ASD's ACSC Annual Cyber Threat Report, July 2021 to June 2022

The Annual Cyber Threat Report is the Australian Signals Directorate’s Australian Cyber Security Centre's (ASD's ACSC) flagship unclassified publication. The Report provides an overview of key cyber threats impacting Australia, how the ASD's ACSC is responding to the threat environment, and crucial advice for Australian individuals and organisations to protect themselves online.

Foreword

I am pleased to present the third Annual Cyber Threat Report by the Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC).

Throughout its 75 year history, ASD's ACSC has defended Australia from global threats and advanced our national interests. It remains at the frontline of defending our nation and keeping Australia safe and secure.

We are currently witnessing deteriorating strategic circumstances in our region and globally, including a military build-up unseen since World War II, and expanding cyber and grey zone capabilities are of particular concern.

In this environment, the work performed by ASD's ACSC is more important than ever.

This expanded Annual Cyber Threat Report 2021–22 is the product of insights from across the Commonwealth, with the Australian Federal Police, the Australian Criminal Intelligence Commission, the Australian Security Intelligence Organisation, Defence Intelligence Organisation and the Department of Home Affairs also contributing to help all Australians better understand the cyber threat environment and improve their cyber defences.

Over the last financial year and reflecting strategic competition globally, we have all witnessed a heightened level of malicious cyber activity. Regrettably, too many Australians have also felt its impacts.

The government considers cyber security and reinforcing our online resilience to be a national priority. Increased investment in ASD’s cyber and intelligence capabilities under project REDSPICE (Resilience, Effects, Defence, SPace, Intelligence, Cyber, Enablers) positions Australia to lift our defences and recognises the critical role ASD plays in our national security.

This report maps how threat actors across the world have continued to find innovative ways to deploy online attacks, with supply chains used to penetrate cyber defences of governments and organisations in many countries, including Australia.

The better news is that with increased collaboration across industry, small business, and government—and with all Australians—our joint cybersecurity future and the digital opportunities before us remain bright.

In many ways, this report is the product of all Australians with its foundations and findings formed by reports to the ASD's ACSC. Reporting cybercrime is vital for us to build a threat picture that can prevent others from falling victim to the ransomware syndicates and cybercriminals. The best cyber defence is informed by the best intelligence.

Together we can reach our ambitious goal to make Australia truly the most secure place to connect online. This report is another important step forward.

The Hon Richard Marles, MP
Deputy Prime Minister and Minister for Defence

Executive Summary

Over the 2021–22 financial year, the deterioration of the global threat environment was reflected in cyberspace. This was most prominent in Russia’s invasion of Ukraine, where destructive malware resulted in significant damage in Ukraine itself, but also caused collateral damage to European networks and increased the risk to networks worldwide.

In Australia, we also saw an increase in the number and sophistication of cyber threats, making crimes like extortion, espionage, and fraud easier to replicate at a greater scale. The ASD's ACSC received over 76,000 cybercrime reports, an increase of nearly 13 per cent from the previous financial year. This equates to one report every 7 minutes, compared to every 8 minutes last financial year.

The ASD's ACSC identified the following key cyber security trends in the 2021–22 financial year:

• Cyberspace has become a battleground. Cyber is increasingly the domain of warfare, as seen in Russia’s use of malware designed to destroy data and prevent computers from booting in Ukraine. But Russia was not alone in its use of cyber operations to pursue strategic interests. In July 2021, the Australian Government publicly attributed exploitation of Microsoft Exchange vulnerabilities to China’s Ministry of State Security. And a joint Five-Eyes Advisory in November 2021 confirmed exploitation of these vulnerabilities by an Iranian state actor. Regional dynamics in the Indo-Pacific are increasing the risk of crisis and cyber operations are likely to be used by states to challenge the sovereignty of others.
• Australia’s prosperity is attractive to cybercriminals. According to a 2021 Credit Suisse report, Australia has the highest median wealth per adult in the world. In 2021–22, cybercrimes directed at individuals, such as online banking and shopping compromise, remained among the most common, while Business Email Compromise (BEC) trended towards targeting high value transactions like property settlements.
• Ransomware remains the most destructive cybercrime. Ransomware groups have further evolved their business model, seeking to maximise their impact by targeting the reputation of Australian organisations. In 2021–22, ransomware groups stole and released the personal information of hundreds of thousands of Australians as part of their extortion tactics. The cost of ransomware extends beyond the ransom demands, and may include system reconstruction, lost productivity, and lost customers.
• Worldwide, critical infrastructure networks are increasingly targeted. Both state actors and cybercriminals view critical infrastructure as an attractive target. The continued targeting of Australia’s critical infrastructure is of concern as successful attacks could put access to essential services at risk. Potential disruptions to Australian essential services in 2021–22 were averted by effective cyber defences, including network segregation and effective, collaborative incident response.
• The rapid exploitation of critical public vulnerabilities became the norm. Australian organisations, and even individuals, were indiscriminately targeted by malicious cyber actors. Malicious actors persistently scanned for any network with unpatched systems, sometimes seeking to use these as entry points for higher value targets. The majority of significant incidents ASD's ACSC responded to in 2021–22 were due to inadequate patching.

In the face of rising threats to the digital-dependent Australian economy, cyber defence must be a priority for all Australians. The most effective means of defending against cyber threats continues to be the implementation of the Essential Eight cyber security strategies. To support this, the ASD's ACSC launched several new initiatives in 2021–22 to improve Australia’s cyber resilience, such as a Cyber Threat Intelligence Sharing (CTIS) platform which automates sharing of indicators of compromise. The Australian Government’s ten year investment in ASD, known as REDSPICE, will further harden Australia’s cyber defences in 2022–23 and beyond.

What the ASD's ACSC saw:

• An increase in financial losses due to BEC to over $98 million
  an average loss of $64,000 per report.
• A rise in the average cost per cybercrime report to over $39,000 for small business, $88,000 for medium business, and over $62,000 for large business
  an average increase of 14 per cent.
• A 25 per cent increase in the number of publicly reported software vulnerabilities
  (Common Vulnerabilities and Exposures – CVEs) worldwide.
• Over 76,000 cybercrime reports
  an increase of 13 per cent from the previous financial year.
• A cybercrime report every 7 minutes on average
  compared to every 8 minutes last financial year.
• Over 25,000 calls to the Cyber Security Hotline
  an average of 69 per day and an increase of 15 per cent from the previous financial year.
• 150,000 to 200,000 Small Office/Home Office routers in Australian homes and small businesses vulnerable to compromise
  including by state actors.
• Fraud, online shopping and online banking
  were the top reported cybercrime types, accounting for 54 per cent of all reports.

