access; historical files likely taken; Nova claim	Confirmed
Jul–Sep 2026	Christchurch City Council (also Wellington, Auckland)	NZ	Fake payment QR codes on parking meters	Confirmed
FY2025/26; event month unknown	Unnamed contractor to NZ government	NZ	NCSC case study: Teams helpdesk impersonation and data exfiltration; precise date unknown	Confirmed; date unclear
Early Oct 2026	Mandurah SES unit (WA)	AU	Unauthorised access to a server with pre-2022 records; ransomware claim	Confirmed
21–23 Oct 2026	Federal and council websites	AU	Taken offline to patch PHP2Shell – no known successful exploitation in Australia	Precautionary

INCIDENT TIMELINE AND IMPACT

Incidents clustered in June 2026 and spread across every tier of government

Chronology of reported events; two leak-site claims are listings only. The NZ contractor case has no disclosed event month.

Nov 2025 –Australia
Victorian DoE –school server exploited

Jan 2026 –Australia
South West Development Commission –Lynx listing only

Mar 2026 –New Zealand
Hutt City Council –phishing

Apr 2026 –Australia
NSW Treasury –alleged insider

Apr–May 2026 –Australia
Queensland DoE –Canvas supplier breach

Jun 2026 –Australia
Services Australia –AI-agent access; NSW NPWS –AI-agent access; NSW Rural Fire Service –remote-access compromise

Jul–Sep 2026 –New Zealand
Christchurch council meters –QR-code phishing

Sep 2026 –Australia
Transport for NSW –Clop listing only

Oct 2026 –Australia
Mandurah SES –server accessed; federal and council websites –PHP2Shell precaution

Date not specified (FY2025/26) – New Zealand: Contractor to government organisations – Teams impersonation; outside the 11 in-period dated entries

No single technique dominates – every route bypassed the agency core

12 government-related entries grouped by primary route (8 Australia, 4 New Zealand); 11 placed in-period and one NZ contractor event reported without an exact date

PRIMARY ROUTE – INCIDENTS: EXAMPLES

Stolen or compromised credentials – 2: Manage My Health / Health NZ; NSW RFS remote access
Phishing and social engineering – 2: Hutt City Council; NZ government contractor (Teams)
Autonomous AI-agent access – 2: Services Australia; NSW NPWS
Unpatched internet-facing system – 1: Victorian DoE school server
Third-party SaaS breach – 1: Queensland DoE via Canvas/QLearn
Insider – 1: NSW Treasury (alleged)
Physical fraud on public assets – 1: Christchurch council parking meters
Precautionary outage – 1: PHP2Shell patching of government websites
Not disclosed – 1: Mandurah SES

SUPPLIER INVOLVEMENT

At least 3 access cases involved a supplier, SaaS platform, or contractor (one NZ contractor case has no exact date); vendor involvement at NSW RFS remains possible.

ASSESSMENT

Moderate confidence, small sample: the common factor is not the technique but the location – every route bypassed hardened departmental cores.

CASE STUDY – VICTORIAN DEPARTMENT OF EDUCATION

The alert arrived in a minute; assurance never followed

TIMELINE

27 Oct 2025: ASD critical alert 10:00 am; Education alerted 10:01 am; directive to school technicians 4:32 pm
≤ 6 Nov 2025: Unpatched school server exploited – earliest activity found
2 Dec 2025: A vendor, not the department, detects the intrusion
23 Dec 2025: Forensics confirm data exfiltration
7–14 Jan 2026: OVIC notified; public reporting begins
Oct 2026: OVIC: IPP 4.1 and 4.2 contravened; 7 recommendations due 31 Dec 2026

WHAT WAS EXPOSED

Every government school student’s name, school, year level, school email, and encrypted password
The same details for hundreds of thousands of former students
Not all schools covered by vulnerability management; central tooling due end-2028

LESSONS FOR EVERY DEVOLVED ESTATE

A directive without a feedback loop is not a control – require attestation from every site
Use interim compensating monitoring until central tooling arrives
Data minimisation is a security control – deleted data cannot be stolen

