ASD's ACSC Annual Cyber Threat Report 2025-26: incidents up 20%, threat notifications up 80%, code repositories targeted
The Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) published its Annual Cyber Threat Report 2025-26, reporting responses to more than 1,500 cyber incidents (up over 20%) and more than 4,400 proactive notifications of potential malicious activity (up nearly 80%). The agency received over 82,000 ReportCyber reports and handled 139 ransomware incidents, consistent with the prior year. Critical infrastructure accounted for 10% of all incidents (154 incidents), with financial and insurance services (30%), public administration (21%) and utilities (17%) most affected. The report flags AI as a defining force enabling faster vulnerability discovery and exploitation at scale, and warns that state-sponsored actors are pre-positioning in networks, including OT, for future disruption. Since September 2025 the ACSC has tracked sustained targeting of online code repositories leading to software supply chain compromises.
Detalhes técnicos
Top MITRE ATT&CK initial access techniques in critical infrastructure incidents were phishing (36%), valid accounts (16%) and drive-by compromise (10%). Compromised accounts and credentials were among the most frequently reported incident categories across government, industry and CI. In the code repository campaign, actors gained access via social engineering, compromised credentials and authentication tokens, then abused legitimate tooling to modify public software packages, extract and leak secrets, and migrate private repositories to public; they used open-source secret-scanning tools rather than bespoke malware. Publicly reported CVEs rose 30%. Average self-reported cybercrime cost per business report rose 16% to AUD 93,500; identity fraud remained the top reported cybercrime (down 18%). The Australian Protective DNS blocked access to more than 564 million malicious domains across 220 billion queries.
Remediação
ASD's ACSC urges radically faster patching, MFA or passkeys, best-practice event logging, replacement of legacy technology with compensating controls where replacement is not possible, and supply chain/third-party risk management with secure-by-design products. It points to the new Essentials series (October 2026), which evolves the Essential Eight into a principles-based framework, and to CI Fortify (October 2025) plus Advice for Isolating Vital Systems. Critical infrastructure operators should adopt an assumed breach posture, be able to physically isolate vital OT systems for three months while sustaining services, and prove rapid full rebuild capability. Organizations should plan migration to post-quantum cryptography by end of 2030 using the LATICE framework.
Linha do tempo
-
ASD's ACSC Annual Cyber Threat Report 2025-26: incidents up 20%, threat notifications up 80%, code repositories targeted
ler a análise desta fonte ocultar
The Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) published its Annual Cyber Threat Report 2025-26, reporting responses to more than 1,500 cyber incidents (up over 20%) and more than 4,400 proactive notifications of potential malicious activity (up nearly 80%). The agency received over 82,000 ReportCyber reports and handled 139 ransomware incidents, consistent with the prior year. Critical infrastructure accounted for 10% of all incidents (154 incidents), with financial and insurance services (30%), public administration (21%) and utilities (17%) most affected. The report flags AI as a defining force enabling faster vulnerability discovery and exploitation at scale, and warns that state-sponsored actors are pre-positioning in networks, including OT, for future disruption. Since September 2025 the ACSC has tracked sustained targeting of online code repositories leading to software supply chain compromises.
Technical Details
Top MITRE ATT&CK initial access techniques in critical infrastructure incidents were phishing (36%), valid accounts (16%) and drive-by compromise (10%). Compromised accounts and credentials were among the most frequently reported incident categories across government, industry and CI. In the code repository campaign, actors gained access via social engineering, compromised credentials and authentication tokens, then abused legitimate tooling to modify public software packages, extract and leak secrets, and migrate private repositories to public; they used open-source secret-scanning tools rather than bespoke malware. Publicly reported CVEs rose 30%. Average self-reported cybercrime cost per business report rose 16% to AUD 93,500; identity fraud remained the top reported cybercrime (down 18%). The Australian Protective DNS blocked access to more than 564 million malicious domains across 220 billion queries.
Remediation
ASD's ACSC urges radically faster patching, MFA or passkeys, best-practice event logging, replacement of legacy technology with compensating controls where replacement is not possible, and supply chain/third-party risk management with secure-by-design products. It points to the new Essentials series (October 2026), which evolves the Essential Eight into a principles-based framework, and to CI Fortify (October 2025) plus Advice for Isolating Vital Systems. Critical infrastructure operators should adopt an assumed breach posture, be able to physically isolate vital OT systems for three months while sustaining services, and prove rapid full rebuild capability. Organizations should plan migration to post-quantum cryptography by end of 2030 using the LATICE framework.