What the ASD's ACSC did:

• Responded to over 1,100 cyber security incidents.
• Blocked over 24 million malicious domain requests
  through the Australian Protective Domain Name System.
• Took down over 29,000 brute force attacks against Australian servers
  through the Domain Takedown Service.
• Took down over 15,000 domains hosting malicious software
  targeting Australia’s COVID-19 vaccine rollout.
• Shared over 28,000 indicators of compromise with ASD Partners
  through the Cyber Threat Intelligence Sharing platform.
• Collaborated with partners on 5 successful operations against criminal online marketplaces and foreign scam networks.
• Responded to 135 ransomware incidents
  an increase of over 75 per cent compared to 2019–20.
• Notified 148 entities of ransomware activity on their networks.
• Conducted 49 high priority operational tasks in response to identified and potential significant cyber threats
  including scanning for vulnerable Australian devices.
• Published 49 Alerts and 14 Advisories on cyber.gov.au
  which collectively saw more than 393,000 visits.
• Issued an Advisory urging Australian organisations to adopt an enhanced security posture following Russia’s invasion of Ukraine
  which was updated 10 times and received more than 57,000 views, plus a potential reach of almost 1 million people through social media.
• Briefed more than 200 government, business and critical infrastructure organisations
  on the risk of collateral damage to Australian networks following the Russian invasion of Ukraine.
• Published 13 new Step-by-Step Guides
  to help Australian individuals and small businesses to implement simple cyber security practices.
• Expanded the Partnership Program
  to over 2,300 network partners, 3,400 business partners, and over 82,000 home partners.
• Led 24 cyber security exercises
  involving over 280 organisations to strengthen Australia’s cyber resilience.
• Operationalised amendments to the Security of Critical Infrastructure Act
  including through new incident categorisation thresholds and changes to the ReportCyber website.
• Notified 5 critical infrastructure entities of malicious cyber activity and vulnerabilities
  potentially impacting their networks since the implementation of amendments to the Security of Critical Infrastructure Act.
• Completed the Critical Infrastructure Uplift Program (CI-UP) pilot
  and rolled out activities and tools open to all critical infrastructure partners.

What should individuals do?

Follow the ASD's ACSC’s easy steps to secure your devices and accounts including:

• Update your devices
  and replace old devices that do not receive updates
• Activate multi-factor authentication
• Regularly backup your devices
• Set secure passphrases
• Watch out for scams
• Sign up to the ASD's ACSC’s free Alert Service
• Report a cybercrime to the ASD's ACSC

What should organisations do?

For larger organisations: implement the ACSC’s Essential Eight mitigation strategies, Strategies to Mitigate Cyber Security Incidents and the Information Security Manual.

For smaller organisations: follow the ASD's ACSC’s advice for ransomware, Business Email Compromise and other threats.

• Review the cyber security posture of remote workers
  and their use of communication, collaboration and business productivity software.
• Patch vulnerabilities within 48 hours
  If you cannot achieve this, consider using a cloud service provider or managed service provider that can.
• Only use reputable cloud service providers and managed service providers
  that implement appropriate cyber security measures.
• Sign up to become an ASD partner
  to receive insights, Advisories and advice.
• Test your cyber security detection, incident response, business continuity and disaster recovery plans.
• Report all cybercrime and cyber security incidents to the ASD's ACSC
  via ReportCyber.

Cybercrime and cyber security incident statistics

A cybercrime is an offence committed through or against information and communications technology (ICT). Cybercrimes are either cyber enabled (using ICT to facilitate offences such as fraud or sexual exploitation) or cyber dependent (crimes which can only be committed via ICT, such as the use of ransomware or other malware).

A cyber security incident is an event, or series of events, that has a significant probability of compromising an organisation’s operations. Not all cybercrimes lead to cyber security incidents, and the following statistics are from 2 distinct datasets: cybercrimes reported to ReportCyber, and cyber security incidents to which the ASD's ACSC responded.

The cost of cybercrime

As the volume of cybercrime increases, cybercriminal methodology evolves, and digital transactions blur national borders, it is becoming increasingly difficult to accurately estimate the total cost of cybercrime.

Cybercrime can cause financial and reputational damage, disrupt business and essential services, and result in permanent damage to an organisation. Self-reported financial loss data as submitted to ReportCyber only captures a small portion of the total financial impact of cybercrime. It does not capture the cost to the customers of victims, nor the capital and recurring costs of cyber security incident remediation.

Frequency of cybercrime reports

During the 2021–22 financial year, over 76,000 cybercrime reports were made via ReportCyber, an increase of nearly 13 per cent from the previous financial year. One cybercrime report is made approximately every 7 minutes, compared to one report every 8 minutes in 2020–21.

Cybercrime reports by state and territory

Australia’s more populous states continue to report more cybercrime. Queensland and Victoria report disproportionately higher rates of cybercrime relative to their populations. However, the highest average reported losses were by victims in the Northern Territory (over $40,000 per cybercrime report where a financial loss occurred) and Western Australia (over $29,000).

Cybercrime by type

The most frequently reported cybercrimes were all cyber enabled crimes:

• online fraud: approximately 27 per cent
• online shopping: approximately 14 per cent
• online banking: approximately 13 per cent.

Cyber dependent crimes, such as ransomware, were a very small percentage of total cybercrime reports. Nevertheless, the ASD's ACSC assesses that ransomware remains the most destructive cybercrime threat. This is because ransomware has a dual impact on victim organisations—their business is disrupted by the encryption of data, but they also face reputational damage if stolen data is released or sold on. The public are also impacted by disruptions and data breaches resulting from ransomware.

Cybercrime loss by organisation size

Medium-sized businesses (defined by Australian Bureau of Statistics as between 20 and 199 employees) had the highest average loss per cybercrime report where a financial loss occurred.

This may be because they were less likely than large organisations to apply cyber security mitigations as outlined in the ASD's ACSC’s Strategies to Mitigate Cyber Security Incidents. These strategies decrease the likelihood and impact of cyber incidents. In addition, medium-sized organisations may be more likely to report cybercrime to ReportCyber, as they are less likely than larger organisations to have sufficient in-house or commercial incident response capabilities. The ASD's ACSC urges organisations to report all cybercrime, irrespective of the financial loss incurred, as it helps to better understand and defend against the threat.

Note: The 2021 Annual Cyber Threat Report averaged financial loss across all cybercrime reports. This year’s Report averages only those cybercrime reports where financial loss occurred. The ASD's ACSC assesses that excluding reports where no financial loss occurred provides more accurate and actionable data for businesses.

Calls to the ASD's ACSC

The number of calls to 1300 CYBER1 has continued to increase. The ASD's ACSC received more than 25,000 calls in the 2021–22 financial year, an average of 69 calls per day. This is a 15 per cent increase on the 2020–21 financial year and over a four-fold increase from the 2019–20 financial year, when the ASD's ACSC received 5,300 calls.

Cyber security incidents

During the 2021–22 financial year, the ASD's ACSC responded to over 1,100 cyber security incidents, an average of 21 cyber security incidents per week. Compared to the 2020–21 financial year, this is a decrease of 36 per cent. This does not mean that the cyber security threat to Australian organisations has decreased, especially as the number of cybercrime reports has increased. The expansion of Australia’s commercial incident response sector means incidents which may have previously required an ASD's ACSC response may now be being handled by in-house or contracted incident response teams.

Cyber security incident severity

The ASD's ACSC categorises each incident it responds to on a scale of Category 1, the most severe, to Category 6, the least severe. Incidents are categorised on severity of effect, extent of compromise, and significance of the organisation.