CASE STUDY – SERVICES AUSTRALIA AI-AGENT ACCESS

An AI model as the intruder, and a disclosure inbox as the weak link

TIMELINE

18 Jun 2026: OpenAI model accesses non-public Medicare statistics files during an internal evaluation
11 Aug 2026: OpenAI becomes aware while reviewing misaligned model activity
10–11 Sep 2026: Email sent to a public-disclosures inbox; seen next day
15 Sep 2026: Services Australia informs ASD
24 Sep 2026: PM discloses; PM&C rapid review of AI-incident arrangements
2 Oct 2026: Second case disclosed: NSW NPWS fire-history service

WHAT WAS EXPOSED

No malicious operator – yet access controls were crossed at machine speed
Notification failed because a research inbox was not an incident channel
Legacy portals mixed public and non-public files
Further disclosures plausible; scale unknown (Low confidence)

LESSONS FOR EVERY DEVOLVED ESTATE

Give every disclosure inbox 24/7 triage and SOC escalation
Separate non-public files from published data on open-data portals
Treat high-speed automated querying as a security signal

CASE STUDIES – HEALTH NZ AND NSW RURAL FIRE SERVICE

Accountability does not outsource; remote access is the front door

MANAGE MY HEALTH AND HEALTH NZ

New Zealand – late December 2025 – C2 incident

Key facts: 99,000+ patients’ data stolen; C2 (NCSC highly significant); 2 compliance notices

Credentials stolen by Lumma Stealer used to enter the patient portal
Root cause: MFA available but not mandatory
Privacy Commissioner: operator and Health NZ both breached HIPC Rule 5
Lesson: contract minimum controls for every supplier holding citizen data

NSW RURAL FIRE SERVICE

Australia – June 2026 – also listed by Nova

Key facts: 1 compromised account; ~300 GB Nova claim (unverified); no operational impact

“Initiated from a compromised account and involved our remote access system”
Possible third-party vendor involvement
Many files historical; no evidence that sensitive personal data was accessed
Lesson: phishing-resistant MFA and conditional access for remote access

THREAT ACTORS AND APT CAMPAIGNS

Government-targeting threat actors

Confirmed = government-relevant activity confirmed; Indirect = advisory, listing or indirect evidence; None found = nothing in reviewed sources. Table covers actors tied to register entries or tag-screened listings; J Group, Kazu, and Interlock appear only in the related listings on slide 29

Actor	Origin	Motivation	Australia	New Zealand	Confidence	Observed activity
Salt Typhoon	PRC state	Espionage	Confirmed	Confirmed	High	ASIO; observed in NZ
Volt Typhoon / covert networks	PRC state	Pre-positioning	Confirmed	Indirect	High	ASIO; AA26-113A
Leviathan (APT40)	PRC state	Espionage	Indirect	None found	Moderate	2 tracked campaigns; ASD-led 2024 advisory
FSB Center 16	Russia state	Espionage	Indirect	Indirect	High	AA26-194A co-sealed
LAUNDRY BEAR	Russia state	Espionage	Indirect	None found	Moderate	ASD advisory
DPRK IT workers	North Korea	Revenue, extortion	None found	Indirect	Moderate	NCSC case study
ARMORY CASTLE	Suspected PRC	Espionage	None found	None found	Moderate	BeyondTrust exploitation
ShinyHunters	Criminal	Extortion	Confirmed	Indirect	Moderate	QLD DoE via Canvas
Nova	Criminal	Ransomware	Confirmed	None found	Low (claim)	NSW RFS
The Gentlemen	Criminal	Ransomware	Confirmed	None found	Moderate	Mandurah SES
INC Ransom	Criminal	Ransomware	Indirect	Indirect	Moderate	Mastercom; joint advisory
Clop	Criminal	Mass exploitation	Indirect	None found	Low	Transport for NSW listing
Lynx	Criminal	Ransomware	Indirect	None found	Low	SWDC listing

APT CAMPAIGN INTELLIGENCE

21 distinct dashboard campaigns match ANZ and government-sector tags; not confirmed agency intrusions

CYFIRMA early-warning campaign tracking: first and last seen dates; actor names as attributed in the dataset

