Australia’s Cyber Defense report highlights evolving threats and strategic countermeasures
The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) recently published the 2023–24 Annual Cyber Threat Report outlining the cyber threat posed to the country’s governments, critical infrastructure, businesses, and household installations. It shows how malicious state actors and cybercriminals are evolving tactics to breach Australian networks. It underscores the critical need for robust public-private partnerships to protect Australians from cyber threats and strengthen national defenses. It also details the decisive actions being taken to deter and hold cybercriminals accountable, including the Government’s inaugural use of Australia’s autonomous cyber sanctions framework to impose sanctions on Russian cybercriminals.
“Informed by ASD’s intelligence insights and partnerships, this report reinforces the importance of enhancing our nation’s cyber defenses and the need for all Australians to play their part in protecting our collective cyber security,” Richard Marles, deputy prime minister and minister for defence, wrote in the report. “Reporting cybercrime, incidents, and vulnerabilities remains a critical part of building a national threat picture and enabling us to effectively counter malicious cyber actors. This report is a key part of the Government’s efforts to raise the profile of Australia’s cyber threats to ensure we can respond effectively to keep Australians safe.”
State-sponsored cyber actors persistently target Australian governments, critical infrastructure, and businesses using evolving tradecraft. These actors conduct cyber operations in pursuit of state goals, including espionage, in exerting malign influence, interference, and coercion, and in seeking to pre-position networks for disruptive cyber attacks.
Over the past year, ASD co-sealed several joint advisories with international partners to highlight the evolving operations of state-sponsored cyber actors. In February 2024, ASD joined the U.S. and other international partners in releasing an advisory that assessed the People’s Republic of China (PRC) as leveraging living-off-the-land techniques that abuse native tools and processes on systems. The PRC’s choice of targets and pattern of behavior is consistent with pre-positioning for disruptive effects rather than traditional cyber espionage operations.
Russia is also adapting its techniques, including for the exploitation of cloud platforms. The evolution of this tradecraft means that network defenders must prioritize and invest in cyber security skills, resources, and teams.
Apart from state-sponsored hackers, profit-driven cybercriminals may opportunistically target critical infrastructure organizations for financial gain, seeking to extort victims by disrupting critical services or stealing data. Cybercriminals will pressure a victim to pay to restore services and minimize the potential consequences of a cyber security incident, including reputational and financial damage, and potential legal repercussions.
Hacktivists may disrupt critical infrastructure organizations through low-capability attacks, including website defacement and DDoS attacks. Cyber security incidents affecting critical infrastructure can be high profile – something that may encourage hacktivist activity to elevate their messaging.
Australian critical infrastructure organizations are regularly targeted by malicious cyber actors because they provide critical services, hold sensitive data, and are often connected to other critical infrastructure organizations. Also, different malicious cyber actors target critical infrastructure systems to fulfill their objectives. These include espionage, pre-positioning for disruptive attacks, and for financial gain.
Additionally, OT (operational technology) systems are becoming increasingly interconnected, which can expose them to vulnerabilities, making them more susceptible to cyber threats. To safeguard Australia’s critical services, it is essential to secure both information and communications technology and OT systems.
Malicious cyber actors are particularly interested in OT and connected systems, including corporate networks, as they can be exploited to gain access to a corporate network and vice versa. This access can potentially allow cyber actors to move laterally through systems to reach their intended target. Therefore, designing robust information security measures is crucial to ensure the confidentiality, integrity, and availability of these systems.
Critical infrastructure networks are an attractive target due to the sensitive data they hold and the widespread disruption that a cyber security incident can cause on those networks. In FY2023-24, over 11 percent of cybersecurity incidents ASD responded to were related to critical infrastructure. Compromise could lead to the disruption of critical services, affecting the economy and lives of everyday Australians.
Cybercrime is a persistent and disruptive threat. Cybercriminals are adapting to capitalize on new opportunities, such as artificial intelligence, which reduces the level of sophistication needed for cybercriminals to operate. In FY2023-24, business email compromise and fraud were among the top self-reported cybercrimes for businesses and individuals in Australia. Ransomware and data theft extortion also remained a pervasive and costly threat.
The most frequently reported critical infrastructure sectors were electricity, gas, water and waste services (30 percent), education and training (17 percent), and transport, postal and warehousing (15 percent). The top 3 cyber incident types affecting Australian critical infrastructure were compromised accounts or credentials; malware infection (other than ransomware); and compromised assets, networks, or infrastructure. The three most common activity types leading to critical infrastructure-related incidents were phishing (23 percent); exploitation of a public-facing application (21 percent); and brute-force activity (15 percent).
Ransomware attacks are highly destructive, causing significant harm to individuals, organizations, and wider society. For example, businesses may experience reputational damage and financial losses from offline systems and data loss. According to the AIC, small to medium businesses are high-risk targets for ransomware attacks, with small to medium business owners (6.2 percent) being more likely to be the victim of a ransomware attack compared with employees (3.2 percent) and individuals who were not small to medium business owners or employees (1.5 percent).
Also, denial of service and distributed denial of service were overrepresented in critical infrastructure cybersecurity incidents, and present more than twice as often (11 percent) when compared to other incidents (5 percent) responded to by ASD.
There are many ways in which Australian organizations can engage with ASD to improve their cybersecurity and help boost Australia’s cyber defenses. The ASD’s Cyber Security Partnership Program enables eligible Australian organizations to engage with ASD and industry and government partners, drawing on collective understanding, experience, skills, and capability to lift cyber resilience across the Australian economy. ASD’s Cyber Security Partnership Program is a national program, delivered through ASD’s state offices located around Australia.
The Critical Infrastructure Uplift Program (CI-UP) assists Australian critical infrastructure organizations to improve their resilience against cyber attacks, with a focus on critical infrastructure assets and OT environments. As a voluntary, intelligence-driven program, CI-UP focuses on improving the cyber security of critical infrastructure in a range of areas, including enhancing the visibility of malicious cyber activity and awareness of vulnerabilities; enhancing the ability to contain and respond to a cyber security incident; and furthering culture and cyber maturity.
Earlier this week, the Australian Parliament enacted on Monday a cybersecurity legislative package to bolster national cyber defenses and resilience. The package includes the Cyber Security Act 2024, the Intelligence Services and Other Legislation Amendment (Cyber Security) Act 2024, and the Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024. The Cyber Security Act will execute seven initiatives initially introduced under the Cyber Security Strategy.
link