The number and severity of cyber security incidents in the 2021–22 financial year is not directly comparable with previous financial years, as the ASD's ACSC introduced a new incident categorisation scale in March 2022. This was due to the introduction of mandatory incident reporting for Regulated Critical Infrastructure under amendments to the Security of Critical Infrastructure Act 2018 (SoCI Act). Changes included simplifying the scale, prioritising incidents related to Critical Infrastructure and Systems of National Significance networks and refining definitions of cyber effects and impacts.

The severity of cyber security incidents is increasing. Nearly 15 per cent of incidents in the 2021–22 financial year were categorised as C3, up from approximately 6 per cent in the previous financial year. This is partly attributable to the category changes, but also to an increase in attacks by cybercriminals on larger organisations and an increased impact on victims. Attacks included the exfiltration of sensitive data and the movement by malicious actors across multiple segments of affected networks.

Cyber security incidents by sector

Excluding government sectors—which have some additional reporting obligations—the health care and social assistance sectors reported the highest number of cyber security incidents during the 2021–22 financial year. Compared to the 2020–21 financial year, the retail sector dropped out of the top 10, replaced by the electricity, gas, water and waste service sector.

The top 10 reporting sectors accounted for approximately 75 per cent of all incidents for the 2021–22 financial year. As such, these sectors are a focus for ASD's ACSC partnership and outreach activities.

Note: The reporting frequency of government agencies is in part due to their obligations to report significant cyber security incidents to the ASD's ACSC, and may not necessarily reflect a greater susceptibility to cyber security incidents.

State actors

Gaining a foothold to steal our secrets

In 2021–22, state actors continued to engage in malicious cyber operations as an efficient method of political and economic espionage. State actors seek sensitive information—including personally identifiable information (PII)—to support their government’s intelligence requirements. However these actors do not just want classified information. They also want to understand who we are, how we connect with each other, and what values we hold. Furthermore, in some cases, they may seek to pre-position in strategic networks to prepare for coercive or disruptive activity against us.

Over the past financial year, Australia continued to be the target of persistent cyber espionage by a wide range of state actors due to its regional and global interests, international partnerships and participation in multilateral forums. This cyber espionage is often conducted or directed by foreign intelligence services seeking information from public and private networks across Australia, including political, diplomatic, military, technological and commercial data, as well as personal data from individual Australians.

The ASD's ACSC collaborated with Australian, state and territory government agencies to ensure events such as the Census and state and federal elections were resilient to malicious cyber activity by state or criminal actors.

While state actors have access to a wide range of sophisticated and bespoke capabilities, the majority of compromises the ASD's ACSC observed used relatively simple tools and techniques. These include spear phishing, targeting third-party service providers and exploiting unpatched or misconfigured systems using public vulnerabilities. The exploitation of public vulnerabilities is low cost and scalable, and exploits can be deployed within hours of a patch release or technical write up. Exploiting public vulnerabilities also avoids the need to use zero-day exploits—vulnerabilities that have not been disclosed or patched by the software vendor—allowing state actors to preserve these for use against the highest value targets. State actors will likely continue to use simple tools and techniques to target government and business networks for as long as it remains effective, inexpensive and scalable.

Cyber operations as a geostrategic tool

The Indo-Pacific is at the centre of geostrategic competition, and cyber operations are a valuable tool in this contest. Some countries use cyber operations to gain advantage by stealing other nations’ security secrets and intellectual property at a greater scale than in the past. They can also use cyberspace to sow disinformation, interfere in economies and shape public sentiment. If necessary, states can launch cyberattacks that sabotage and destabilise their adversaries. Much of this can be done covertly, at relatively low cost and in ways that make it hard for other states to deter or respond.

Cyberspace itself has become a battleground. Some countries in our region continue to strain the norms and institutions that govern cyberspace as a global commons. These countries have increasingly cut access to the open internet and used digital tools to repress freedoms. These countries seek to export their approach and impose it on others by undermining international standards and technical protocols. Australia opposes these actions and is committed to a free and open Internet. In April 2022, Australia joined over 60 other nations in launching A Declaration for the Future of the Internet, which describes our position on the potential for digital technologies to uphold the values that promote connectivity, democracy, and the rule of law.

Cyberspace is also a joint warfighting domain, with cyber effects increasingly incorporated into military operations. Some countries are acquiring cyber capabilities which can ‘hold-at-risk’ the networks other countries rely on. To ‘hold-at-risk’ is to demonstrate the capability to overcome the defences of another country, to undermine confidence in networks and enable state actors to cripple essential services in the event of a conflict.

Cyber operations in military conflict

Russia’s invasion of Ukraine has altered the geopolitical balance in ways that could expose organisations to increased malicious cyber activity.

Ukrainian government officials have acknowledged they are fighting a dual war—one on the ground and one in the digital realm. Cyber operations have been used as a tool of war alongside a major ground offensive, with malicious cyber activity against Ukrainian networks before and during the conflict.

Ukraine has experienced an onslaught of sustained disruptive cyber activity, including distributed denial of service (DDoS) attacks. While the impact of this malicious activity has been mitigated by Ukraine’s cyber defensive measures, it still has the potential to cripple essential services and have cascading effects. In the first 6 weeks of the invasion, at least 8 variants of destructive malware were identified, including wiper malware designed to erase data and prevent computers from booting.

Against this backdrop, the integration of cyber operations into conventional war has drawn non-traditional combatants and civilian entities into the conflict. Criminal syndicates and issue-motivated groups have conducted activities in support of Russian or Ukrainian interests, independent of Russian and Ukrainian government chains of command. Issue-motivated groups have made claims of successful attacks against government and private networks, including exfiltration and posting of data on the darkweb. Such activities facilitate future potential cyberattacks by malicious state and non-state actors.

A subset of the malicious cyber activity which occurred in the first 60 days of the war is below. Disruptive activities continue unabated, and escalating geopolitical tensions will likely see the continued use of cyber effects as a means of dissuasion, disruption, degradation or denial.

Cyber risks to Australian networks

Russia’s invasion of Ukraine demonstrated the real threat of disruptive and destructive cyber operations, including the potential for third parties to suffer collateral damage. Some Russian cyber operations impacted beyond their primary target sets. For example, a 24 February 2022 attack on a satellite communications company had spillover effects across geographic borders. In addition to causing outages across Ukraine, this attack disabled over 10,000 satellite communications terminals outside Ukraine, including terminals that supported the operation of wind turbines and internet services for private citizens.

Previous cyberattacks against Ukraine have also had international consequences—such as the NotPetya malware in 2017, which affected companies worldwide, including in Australia. Russian cyber actors may conduct malicious activity as a response to military materiel support provided by the US, UK, Australia and other partners, as well as the economic costs imposed on Russia.

Australia would be vulnerable in future regional or global conflicts to cyber operations that target the supply chains that Australian systems depend upon. This would be the case even if Australia were not directly involved. There would probably be little warning of such disruption. Australian network owners need to consider how to secure their critical systems and protect their sensitive information; for instance, through improved segmentation between their corporate and operational networks.

What the ASD's ACSC is doing

In the lead-up to the invasion, DDoS attacks targeted Ukraine’s finance sector and banks. On 20 February 2022, Australia joined the US and UK in publicly attributing these cyberattacks to the Russian General Staff Main Intelligence Directorate.