Campaign	Actors (dataset attribution)	First seen	Last seen	Grouping
mailman	Leviathan	Feb 2020	Oct 2026	Leviathan (APT40)
reliable	Leviathan	Jan 2021	Oct 2026	Leviathan (APT40)
think pocket	MISSION2074	Aug 2021	Apr 2026	Other China-nexus
KDX-M7	MISSION2074, Stone Panda	Mar 2023	Apr 2026	Other China-nexus
meteor	Lazarus Group, MISSION2074	Apr 2023	Oct 2026	Other China-nexus
territorial integrity	Mustang Panda	Apr 2023	Oct 2026	Other China-nexus
Citrix (lists NZ)	NSCN2301	Jul 2023	Oct 2026	Other China-nexus
Ephemeris	TICK	Jun 2024	Oct 2026	Other China-nexus
hwasong	APT27, Lazarus, Oilrig	Jun 2024	Oct 2026	Other China-nexus
Stealth Attack	MISSION2074	Aug 2024	Aug 2026	Other China-nexus
Tumen	FIN7, Lazarus Group	Aug 2024	Oct 2026	Other origin
Dragon Emperor	Stone Panda	Sep 2024	Jan 2026	Other China-nexus
Thunderstorm	Volt Typhoon, Emissary Panda	Sep 2024	Oct 2026	Salt / Volt Typhoon-linked
Red River	CCEN2403, CCVN2401 (Vietnam)	Oct 2024	Oct 2026	Other origin
Blue Yonder	Volt Typhoon, MISSION2074	Nov 2024	Oct 2026	Salt / Volt Typhoon-linked
Hegemon	Volt Typhoon, Earth Estries +3	Dec 2024	Sep 2026	Salt / Volt Typhoon-linked
Victory	Stone Panda, TA505	Jan 2025	Oct 2026	Other China-nexus
free market	CCVN2501 (Vietnam)	Jun 2025	Sep 2026	Other origin
Dunan	Salt + Volt Typhoon, MISSION2074	Nov 2025	Apr 2026	Salt / Volt Typhoon-linked
Dominion	Salt Typhoon, MISSION2074	Jan 2026	Oct 2026	Salt / Volt Typhoon-linked
June 2026 Minjun	APT43, Lazarus Group	Oct 2026	Oct 2026	Other origin

Grouping: 5 Salt / Volt Typhoon-linked, 2 Leviathan (APT40), 10 other China-nexus, 4 other origin. 14 carry the standard Government & Civic tag; 7 only granular government tags (both counted). First seen in the window: Dunan (Nov 2025), Dominion (Jan 2026), June 2026 Minjun (Oct 2026).

Campaign-target matrix: actor relevance corroborated, agency targeting not shown

Country and sector fields describe broad target lists (5–18 countries) – co-occurrence is not evidence that an ANZ agency was attacked.

Campaign	Actors (dataset)	Tooling	Targeted technology	NZ	Public corroboration	Decision
Dunan	Salt + Volt Typhoon	SNAPPYBEE, China Chopper	OS, web apps	–	Salt Typhoon in NZ; ASIO probing; SNAPPYBEE–Salt link	Relevant · Moderate
Dominion	Salt Typhoon	MoonBounce	OS, web apps	–	Salt Typhoon corroborated; MoonBounce publicly tied to APT41	Relevant · Low–Mod
Thunderstorm	Volt Typhoon, Emissary Panda	Volt	Routers, VPN, web apps	–	Volt Typhoon named by ASIO; edge focus	Relevant · Moderate
Hegemon	Volt Typhoon, Earth Estries +3	Cobalt Strike, Winnti, Zingdoor	Routers, VPN, monitoring	–	Edge and network infrastructure	Relevant · Moderate
Blue Yonder	Volt Typhoon, MISSION2074	ShadowPad, Mirai, Volt	Web apps, supply-chain software	–	Volt Typhoon named by ASIO; active to Oct 2026	Relevant · Moderate
mailman, reliable	Leviathan (APT40)	None named	Remote access, VPN, Exchange	–	ASD-led 2024 advisory on APT40 targeting Australia	Relevant · Moderate
Citrix	NSCN2301	Cobalt Strike Beacon, PlugX	Remote desktop, cloud security	Yes	None found for ANZ government	Context · Low
Victory	Stone Panda, TA505	Clop, Lodeinfo	App infrastructure, DB, OS	–	Clop mass-listing pattern; no link	Context · Low
12 others	MISSION2074, Mustang Panda, Lazarus, TICK…	PlugX, Winnti, Lodeinfo	Mostly web apps	–	Broad lists; Mustang Panda 2026 activity elsewhere	Context · Low

Campaigns concentrate on web-facing applications and edge infrastructure

ACTOR ORIGIN
17 of 21 tag-matched campaigns list a China-nexus actor in the dataset; 4 have other origins. This does not establish ANZ agency intrusions.

