Federal government systems and regulated critical infrastructure were victim of "extensive compromise" twice in a major escalation of the threat posed by cyber intrusions in the last financial year.
Subscribe now for unlimited access.
$0/
(min cost $0)
or signup to continue reading
Russia's war was a major contributor to the rise in sophisticated but indiscriminate state-based and cybercriminal attacks, even if Australia wasn't intentionally a primary target.
The two previously undisclosed hacks at the heart of government and the national critical infrastructure were of the second highest possible severity rating used by the government's Australian Cyber Security Centre, which does not disclose which systems were breached to not invite further attacks.
The incidents, revealed in the latest ACSC annual cyber threat report, were prior to the high-profile data breaches of Optus and Medibank customer records in recent months that impacted millions of Australians.
However, the centre did fend off more than 29,000 brute force attacks against Australian services over the last year and responded to 1100 cybersecurity incidents ranging from unsuccessful attempts to sustained disruptions on Australian services.
The 135 ransomware incidents last year were most destructive of the cyber attacks against Australians, but trail behind the volume of fraud, shopping and banking scams.
Compromised business email accounts and falsified invoices were responsible for almost $100 million in losses in the last financial year. But the centre no longer reports the total lost value due to all cyber incidents as it says it can no longer accurately calculate the financial impact on Australians. It encouraged any victims of cyber scams or ransomware to not pay the blackmailers and instead report the breach to them.
While incomplete, the government's own figures show Commonwealth entities face the single largest share of cyber security incidents, responsible for almost a quarter of all reported incidents. That does not include breaches of contractors who work on behalf of the federal government, such as the service provider for Defence's social platform ForceNet, which this week reported receiving a ransomware threat.
Abigail Bradshaw, who heads the ACSC, said there was a "new and profound" shift on previous years, in which cyber was weaponised to a scale never before seen.
"In the last 12 months we've witnessed a sustained integration of cyber with conventional warfare in Ukraine, and the coalescence of powerful and disruptive cybercrime gangs and nation-states combining efforts in that conflict," she said.
"We've also witnessed the continued commercialisation of malicious malware and cyber-crime tools, which have fed a growing network of cybercrime gangs, and the weaponisation and monetisation of stolen data."
She urged organisations and individuals to prioritise their cyber security by patching their systems, including older model routers, and demand services implement multi-factor authentication to protect their accounts.
The invasion of Ukraine has also provided an opportunity to examine the relative strengths of concerted efforts in cyber resilience, private sector collaboration to defend networks, and the impact of global law enforcement and intelligence collaboration, Ms Bradshaw said.
The most significant lesson from the war for Australia's cyber officials charged with protecting both government and the private sector online was not to believe in inevitability of breaches, but partnerships were key to strong cyber defence.
READ MORE CYBERSECURITY NEWS:
Defence Minister Richard Marles said the heightened level of malicious cyber activity reflected the evolving strategic competition across the globe.
"This has been clearly demonstrated in the brutal invasion of Ukraine - where Russia has sought to cause damage not just in traditional warfare, but through the use of destructive malware as well," he said.
"Threat actors across the world continue to find innovative ways to deploy online attacks, as a result too many Australians have felt the impacts of cybercrime."
Cyber Security Minister Claire O'Neil said the government was focusing its best and brightest cyber security experts on responding to the contemporary threats and developing capabilities needed to build digital resilience.
"Recent examples of malicious cyber activity have demonstrated to Australians how important it is for organisations and individuals to prioritise their cyber security."
Harley Dennett
Former federal politics bureau chief for the Canberra Times, via a career that's taken me from rural Victoria to Washington DC. Telling the stories of my local LGBTI community brought me to political journalism, where I've covered eight budgets, four national elections in two countries, Defence, public service and international governance.
Former federal politics bureau chief for the Canberra Times, via a career that's taken me from rural Victoria to Washington DC. Telling the stories of my local LGBTI community brought me to political journalism, where I've covered eight budgets, four national elections in two countries, Defence, public service and international governance.