On 23 February 2022, the ASD's ACSC released an Alert and an Advisory urging Australian organisations to urgently adopt enhanced cyber security postures by prioritising the following actions:

• patching applications and devices
• implementing mitigations against phishing and spear phishing attacks
• ensuring that logging and detection systems are fully updated and functioning
• reviewing incident response and business continuity plans.

In cooperation with our international partners from Canada, New Zealand, the UK and the US, on 21 April 2022, the ASD's ACSC released a joint Advisory specifically on Russian state and cybercriminal threats to critical infrastructure. The Advisory urges critical infrastructure network operators to prepare for and mitigate potential cyber threats by hardening their cyber defences and performing due diligence to identify indicators of compromise.

In addition, the ASD's ACSC has increased engagement with international partners to share tactics and techniques, and worked closely with industry partners to share knowledge of the threat environment. The ASD's ACSC briefed more than 200 business organisations on the risk of collateral damage to Australian networks following the Russian invasion of Ukraine, and has also provided multi-classification threat briefings to government and critical infrastructure partners.

Beyond the immediate threat presented by Russia’s invasion of Ukraine, the ASD's ACSC works to counter the risk of malicious activity by a wide range of state actors.

By the end of the 2021–22 financial year, the Advisory had:

• been updated 10 times.
• received more than 57,000 views, and
• a potential reach of more than 950,000 users through ASD's ACSC's social media platform.

Malicious cyber activity in first 60 days of Russia’s invasion of Ukraine

Europe

• Whole of economy
  • DDoS attack against major Telecommunications provider
  • Phishing campaigns launched against European citizens
• Government
  • Phishing campaign against European governments and militaries
  • Phishing campaign targeting officials helping evacuate Ukrainian refugees

Ukraine

• Whole of economy
  • Ransomware attacks on Ukrainian citizens
  • DDoS causes severe outages to Media and Telecommunications sector
  • Phishing campaign targeting Ukrainian media
• Government
  • Malware and DDoS attacks on Ukrainian government departments
  • Mass phishing campaign against Ukrainian government and military personnel

Russia

• Government
  • DDoS attacks on Russian government and state-owned enterprises such as media and banks
  • Issue-motivated groups exfiltrate emails and documents from Russian entities

Unites States

• Government
  • DDoS attack on Ukrainian embassies including in the US

Russian state-sponsored cyber actors

Russian state-sponsored cyber actors have demonstrated capabilities to compromise ICT networks, develop mechanisms to maintain long-term, persistent access to ICT networks, exfiltrate sensitive data from ICT and Operational Technology (OT) networks, and disrupt critical infrastructure systems and OT functions by developing destructive malware.

Numerous Russian government and military organisations have the capability to undertake cyber operations against ICT and OT networks, including elements of:

• The Russian Federal Security Service (FSB)
• The Russian Foreign Intelligence Service (SVR)
• The Russian General Staff Main Intelligence Directorate (GRU)
• The Russian Ministry of Defence

REDSPICE

REDSPICE (Resilience, Effects, Defence, SPace, Intelligence, Cyber, Enablers) will be pivotal to addressing future cyber threats. REDSPICE will expand the range and sophistication of ASD’s intelligence, offensive and defensive cyber capabilities, and deliver forward-looking capabilities essential to maintaining Australia’s strategic advantage and capability edge over the coming decade and beyond. It will:

• help anticipate and prevent a crisis
• block sophisticated cyberattacks against Australian critical infrastructure
• provide offensive capabilities that equip government with retaliatory options
• ensure Australia’s cyber and intelligence capabilities remain resilient to attack.
   
• 3X current offensive cyber capability
• 2X persistent cyber-hunt activities

The REDSPICE investment will help train a new generation of cyber and intelligence experts to protect Australia from cyber adversaries.

• 1900 new analyst, technologist, corporate, and enabling roles across Australia and the world
  • Analysts: Create our edge, solve the problems other cannot.
  • Technologists: Use emerging and cutting-edge technology and big data to solve complex problems.
  • Corporate & Enabling Services: Enable our purpose.

A nationally and internationally distributed workforce will create additional redundancy in ASD’s critical capabilities and opportunities for greater partnership with industry, academia and other sectors of the Australian economy.

• 40 per cent staff located outside Canberra
• 4X global footprint

REDSPICE will provide new intelligence capabilities and build our threat intelligence picture, including through threat intelligence sharing with ASD partners.

Enhanced National Cyber Defence

• Improves resilience of critical infrastructure against sophisticated cyber attacks
• Increases the visibility of threats to Australia’s most critical systems
• Improves machine-time cyber threat intelligence sharing across government and industry
• Doubles persistent cyber-hunt activities and nationwide cyber-incident response.

REDSPICE provides $5 billion in opportunities for Australian industry, including small and medium Australian enterprises. This will grow the wider Australian cyber security sector.

Cybercrime

Proliferation of threats

Australia is an attractive target for cybercriminals. Our widespread internet connectivity, per capita wealth, and investment structures—such as moveable superannuation accounts and widespread share ownership—are all powerful incentives for cybercriminals.

During the 2021–22 financial year, fraud, financial and identity theft and BEC continued to be common cyber threats due to their volume and ability to cause severe and long-term harm. Many actors used common techniques such as spear phishing to compromise victims’ networks.

Australia’s cybercrime environment over 2021–22 was underpinned by the constant, rapid evolution of cybercriminal techniques used to target Australia for profit. This evolution was not limited to malware but encompassed all aspects of the cybercriminal environment, including target identification and exploitation, service delivery, cash-out methods, and supporting infrastructure. Ultimately, while cybercrime capabilities became more sophisticated, they also became more accessible for less technologically skilled actors. This ongoing evolution enabled cybercriminals to consistently adapt to environmental changes, while remaining resilient to disruption efforts by law enforcement.

Cybercrime-as-a-Service

The evolution of Cybercrime-as-a-Service (CaaS) continued to increase the overall cybercrime threat to Australia. CaaS encompasses an ever-increasing range of purchasable tools, services and information used to facilitate cybercriminal operations. Examples of CaaS include, but are not limited to, the complicit provision of server infrastructure used to host cybercriminal campaigns, the sale of access to compromised victim networks, money laundering services, and the development and obfuscation of malware. The availability of these enabling functions means that individual actors are not required to be an expert in every component of a criminal operation. In effect, cybercriminals are outsourcing elements of their operations, and a growing black market is serving their needs.

The expansion of the CaaS industry has lowered the barrier to entry for actors seeking to conduct cybercrime. For instance, Ransomware-as-a-Service (RaaS) provides actors who may not have the technical skill to develop their own ransomware with an opportunity to launch highly profitable attacks. In addition, the CaaS industry allows actors to monetise their expertise in a particular skillset. As a consequence, cybercriminals have become more specialised over 2021–22, and pose a greater threat to Australians and businesses.

During 2021–22, the ASD's ACSC collaborated with partners on 5 successful operations against criminal online marketplaces and foreign scam networks. While offshore cybercrime groups have exploited Australian victims, individual actors—including Australian citizens—remain a threat. Australian law enforcement agencies have leveraged international partnerships to tackle criminal behaviour across the globe.