RECURRING TOOLING

Winnti in 4 campaigns; PlugX, Lodeinfo, and Volt in 3 each
5 campaigns involve Salt or Volt Typhoon; 2 involve Leviathan (APT40)
Stone Panda (APT10) named in 3 campaigns – historically attributed to MSP compromise (2018)

ADVERSARY TTPS AND ATTACK PATTERNS

MITRE ATT&CK techniques evidenced in the period

Basis: “Observed” = seen in ANZ incidents or advisories; “Campaign tooling” = associated with tracked campaign tooling, not observed in an ANZ incident

Tactic	ID	Technique	Where evidenced	Basis
Initial Access	T1190	Exploit Public-Facing Application	Victorian DoE; BADCANDY	Observed
Initial Access	T1078	Valid Accounts	Manage My Health; NSW RFS; FortiBleed	Observed
Initial Access	T1133	External Remote Services	NSW RFS	Observed
Initial Access	T1566	Phishing	Hutt City Council	Observed
Initial Access	T1566.004	Spear phishing Voice	NZ contractor (Teams)	Observed
Credential Access	T1110.003	Password Spraying	FortiBleed	Observed
Persistence	T1505.003	Web Shell	BADCANDY; China Chopper	Observed
Persistence	T1542.001	System Firmware	MoonBounce	Campaign tooling
Defence Evasion	T1562	Impair Defenses	NZ contractor	Observed
Defence Evasion	T1574.002	DLL Side-Loading	SNAPPYBEE	Campaign tooling
Collection	T1602	Data from Configuration Repository	FSB Center 16 routers	Observed
Command and Control	T1090.003	Multi-hop Proxy	China-nexus covert networks	Observed
Exfiltration	TA0010	Technique not specified	Victorian DoE; NZ contractor; NSW Treasury	Observed

VULNERABILITY AND EXPLOITATION LANDSCAPE

Edge devices, remote access and web runtimes carried the most risk

Grouped by technology so agencies can find their platforms; ASD exposure figures cover all sectors

Technology	Vulnerability / campaign	Exploitation status	ANZ government evidence	Priority
Cisco IOS XE	CVE-2023-20198 – BADCANDY web shell	Actively exploited (ASD, 31 Oct 2025)	400+ AU devices potentially compromised since Jul 2025	Critical
Fortinet firewalls / VPN	FortiBleed credential exposure, password spraying	Active campaign (ACSC, 18 Jun 2026)	Australia among affected countries	Critical
PHP web runtimes	CVE-2026-109618 / -109619 – PHP2Shell	Critical alert 21 Oct 2026	Government sites offline for patching; no known AU exploitation	Critical
BeyondTrust Remote Support	CVE-2026-102764 auth bypass	Exploited since 29 Aug 2026	No ANZ government victim found	High
Zimbra Collaboration Suite	CVE-2025-66376 – LAUNDRY BEAR zero-day	Exploited from Jul 2025	ASD advisory; no ANZ government victim found	High
Edge routers	FSB Center 16 – SNMP/TFTP, Smart Install	AA26-194A (Jul 2026)	Co-sealed by ASD and NCSC-NZ	High
SOHO routers, IoT, NAS	China-nexus covert networks	AA26-113A (Apr 2026)	Co-sealed by AU and NZ	High

GOVERNMENT TECHNOLOGY AND SUPPLY-CHAIN EXPOSURE

Suppliers were the route to mass citizen-data loss

SAAS PLATFORMS

Canvas/QLearn –Queensland DoE; staff and student data held since 2020
Manage My Health –Health NZ held jointly responsible

SPECIALIST SUPPLIERS

IKAD Engineering (Defence programs) –confirmed access, Nov 2025
Mastercom (councils, police, SES) –INC Ransom claim acknowledged

CONTRACTORS

Contractor to NZ government compromised via fake Teams helpdesk call
Remote IT contractor identity risk (DPRK case)

REMOTE-ACCESS VENDORS

NSW RFS –possible third-party vendor for radio and telecom infrastructure
Vendor accounts as privileged access

NCSC root causes across supplier incidents: no MFA; over-permissioned access; poor segmentation.

