More than 82k cyber crime reports fielded in 12 months, confirms Australian Signals Directorate

In that time, the ASD’s Australian Cyber Security Centre fielded over 82,000 cyber crime reports – about one every six minutes.

In addition, the agency responded to more than 1,500 cyber security incidents and notified more than 4,400 Australian organisations of potentially malicious activity.

That’s 80 per cent more than the previous year.

The report’s findings prompted Minister for Home Affairs and Minister for Cyber Security Tony Burke to deliver a clear warning: “Being under attack is certain, constant and ever present”.

The ASD noted that AI has become “the defining force in the cyber threat landscape” over the last 12 months, giving threat actors vastly greater ability to act at speed and scale.

At the same time, however, the ASD believes AI has more potential to boost Australia’s sovereign capabilities and national security than any technology since World War II.

VIEW ALL

“ASD’s Annual Cyber Threat Report reflects the fact that Australia continues to face a challenging strategic environment with AI accelerating the scale, speed and complexity of cyber threats,” Richard Marles, Deputy Prime Minister and Minister for Defence, said in a 26 October statement.

“AI is reshaping the online landscape, enabling cyber criminals and state-sponsored actors to launch faster, more sophisticated and scalable attacks. To stay ahead, Australians must enhance their cyber defences while harnessing AI’s benefits.

“The Annual Cyber Threat Report reinforces that government and industry must continue to work together to strengthen our collective cyber resilience and safeguard our critical digital infrastructure.”

In the wake of the report, the ASD is urging Australian organisations to strengthen cyber resilience, address vulnerabilities quickly and prioritise security over service availability.

“It is vital that businesses prepare for service disruptions from a cyber incident,” the ASD said.

“Protecting Australia’s critical infrastructure and essential services starts with strengthening cyber resilience, addressing vulnerabilities quickly and embedding strong cyber security practices before incidents occur.”

Other key figures include:

• More than 37,500 calls answered by the Australian Cyber Security Hotline.
• The publication of 76 cyber alerts and advisories, including joint releases with international partners.
• More than 564 million malicious domains were blocked after ASD’s Protective Domain Name System processed more than 220 billion queries.
• The average reported cyber crime costs were $33,000 for individuals and $93,500 for businesses.

The ASD is also calling on organisations to report suspicious activity earlier and prepare for cyber incidents that could disrupt essential services

“To keep people safe, we’re positioning Australia to respond to the evolving threats and opportunities presented by emerging technologies,” Burke said.

“That starts with protecting critical infrastructure and government systems, securing technology at its source and enabling people as our strongest defence, to become Australia’s ‘human firewall’.”

You can read the full report here.

Niraj Naidu, cyber security firm Rubrik’s regional chief technology officer for Australia and New Zealand, said the release was a timely one given the PHP2Shell vulnerability, adding that “technical complexity is not the safety net it once was”.

“AI is shrinking the time between a flaw becoming public and someone trying to exploit it. Response speed matters more than ever,” he said.

“Attackers are rapidly exploiting these flaws and the first job for local security leaders is to patch or mitigate immediately, while systems that can’t be secured should come offline. Australian organisations already have a benchmark, with the Essential Eight setting a 48-hour patching window for internet-facing systems when a vulnerability is critical or a working exploit exists.”

The issue, according to Naidu, is not that the flaws aren’t new, but rather that AI is making flaws that were, historically, once harder to exploit an easier proposition for threat actors.

“Patching is only the start as organisations across A/NZ need to know what data and identities sit behind exposed assets, detect compromise early, contain lateral movement, and be confident their back-ups are clean,” Naidu said.

“We can’t prevent every compromise, so we need to prove we can withstand and rapidly recover from them.”