Business Email Compromise

BEC, where malicious actors compromise organisations via email, continues to be lucrative for cybercriminals. BEC is not limited to scamming businesses out of money or goods. Cybercriminals also use BEC to pretend to be business representatives or to trick employees into revealing confidential business information. BEC is also an entry point for malicious actors to move into higher value targets within networks. The compromise of a single employee email can be a prelude to a major ransomware attack.

In 2021–22, the number of successful BEC reports declined slightly to 1514. However, self-reported losses in 2021–22 increased significantly to over $98 million. Nationally, the average loss per successful BEC increased to over $64,000. The most BEC reports came from Queensland (389 reports), but average self-reported financial losses were highest in Western Australia, at approximately $112,000 per report. Western Australia had several reports of financial losses over $1 million due to BEC, lifting its overall average.

Investigations into BEC suggest property settlements are being targeted. This is likely due to the high value of transactions. Property prices increased further during the coronavirus pandemic and digital settlement methods became more entrenched, making property transactions an attractive target. Despite the best efforts of law enforcement agencies, only a small fraction of BEC financial losses are ever recovered.

How to protect yourself from cybercrime

Cybercriminals are increasingly persistent in targeting all sectors of Australia’s economy. Financial losses divert resources from other areas of critical need. The ASD's ACSC seeks to counter this targeting through tailored advice to different sectors of Australian society; for instance through the Act Now Stay Secure communication and uplift program.

Over the 2021–22 financial year, the Act Now, Stay Secure advertising campaign:

• delivered over 57 million online ads to Australians though social media, video and search
• reached over 6.2 million Australians through broadcast radio advertising
• was supported by an organic social media campaign with a potential reach of 637,000 people
• was amplified by 191 stakeholders sharing campaign content to their own channels.

Act Now, Stay Secure themes:

• July 2021
  • Email Security
• August 2021
  • Backups
• September 2021
  • Annual Cyber Threat Report
• October 2021
  • Updates
• November 2021
  • Online Shopping
  • The launch of the Australian Cyber Security Hotline
  • The launch of the online learning resources on cyber.gov.au
  • The launch of the Small Business Cyber Security guide
• February 2022
  • Secure Your Portable Devices
  • Cyber Security Instruction Manual: A Kid's Guide
•  March 2022
  • Backups
  • ASD's ACSC Alert and Advisory
• April 2022
  • Ransomware
• May 2022
  • Password Managers
• June 2022
  • Email Security

Ransomware

Ransomware targeting

Ransomware is a cyber dependent crime which can impact everyone from consumers through to countries. For example, the Costa Rican Government declared a state of emergency in May 2022 following ransomware attacks on nearly 30 government institutions, including its health, finance, energy and social services departments. While Australia has not experienced an incident of this scale, the potential remains for cybercriminals to cause widespread disruption.

Top-tier ransomware groups are continuing to target Australian ‘big game’ entities—organisations that are high profile, high value, or provide critical services. While global trends indicate a decline in ‘big game’ targeting and a shift towards targeting small and medium sized businesses, that change has yet to be seen in Australia.

The business model of ransomware groups continued to evolve. Some ransomware groups now share victim information, increasing the ransomware threat as victims potentially face targeting by more than one group. For example, after announcing its shutdown, the BlackMatter group transferred its victims to ransomware infrastructure owned by another group, known as Lockbit 2.0. And, in October 2021, members of the Conti ransomware group reportedly began selling access to victims’ networks, enabling follow-on targeting by other actors.

Ransomware tactics

The combination of data encryption and threats to publicly release sensitive information as a method of pressuring ransomware victims into paying is known as ‘double extortion’. Victims who previously would have been able to recover from a ransomware incident by maintaining regular backups may still be vulnerable to reputational damage resulting from double extortion. In 2021–22, ransomware actors continued to incorporate additional extortion tactics in their operations to more effectively extract payment from victims. This is often referred to as ‘multifaceted extortion’. Examples of additional extortion tactics include convincing third-party stakeholders to pressure victims into negotiation, and sustained DDoS attacks against the victim’s network during ransom negotiations.

Ransomware-as-a-Service

The ASD's ACSC observed the emergence of new and possibly rebranded RaaS operations over 2021–22. The availability of RaaS offerings affords cybercriminals a choice about the tools they can use. Ransomware syndicates also continued to professionalise by using third parties to negotiate with victims, assist them in receiving their ransom payments, and arbitrating disputes between actors.

• Pre-crime: Cybercriminals establish themselves online and obtain the necessary skills, experience and/or relationships to be successful.
   
• Preparation: Cybercriminals design and implement their operating model, including establishing technical and financial infrastructure and selecting their target.
   
  • Money Movement 1 - Cybercriminal to Service Providers
     
• Actualisation: Cybercriminals commit the crime, including conducting network reconnaissance, exfiltrating data and encrypting files.
   
• Engage and negtiate: Cybercriminals engage with victim/third party to apply pressure and/or negotiate ransom payment.
   
  • Money Movement 2 - Victim to Cybercriminal
     
• Exit: Cybercriminals conclude the crime and cease all victim contact. Depending on ransom payment, cybercriminals will leak or decrypt victim data.
   
  • Money Movement 3 - Cybercriminal to Criminal Associates
     
• Post-crime: Cybercriminals profit from the activity, including laundering the funds to safely access the proceeds of crime. Cybercriminals pay collaborators and advertise success to enhance reputation.

Ransomware trends

All sectors of the Australian economy were directly impacted by ransomware in 2021–22. The ASD's ACSC received 447 ransomware cybercrime reports via ReportCyber. While this is a 10 per cent decrease compared with the 2020–21 financial year, reports remain higher than in 2019–20. It is also likely that ransomware remains significantly underreported, especially by victims who choose to pay a ransom.

The education and training sector reported the most ransomware incidents in 2021–22, rising from the fourth-highest reporting sector in 2020–21. The threat to the education and training sector is significant as its business model favours open collaborative environments. Remote learning during the coronavirus pandemic also introduced large numbers of personal devices and new software into this sector.

The top 5 reporting sectors for ransomware accounted for 47 per cent of all ransomware-related cybercrime reported to ReportCyber during the 2021–22 financial year.

The ASD's ACSC responded to 135 cyber security incidents related to ransomware, an increase of over 75 per cent compared to 2019–20. In addition, the ASD's ACSC identified and notified 148 organisations of ransomware activity

Data breaches

Cybercriminals target the PII of employees and customers, seeking to maximise the commercial and reputational impact of a data breach. In the last financial year, human resources organisations such as payroll and recruitment companies have been frequently targeted by ransomware actors, as these types of companies provide services across a wide range of sectors. Compromises of payroll providers in 2021–22 led to the data of hundreds of thousands of Australian employees being accessed and exposed.

Social assistance organisations, which hold sensitive data on vulnerable people, have also been targeted in Australia and internationally. For example, in January 2022, the Swiss-based International Committee of the Red Cross publicly stated a ransomware attack on its servers had compromised the personal data of more than half a million people, including refugees and internally displaced people in conflict zones across the world.

Cost to victims of ransomware

Regardless of the size of the victim, ransomware can be expensive to resolve. The most immediate costs come from the lost productivity due to system downtime, and the time and money needed to rebuild systems following an incident. The legacy of a ransomware incident poses additional challenges, such as tarnishing a victim’s reputation among its customers.