UNDERGROUND AND DARK-WEB INTELLIGENCE

Government is a regular, not dominant, subject of ANZ underground chatter

CYFIRMA underground and dark-web monitoring, 29 Apr – 26 Oct 2026 (six 30-day windows) – mentions, not confirmed compromises

KEY FIGURES

60 unique posts tagged Government & Civic
58 / 2 posts mentioning Australia / New Zealand
82% of posts carry no threat category (49 of 60)
11 posts tagged government alone – 49 also tag other industries

ANALYST ASSESSMENT

Government ranks 4th of 14 industry tags by post count (60 posts); posts can carry several industry tags
Most posts are multi-sector lists or dumps – not agency-specific targeting
No victim names in the data – no post tied to a confirmed compromise
Confidence: Moderate (volume); Low (targeting)

GOVERNMENT & CIVIC CHATTER TRENDS

Australian government chatter climbed to a six-month high in October 2026

Unique posts per 30-day window, 29 Apr – 26 Oct 2026 – covers half of the assessment window; not extrapolated

LATE-PERIOD RISE
Last three windows: 36 posts vs 24 in the first three. Final window: 19 posts (18 AU, 1 NZ).

MOSTLY UNCATEGORISED
18 of the 19 final-window posts carry no threat category –a rise in mentions, not in attacks.

JUNE RANSOMWARE CLUSTER
5 ransomware-tagged posts, 13–26 Jun 2026 –the same weeks Nova listed NSW data. No victim names: link unconfirmed.

GOVERNMENT & CIVIC CHATTER TRENDS

Ransomware dominates the categorised government chatter

Categorised posts only (11 of 60); a post can carry several categories

UNCATEGORISED POSTS
49 of 60 government posts have no threat-category keyword. Categories come from keyword tagging, not analyst verification.

NOTABLE CLUSTERS AND DATA QUALITY

22 Aug 2026: two near-identical posts combining hacktivism, DDoS, data-leak, and ransomware keywords
24 Sep 2026: two claimed-hack posts tagged to government, education, and healthcare
3 broad posts mention >5 countries; excluding them leaves 56 AU + 1 NZ

UNDERGROUND AND DARK-WEB INTELLIGENCE

Geographic distribution of Government & Civic underground mentions

April – October 2026 | Keyword-tagged CYFIRMA monitoring observations

CYFIRMA RESEARCH ASSESSMENT
CYFIRMA monitoring recorded 60 Government & Civic-tagged underground posts, including 58 referencing Australia and two referencing New Zealand. The distribution reflects geographic mentions within the monitored dataset, not confirmed government compromises or vulnerable systems.

Telegram observation – Australian Defence reference

MONITORING OBSERVATION
CYFIRMA researchers observed a Telegram-forwarded advertisement for a purported 3.5 TB NATO-related dataset that references Australia’s Department of Defence. The post is reported here as a standalone observation and is not included in the Government & Civic post counts. Monitoring is ongoing to establish the source of the material and assess any implications for Australian government entities.

GOVERNMENT RANSOMWARE INTELLIGENCE

Record-level screening: 10 Government & Civic-tagged records yielded 4 distinct listings

CYFIRMA leak-site dataset – a listing is an allegation, not a confirmed breach

SCREENING STAGES (RECORDS)

Leak-site records in the dataset (Dec 2023 – Oct 2026): 21,346
Australia or New Zealand, all time: 423
ANZ listings in the assessment window (165 AU, 21 NZ): 186
Tagged Government & Civic: 10
Qualify after record-level screening: 5
Distinct tag-screened government-related listings: 4
Corroborated by the victim or authorities: 2

WHY 6 CANDIDATES DID NOT QUALIFY

Geography: ombudsman.gov.ws is Samoa, recorded as Australia
Not government: Genealogy SA, Gellibrand Support Services, Thorndale Foundation – not-for-profits
Unidentifiable: afton.loc – internal AD domain, the only NZ candidate
Duplicate: Nova “NSW Government” listing merged with NSW RFS
Tag accuracy: dataset country or industry tags wrong in at least 2 of 10 candidates
Outside the category: related listings, including a government school, are contextual and not in the four tag-screened records

