Executive Summary The last 24 hours in the Australian cyber security landscape have been dominated by significant government action against AI platforms and a confusing ransomware situation in the healthcare sector. On 6 February 2026, the Australian Government officially banned DeepSeek from government devices, citing national security concerns and severe vulnerabilities in the model’s safety guardrails. Simultaneously, the healthcare sector is on high alert as conflicting reports emerge regarding a massive data theft at a major Victorian provider.

Here is your daily deep dive into the threats impacting Australian organisations today.

Government & AI Systems: The DeepSeek Ban

Sectors: Government, EdTech, SaaS Threat Level: Critical

Following advice from intelligence agencies, the Australian Government has mandated the removal of DeepSeek products from all federal systems as of yesterday.

The Vulnerability: Security researchers have demonstrated that the DeepSeek-R1 model is highly susceptible to adversarial manipulation. Independent analysis revealed the model failed 58% of jailbreak attempts and 86% of prompt injection tests, allowing it to generate harmful content, including malware code and disinformation, despite built-in safety filters.
Impact: This ban highlights the growing risk of Shadow AI in government and enterprise environments. Agencies and SaaS providers integrating similar LLMs must immediately review their "guardrail" implementations.
Action: Organisations should audit their networks for unauthorised use of DeepSeek and other non-compliant AI tools.

Healthcare: The 0APT Ransomware Mystery

Sectors: Healthcare, Privacy Threat Level: High

A new threat group, 0APT, has claimed responsibility for stealing 920GB of sensitive data from Epworth HealthCare, one of Victoria’s largest private hospital groups.

The Incident: The threat actors allege they have exfiltrated patient databases, surgical records, and billing details (including USD and AUD transactions).
The Conflict: In a statement released yesterday, Epworth HealthCare denied any evidence of a direct breach, suggesting the claim may relate to a third-party vendor. This "supply chain uncertainty" is a classic tactic used by ransomware groups to induce panic and force negotiations.
Observation: This incident underscores the critical need for third-party risk management (TPRM). Even if your perimeter is secure, your data remains vulnerable in the hands of vendors.

Infrastructure & IoT: Browser and Edge Exploits

Sectors: All (Corporate IT), IoT Threat Level: High

Microsoft and Ivanti have both been in the spotlight over the last 48 hours with critical updates.

Microsoft Edge (Chromium): On 5 February 2026, Microsoft released an emergency update for Edge to address CVE-2025-13223 and CVE-2025-10585. Both vulnerabilities are confirmed to be exploited in the wild. These memory corruption flaws allow remote attackers to execute arbitrary code via a crafted HTML page.
Ivanti Connect Secure: Organisations are still struggling to patch CVE-2025-0282, a critical stack-based buffer overflow in Ivanti VPN appliances. Exploitation allows unauthenticated remote code execution (RCE). Australian organisations with edge devices must verify their integrity immediately using the external Integrity Checker Tool (ICT).

SaaS & Web Applications: n8n Workflow Automation

Sectors: SaaS, FinTech Threat Level: Critical

A critical vulnerability (CVE-2026-21858) in the popular workflow automation platform n8n is being actively targeted.

The Flaw: This is an unauthenticated RCE vulnerability. Attackers can execute arbitrary code on the underlying server by manipulating form-based workflows.
Relevance: As FinTech and SaaS providers increasingly rely on "no-code/low-code" automation tools like n8n to connect APIs, these platforms become high-value targets for initial access.

Technical Takeaway

The common thread in the last 24 hours is input validation failure—whether it is the prompt injection attacks bypassing AI guardrails in DeepSeek, or the buffer overflows in Edge and Ivanti. Traditional WAFs are struggling to catch semantic attacks against LLMs.

Recommendation: Move beyond signature-based detection. Implement rigorous behavioural analysis for your APIs and AI interfaces to detect anomalous inputs before they process.

Contact us for a quote for penetration testing service or adversary simulation.