Victims of ransomware attacks continued to use third-party negotiators to facilitate payment of ransom demands in 2021–22. The level of coverage provided under cyber insurance policies is also a contributing factor in how these incidents are handled and resolved by victims, and whether a business decides to pay the ransom.

A 2022 study published by the Australian Institute of Criminology found only 19 per cent of ransomware victims sought advice or support from police or the ASD's ACSC. However, the study found nearly 60 per cent sought help from at least one formal source outside of their family or friends. The study found 23.2 per cent of small to medium business victims paid the ransom, with many millions of dollars being paid in ransoms and other associated costs.

Irrespective of the decision to pay a ransom, all victims are strongly encouraged to report ransomware-related cybercrime and cyber security incidents to the ASD's ACSC. This is essential to develop national visibility of ransomware threats, including emerging trends and ransomware precursors. Even when organisations have sufficient in-house or contracted incident response to address a ransomware incident, sharing technical and contextual information with the ASD's ACSC enables the ASD's ACSC to implement measures to reduce ransomware targeting and protect other potential victims.

Critical infrastructure

Current critical infrastructure threat

The cyber threat to Australia’s critical infrastructure is an enduring concern, because the social or economic well-being of the nation depends on critical infrastructure assets working in cohesion. Critical infrastructure encompasses the physical facilities, communication networks, and information and operational technologies that provide essential services. A sustained disruption in one part of the critical infrastructure ecosystem has knock-on effects elsewhere in the economy, and could ultimately lead to harm or loss of life, as seen internationally as a consequence of ransomware attacks on health services. The potential remains for state actors and cybercriminals to cause similar disruption through targeting of Australian critical infrastructure entities.

During 2021–22, critical infrastructure networks globally were targeted at phenomenal rates. Russia’s targeting of Ukrainian critical infrastructure was particularly prolific, including the use of destructive malware against high-voltage electrical substations. However, the threat is not limited to Ukraine. Some Russia-aligned cybercrime groups—including one that has successfully targeted Australian critical infrastructure—have publicly threatened to conduct operations against Ukraine’s allies.

The risk to Australia’s critical infrastructure networks is real. In 2021, the corporate network of electricity generator CS Energy was targeted by the Russia-aligned Conti ransomware group, as detailed below.

Not all targeting of critical infrastructure is geostrategic; some is profit-motivated, and some is opportunistic exploitation of widespread vulnerabilities. Even the most trivial exploitation can result in major impact, especially if malicious actors move laterally from internet-facing devices on corporate networks to the operational networks of critical infrastructure providers. Certain critical infrastructure networks face additional challenges, such as the use of legacy operational technology with long life cycles (up to 50 years for some operational hardware), making patching and monitoring of networks more difficult.

Critical infrastructure trends

During 2021–22, the ASD's ACSC reshaped its definition of critical infrastructure to better align with the definitions of Regulated Critical Infrastructure and Systems of National Significance under the SoCI Act. In the 2020–21 financial year, the ASD's ACSC defined approximately one quarter of cyber security incidents it responded to as affecting critical infrastructure. However, this definition covered a range of infrastructure and services outside the scope of the SoCI Act, and also captured some severe incidents regardless of sector. In the 2021–22 financial year, using the new definitions, 95 cyber incidents (approximately 8 per cent of all cyber incidents the ASD's ACSC responded to) affected critical infrastructure. Since the implementation in April 2022 of amendments to the SoCI Act, the ASD's ACSC has notified 5 critical infrastructure entities of cyber incidents and vulnerabilities on their networks.

The ASD's ACSC urges organisations to report all cyber security incidents, regardless of whether or not their organisation is subject to mandatory reporting under the SoCI Act. Reporting increases the visibility of threats, enables the identification of trends, and supports the prevention and mitigation of future incidents.

Ransomware and critical infrastructure

Over 2021–22, there were further examples of ransomware groups targeting critical infrastructure. For instance, the BlackCat ransomware group targeted government and critical infrastructure organisations, as well as the finance and construction sectors globally.

The threat to critical infrastructure is not limited to large utilities such as electricity providers. For example, local governments can be an attractive target, as some councils have responsibility for essential services such as water and sewage.

Advice and support for critical infrastructure organisations

A wide range of critical infrastructure providers are subject to mandatory cyber incident reporting requirements, including critical food, transport and higher education assets. The ASD's ACSC has a dedicated portal for reporting cyber security incidents that impact critical infrastructure assets, including a list of critical infrastructure sectors and asset classes following amendments to the SoCI Act.

In recognition of the additional cyber security obligations critical infrastructure organisations have, the ASD's ACSC offers tailored critical infrastructure exercise and uplift programs. These assist ASD's ACSC partners to implement risk mitigation strategies.

Critical vulnerabilities

Vulnerabilities being targeted faster and by more actors

During 2021–22, the number of software vulnerabilities recorded worldwide increased by more than 25 per cent compared to the previous financial year. Over 24,000 Common Vulnerabilities and Exposures (CVEs) were identified during 2021–22. Of these, there were numerous critical and high-impact vulnerabilities, with notable examples including vulnerabilities in Microsoft Azure, Log4j products. Within hours of disclosure, the ASD's ACSC identified malicious actors conducting scanning and reconnaissance against internet-accessible networks to identify unpatched software. In some instances, cyber actors successfully compromised Australian networks using publicly disclosed critical vulnerabilities.

The rapid use of newly released critical vulnerabilities is now standard tradecraft for many malicious actors. Certain software and hardware is used ubiquitously across government, critical infrastructure, small business and by individual users, presenting malicious actors with a plethora of potential victim networks. When a new vulnerability emerges, the ASD's ACSC’s Cyber Hygiene Improvement Programs (CHIPs) frequently identifies numerous Australian devices which are unpatched and vulnerable to exploitation.

Comparative critical vulnerabilities timelines

The time between vulnerability disclosure and exploit is closing rapidly; what once took weeks is now taking days or even hours. The following timelines highlight the shortening window for organisations to mitigate threats:

Confluence

What is Confluence?

A web-based database tool for team collaboration, developed by Australian technology company Atlassian.

• 25 August 2021
  
  Atlassian publicly announced a vulnerability (CVE-2021–26084) in certain versions of Atlassian Confluence and released software version updates the same day.
  
   
• 31 August 2021
  
  A Proof of Concept for the exploit was published online; first public reports of exploitation occurred the same day.
  
   
• 1 September 2021
  
  A CHIPs scan detected malicious actors scanning for, and attempting to exploit, this vulnerability on Australian networks. The ACSC published an Advisory the same day.

F5 BIG-IP

What is F5 BIG-IP?

A platform used to control traffic that passes through an enterprise network, developed by US company F5.

• 4 May 2022
  
  F5 publicly disclosed a vulnerability in BIG-IP network devices that allowed malicious actors to execute arbitrary commands, create or delete files, or disable services. F5 encouraged users running at-risk versions to upgrade as soon as possible.
  
   
• 6 May 2022
  
  ACSC performed CHIPs scanning to determine how many Australian devices were vulnerable, and notified government operators.
  
   
• 6-7 May 2022
  
  Just days after the vulnerability was disclosed, researchers published exploits, with malicious actors soon using them in attacks across the internet.
  