Four category-screened Australian listings – two linked to confirmed access

Listing date	Organisation	Group	Status	Notes
5 Jan 2026	South West Development Commission (WA)	Lynx	Listing only	No statement; Lynx posted ~20 victims that day
26 Jun 2026	NSW Rural Fire Service	Nova	Corroborated	Compromised remote-access account; ~300 GB claim unverified
23 Sep 2026	Transport for NSW	Cl0p	Listing only	1 of 23 victims posted that day – access method not established
3 Oct 2026	Mandurah SES unit (WA)	The Gentlemen	Corroborated	Server with pre-2022 records accessed; operations unaffected

AUSTRALIA VS NEW ZEALAND

Government & Civic tag screen: 4 Australian listings (2 linked to confirmed access; 2 listing only), 0 New Zealand. This is not a census of all government-related claims.

RELATED LISTINGS OUTSIDE THIS TAG-FILTERED COUNT

IKAD Engineering – J Group, 9 Nov 2025 (Defence-program supplier)
Mastercom – INC Ransom, 11 Apr 2026 (councils, police, SES)
Manage My Health – Kazu, 30 Dec 2025 (private NZ portal; Health NZ later held jointly in breach)
Reynella East College (SA government school) – Interlock, 23 Jun 2026; breach confirmed, data claim unverified

GOVERNMENT CYBER ESPIONAGE AND GEOPOLITICAL RISKS

China is the most persistent state threat; AI is a new strategic driver

China

Confidence: High
NCSC: most persistent and capable actor in NZ. ASIO: Salt Typhoon probed AU telecom; sabotage threshold reached. 17 of 21 tracked campaigns China-nexus.

Russia

Confidence: High
FSB Center 16 router advisory (Jul 2026); LAUNDRY BEAR Zimbra zero-day; NZ joined pro-Russia hacktivist warning (Dec 2025).

North Korea

Confidence: High (fact)
IT worker infiltrated a large NZ business with a local laptop facilitator, then attempted extortion.

The Pacific

Confidence: Moderate
NCSC aware of state-sponsored espionage against South Pacific governments and infrastructure.

Middle East conflict

Confidence: Low
Industry assessed elevated risk to Australia; no verified ANZ government impact. 3 hacktivism-tagged government posts in six months.

Artificial intelligence

Confidence: High
PRC group used an AI model to run parts of an espionage campaign (cited by NCSC); AI-agent access to AU government services.

REGULATORY AND POLICY DEVELOPMENTS

Regulators held government to account; reporting duties are tightening

Feb 2026 (NZ)
Cyber Security Strategy 2026–2030 and Action Plan

6 Mar 2026 (AU + NZ)
Joint INC Ransom advisory (with Tonga CERT)

1 May 2026 (NZ)
IPP 3A in force – notice of indirect collection

May 2026 (AU)
Cyber Incident Review Board established

Jun–Jul 2026 (AU)
ASD Essentials consultation (successor to E8)

31 Aug 2026 (AU)
Privacy Act Tranche 2 draft – 72-hour notification

Sep 2026 (NZ)
Compliance notices to Health NZ and Manage My Health

24 Sep 2026 (AU)
PM&C rapid review of AI-incident arrangements

31 Dec 2026 (VIC)
OVIC recommendations due (Department of Education)

AUSTRALIA–NEW ZEALAND COMPARATIVE ANALYSIS

Both edge-driven, with different centres of gravity

ASSESSMENT
Australia’s larger, more devolved public sector produces more incidents, chatter, and listings. NZ’s most serious incidents came through suppliers, which monitoring can miss.

Dimension	Australia	New Zealand
National incident data	Federal 32% + state/local 16% of ASD responses	Public administration top triage sector (102)
State actors	ASIO: Salt and Volt Typhoon probing	86 state-linked incidents; Salt Typhoon observed
Dominant failure mode	Devolved estates, remote access, insider	Supplier platforms and identity
Legislation	Cyber Security Act, CIRB, Tranche 2 draft	Strategy 2026–30, IPP 3A, CI regulation in development

EMERGING THREATS AND STRATEGIC OUTLOOK

Threat assessment: where ANZ government risk concentrates for the next 12 months

CYFIRMA Research analyst judgement grounded in the period evidence – not a statistical score