   
• 9 May 2022
  
  The ACSC published an Advisory addressing multiple vulnerabilities in the F5 BIG-IP Product Range.
  
  Exploits which required just 2 commands and some headers became publicly known. The vulnerability was so easy to exploit that some security researchers speculated that it did not end up in the products by accident.
  
   
• 10 May 2022
  
  Security researchers tweeted that “real world devices are being erased”. The ACSC received its first reported Australian incidents relating to exploitation of F5.

The scalability and low cost of automated cyber exploitation techniques mean the driver for this type of compromise is likely to be the existence of vulnerabilities in victim organisations, rather than an adversary’s interest in a particular network. This ability of a wide array of cyber threat actors to compromise multiple networks, and then assess the value of those accesses, will make it more difficult to attribute a specific motive for targeting an individual Australian network.

Log4j

The most prevalent critical vulnerability in the 2021–22 financial year was Log4j. Log4j is a popular software building block found in a wide variety of Java applications. It provides logging functionality, recording the activity of the software in order to diagnose problems. Over 100,000 products may contain Log4j—as Log4j is open source software, there is no definitive list.

The series of Log4j vulnerabilities made public in December 2021 were trivial to exploit. The vulnerability could be used to execute code on the servers of the Minecraft video game by pasting messages into a chat box, for example.

In response to the Log4j vulnerabilities, the ACSC raised awareness, provided timely advice, and worked closely with government, industry partners and impacted organisations to protect against exploitation of this vulnerability. Over December 2021 – January 2022, the ACSC provided technical support to impacted organisations, released 2 critical Alerts and 2 Advisories that were regularly updated, hosted 7 information sharing events through the Australian Signals Directorate’s Cyber Security Partnership Program, and amplified advice on social media which had a potential reach of over one million people.

The ACSC is aware of malicious actors, including sophisticated cyber threat actors, conducting a large number of reconnaissance scans for Log4j vulnerabilities. Some Australian networks were compromised through Log4j, and the ACSC responded to over 50 cyber security incidents.

The ACSC has identified Log4j exploits being used months after the initial disclosure. Malicious actors also routinely scan for vulnerabilities years after they are initially disclosed, targeting networks which are running legacy software or have failed to patch. For instance, a 28 April 2022 Joint Five-Eyes Advisory observed that 6 of the top 15 Routinely Exploited Vulnerabilities in 2021 were first disclosed in 2020 or earlier. Log4j is likely to be a means of access for malicious actors for years to come.

Log4j Timeline

• 24 November 2021
  The cloud security team of Chinese company Alibaba privately reported the Log4j vulnerability to the software developer.
   
• 10 December 2021
  The vulnerability was publicly disclosed by cyber security researchers. The ACSC issued a public Alert the same day and commenced a comprehensive suite of awareness and response initiatives to prevent potential compromises.
   
• 13 December 2021
  The ACSC commenced technical incident response assistance to impacted organisations, and commenced briefings of the National Cyber Security Committee, Australian Government Chief Information Officers and industry partners.
   
• 14 December 2021
  The ACSC published an updated Alert advising the ACSC had observed active exploitation of this vulnerability within Australia.
   
• 15 December 2021
  The ACSC published a public technical Advisory.
   
• 16-22 December 2021
  The ACSC published additional Alerts and Advisories, and public webinars.
   
• 23 December 2021
  The ACSC published an additional Alert, highlighting malicious actors using Log4j for ransomware activities.

Cyber defence and resilience

Interconnectivity brings risks and opportunities

The virtualisation of Australian life that accelerated during the coronavirus pandemic has become entrenched. Remote working arrangements have given way to a hybrid working model, further increasing cyber security risks as employees switch regularly between personal and corporate devices.

For example, small office/home office (SOHO) modems, routers and network-attached storage are usually insecurely designed with minimal security maintenance. SOHO routers are notorious for having insecure firmware, hardcoded backdoors, and inconsistent patching. Even if secure patches are available, individual users are highly unlikely to install them. And most SOHO routers manufactured before 2017 have no ability to automatically update firmware. Meanwhile, the Internet of Things is growing by billions of devices each year and will introduce new types of vulnerabilities—for instance, in April 2022, researchers released a proof of concept for compromising smart speakers by having the device issue voice commands to itself.

The blurring of work and home lives has made the information held by individuals more valuable to malicious actors. Email accounts listed in PII holdings will almost certainly be under increased threat of spear phishing activity. The theft of PII creates a risk that ordinary Australians will be victimised and need substantial support. In some cases, a victim will be impacted for the rest of their life as exposure of their personal information, once leaked or sold, cannot necessarily be remediated.

As interconnectivity grows, malicious actors are increasingly looking to compromise multiple victims across a range of sectors via a single entry point. The ACSC expects this trend to continue. For example, MSPs were targeted over 2021–22 as they are used by government, commercial and not-for-profit businesses of all sizes, making them an attractive target for malicious actors. Malicious actors increasingly view the supply chain as a priority target and a vector for compromise.

What is the ACSC doing?

The ACSC is delivering a range of initiatives that streamline—and where possible, automate—active cyber defence and intelligence sharing. REDSPICE will further strengthen Australia’s cyber defences.

Uplifting an interconnected Australian economy

Australia’s best defence in a rapidly evolving cyber threat environment is to build resilience across businesses and organisations, and among individuals. As vulnerabilities and interdependencies increase, preventative cyber security measures are not sufficient; organisations should also develop and test incident response, business continuity and disaster recovery plans. Commercial incident response providers have a particularly important role to play; they offer services to organisations which may have limited in-house capabilities, as well as reduce demand on the ASD's ACSC’s finite incident response capabilities. The ASD's ACSC is conducting a suite of incident response transformation activities to increase information sharing and reporting, while growing the scale and maturity of commercial providers and the cyber security sector as a whole.

The consequences for organisations which fail to manage cyber security incidents are clear. In May 2022, the Federal Court of Australia found that financial planning firm RI Advice had breached its financial services license obligations by having inadequate cybersecurity risk management systems. While the judgement does not set a legal standard for Australian Financial Services Licencees or other organisations, it is a strong reminder that company boards should consider cyber resilience as part of their statutory responsibilities. The ASD's ACSC publishes tailored advice for company boards, such as the January 2022 publication Log4j: What Boards and Directors Need to Know. The ASD's ACSC also directly engages senior executives through the Joint Cyber Security Centres.

What can my organisation do?

Essential Eight

The Australian Cyber Security Centre (ACSC) has developed prioritised mitigation strategies—in the form of the Strategies to Mitigate Cyber Security Incidents—to help organisations protect themselves against various cyber threats.

The Essential Eight Maturity Model, first published in June 2017 and updated regularly, supports the implementation of the Essential Eight. It is based on the ACSC’s experience in producing cyber threat intelligence, responding to cyber security incidents, conducting penetration testing and assisting organisations to implement the Essential Eight.

The Essential Eight remains highly relevant, with a major update released in July 2021. In recognition of the degrading cyber threat environment, in March 2022 the Attorney-General’s Department mandated the Essential Eight for all non-corporate Commonwealth entities through amendments to the Protective Security Policy Framework.

Become an ASD Partner

The Australian Signals Directorate’s Cyber Security Partnership Program facilitates ASD's ACSC engagement with Australian organisations and individuals to lift cyber resilience across the Australian economy.

The Australian Signals Directorate’s Cyber Security Partnership Program comprises 3 tiers to reach the entire Australian economy:

• Network Partners – for organisations with responsibility for their own ICT environments, experts in cyber security such as academics, and not-for-profit institutions. The community of ASD Network Partners includes cyber security professionals across government, industry, and academia. Bringing together the situational awareness, technical expertise and experience of this community allows the collective public and private sectors to support and learn from each other. ASD Network Partners are provided access to threat intelligence, news and advice to enhance situational awareness; collaboration opportunities with fellow cyber security professionals; and resilience-building activities (such as exercises, discussions, workshops).
• Business Partners – for businesses that would like to be kept up to date with relevant cyber security information for their businesses, including those not eligible for the Network Partner tier. This tier of partnership provides organisations with a better understanding of the cyber security landscape and outlines the steps required to protect themselves from cyber security threats. They receive a subscription to the ASD's ACSC Alert Service and a monthly newsletter containing news, publications and Advisories produced by the ASD's ACSC.
• Home Partners – for individuals and families that would like to be kept up to date with relevant information. ASD's Home Partners receive a subscription to the ASD's ACSC Alert Service, providing them with a better understanding of the cyber security environment.

Joint Cyber Security Centres

The JCSCs support the Network Partner tier of the Australian Signals Directorate’s Cyber Security Partnership Program to bring together businesses and the research community, along with Australian, state and territory government agencies, in an open and cooperative environment. JCSCs in Adelaide, Brisbane, Melbourne, Perth, Sydney and Hobart, along with a virtual JCSC in Darwin, provide opportunities for the Australian cyber security community to come together in a trusted, neutral environment to drive collaboration and information-sharing.

Over the 2021–22 financial year, ASD's Network Partner membership has increased by 34 per cent, now comprising over 2,300 partners. Business Partners increased by 65 per cent to over 3,400 and Home Partners by 8 per cent to over 82,000.

What can individuals do?

The risk of malicious cyber activity impacting Australian individuals remains high. The ASD's ACSC provides easy steps to secure your devices and accounts at cyber.gov.au, including step-by-step guides on how to enable multi-factor authentication (MFA) on popular social networking applications.

Individuals are encouraged to patch or mitigate critical vulnerabilities within 48 hours. Individuals should turn on automatic updates on all devices and apps, including personal mobile phones, computers and smart devices such as smart speakers. Individuals should be aware that many device manufacturers and software providers only support updates for a limited number of years, and older devices and software may have security vulnerabilities that cannot be patched.

Individuals should also activate MFA, backup devices, set secure passphrases and be alert for scams.

Individuals interested in becoming an ASD Home Partner should register for the ASD's ACSC Alert Service.

• Patch within 48 hours
• Turn on automatic updates
• For advice, call the Australian Cyber Security Hotline 1300 CYBER1 (1300 292 371)
• Activate MFA, backup devices, set secure passphrases and be alert for scams

About the ASD's ACSC

ASD's ACSC leads the Australian Government’s cyber security activities. The ASD's ACSC brings together capabilities to improve the cyber resilience of the Australian community and help make Australia the most secure place to connect online. The ASD's ACSC’s services include:

• the Australian Cyber Security Hotline, which is contactable 24 hours a day, 7 days a week, via 1300 CYBER1 (1300 292 371)
• publishing Alerts, technical advice, Advisories and notifications on significant cyber security threats
• cyber threat monitoring and intelligence sharing with our partners in Australia and overseas to counter cyber security threats
• Joint Cyber Security Centres (JCSCs) that support collaboration between over 80,000 Australian organisations and individuals on cyber security issues
• exercises and uplift activities to enhance the cyber security resilience of Australian organisations.

The ASD's ACSC acknowledges the contributions from Australian, state and territory government agencies and industry organisations in developing this report.

About the contributor

	Australian Signals Directorate ASD’s purpose is to defend Australia from global threats and help advance Australia’s national interests. It does this by mastering technology to inform, protect and disrupt. ASD delivers intelligence, cyber security and offensive operations in support of the Australian Government and the Australian Defence Force.
	Australian Criminal Intelligence Commission The Australian Criminal Intelligence Commission (ACIC), as Australia’s national criminal intelligence agency, works with law enforcement partners to improve the nation’s ability to respond to crime. The ACIC contributes to the cybercrime intelligence function within the ASD's ACSC. Its role in the ASD's ACSC is to provide cybercrime-related criminal intelligence insights by working closely with law enforcement, intelligence and industry security partners in Australia and internationally.
	Australian Federal Police The Australian Federal Police (AFP) is responsible for enforcing Commonwealth criminal law; contributing to combating complex transnational, serious, and organised crime impacting Australia’s national security; and protecting Commonwealth interests from criminal activity in Australia and overseas. The AFP’s cybercrime teams within the ASD's ACSC enable the AFP to collaborate with other ASD partners, triage new referrals, undertake targeted intelligence development and coordinate law enforcement responses to cybercrimes of national significance. The AFP also leads the Joint Policing Cybercrime Coordination Centre to harness the powers, experiences and investigative capabilities of Australian policing jurisdictions.
	Australian Security Intelligence Organisation The Australian Security Intelligence Organisation (ASIO) is Australia’s security intelligence service. It protects Australia and Australians from threats to their security, including terrorism, espionage, and interference in Australia’s affairs by foreign governments. ASIO’s cyber program is focused on investigating and assessing the threat to Australia from malicious state-sponsored cyber activity. ASIO’s contribution to the ASD's ACSC includes intelligence collection, investigations and intelligence-led outreach to business and government partners.
	Defence Intelligence Organisation The Defence Intelligence Organisation co-leads the ASD's ACSC’s Cyber Threat Assessment team in partnership with ASD to provide the Australian Government with an all-source, strategic, cyber threat intelligence assessment capability.
	Department of Home Affairs The Department of Home Affairs leads cyber security policy for the Australian Government, including developing Australia’s Cyber Security Strategy 2020 and overseeing its implementation. Home Affairs Cyber and Infrastructure Security Outreach officers are co-located in the Joint Cyber Security Centres. Outreach officers work with small and medium businesses, with a particular focus on critical infrastructure entities, or those entities that sit within the critical infrastructure supply chain, providing them with advice on where to access information to uplift their cyber security and resilience.

Notes

Sources

The ASD's ACSC manages or uses a number of unique datasets to produce tailored advice and assistance for Australian Governments, organisations and the public. Data used in this report have been extracted from live datasets of cybercrime reports and cyber security incidents reported to the ASD's ACSC. As such, the statistics and conclusions in this report are based on point-in-time analysis and assessment. Cybercrime and cyber security incidents reported to the ACSC may not reflect all cyber threats and trends in Australia’s cyber security environment.

The ASD's ACSC encourages the reporting of cyber security incidents and cybercrimes to inform ASD's ACSC advice and assistance to vulnerable organisations, and enhance situational awareness of the national cyber threat environment.

Glossary

The ASD's ACSC glossary provides definitions for terms used in this Report and other ASD's ACSC publications.

Feedback

The ASD's ACSC welcomes feedback to improve the services it provides to Australians. Feedback can be provided via our feedback form.