Threat	Likelihood	Impact on government	Trend	Basis
Edge-device and remote-access exploitation	High	High	Rising	BADCANDY, FortiBleed, NSW RFS, AA26-194A, edge focus of tracked campaigns
Credential theft and infostealers	High	High	Steady (high)	Lumma Stealer alerts, Manage My Health, Hutt City Council
Supplier and SaaS compromise	High	High	Rising	Canvas/QLearn, Manage My Health, IKAD, Mastercom, NZ contractor
State-sponsored espionage and pre-positioning	High	High	Steady	86 state-linked NZ incidents; ASIO statements; 17 of 21 campaigns China-nexus
Ransomware and extortion against agencies	Moderate	Moderate–High	Steady	4 government leak-site events, 2 corroborated, peripheral systems
AI-agent and AI-accelerated exploitation	Moderate	Moderate–High	Emerging	Services Australia and NSW NPWS cases; PHP2Shell response
Hacktivism and DDoS	Low–Moderate	Low	Low	3 hacktivism and 2 DDoS government posts; no verified impact

EMERGING THREATS AND STRATEGIC OUTLOOK

What to expect over the next quarter to 12 months

AI will keep compressing exploit timelines
Expect more precautionary takedowns of government web services. (Confidence: High)

More AI-agent incidents are likely to be disclosed
Scale cannot be estimated from public data. (Confidence: Moderate)

Supplier and SaaS compromise remains the main route to mass data loss
Nothing in the period suggests a reversal. (Confidence: High)

State edge-device and telecom activity will continue
Detection gaps where agencies depend on carriers and MSPs. (Confidence: High)

Regulatory pressure on government will rise
Tranche 2, CIRB, PM&C AI review, NZ CI regulation. (Confidence: Moderate)

Overseas conflicts may cause short hacktivist spikes
Little evidence of ANZ government impact so far. (Confidence: Low)

PRIORITISED SECURITY RECOMMENDATIONS

A 180-day roadmap for government CISOs and SOC teams

WITHIN 30 DAYS

Verify remediation of every ASD/NCSC critical alert at each devolved site — CISO / CIO
Phishing-resistant MFA on remote access and edge admin; rotate Fortinet credentials — Network / SOC
Apply router-hygiene and BADCANDY guidance — Network operations
Staff disclosure inboxes 24/7; review public data portals — CISO / service owners

WITHIN 90 DAYS

Contract MFA, logging and segmentation for SaaS suppliers; exercise a supplier breach — Procurement / CISO
Harden service desks and Teams against impersonation — Service desk
Act on infostealer notifications — SOC / identity
Purge inactive citizen records — Privacy
Leak-site and underground watch-lists with a verification playbook — CTI / SOC
Check shared-product exposure after mass-listing waves — Vulnerability management

WITHIN 180 DAYS

Hunt edge and telecom-adjacent state activity (AA26-113A, AA26-194A) — Threat hunting
Verify remote IT contractor identity — HR / security
Rehearse 72-hour breach notification — Privacy / legal
Plan Essential Eight to ASD Essentials transition — CISO

RESEARCH METHODOLOGY AND LIMITATIONS

Verified OSINT plus three CYFIRMA datasets, screened record by record

METHOD

Collect: OSINT: ASD/ACSC, NCSC-NZ, OVIC, OAIC, ministerial and council releases, joint advisories, reputable media. Underground extract: 662 rows. Leak-site dataset: 21,346 records. APT dataset: 491 campaign records.
Validate: Dated events within October 2025 – October 2026; undated cases contextualized; government entity or responsibility documented; geography and victim claims checked.
Assess: Evidence status: Confirmed / Reported / Claimed. Confidence: High / Moderate / Low. Three questions answered per section. Every claim traced to the internal evidence register.

LIMITATIONS

Underground data covers six months; keyword tagging; no post text or victim names
Leak-site claims are allegations; 2 of 4 tag-screened listings lack victim corroboration
Campaign target lists are broad; two industry vocabularies (both counted); some actor names not publicly verifiable
ASD sector shares verified from original report; NCSC “a third” vs 15% inconsistency remains
Not a census of incidents; local government under-reported

INTERPRETATION NOTES

Monitoring mentions, ransomware leak-site listings, and campaign target tags are not confirmed intrusions. The supporting Word report and internal evidence registers retain full references.