As a senior penetration tester actively analysing adversary behaviour and responding to frontline incidents, I am tracking a highly volatile cyber threat landscape across Australia. Over the past 24 hours, the window between vulnerability disclosure and active exploitation has collapsed to mere days—and in some cases, hours. Adversaries are aggressively weaponising artificial intelligence, exploiting cloud misconfigurations, and capitalising on critical zero-day vulnerabilities in web applications and APIs.

Here is your daily threat briefing detailing the active exploits, prominent threat actors, and critical vulnerabilities impacting Australian organisations across key sectors.

Sector Threat Analysis

Healthcare The Australian healthcare sector remains under intense siege from double-extortion ransomware. Threat actors like DragonForce and the INC Ransom group are actively targeting healthcare software vendors and third-party systems to disrupt patient services and extract medical records. Affiliates operating Ransomware-as-a-Service (RaaS) models are using legitimate administrative tools to blend into normal network traffic, bypassing basic defences. The focus has shifted from merely locking databases to exfiltrating highly sensitive patient records via vulnerable web applications and poorly secured APIs.

FinTech & eCommerce Financially motivated cyber attacks are taking longer to detect, and cyber extortion has now officially eclipsed Business Email Compromise (BEC) as the leading threat type in our region. FinTech and eCommerce platforms are seeing adversaries bypass traditional perimeter security by targeting financial APIs and cloud payment gateways. Threat groups are aggressively scraping cloud environments for authentication tokens, meaning organisations must urgently secure their cloud infrastructure to defend against sophisticated extortion and comply with Australian regulatory reporting requirements.

SaaS Providers & Government Supply chain and cloud vulnerabilities have taken centre stage. The Australian Signals Directorate’s ACSC recently issued a "High Alert" regarding the ongoing malicious targeting of online code repositories. Threat actors are turning trusted code repositories into malicious delivery systems to harvest credentials, deploy malware, and execute supply-chain compromises affecting both SaaS providers and federal government departments. We are also continuing to observe the exploitation of unpatched web applications to breach major cloud environments, exposing highly sensitive data.

Education / EdTech Higher education institutions and EdTech platforms remain highly exposed due to their expansive attack surfaces. Threat actors are actively leveraging critical pre-authentication Remote Code Execution (RCE) vulnerabilities in remote support software to hijack university networks. Attackers are exploiting weak access controls in student portals and third-party SaaS integrations, capitalising on the high volume of users to hide lateral movement.

IoT (Internet of Things) With the new Cyber Security (Security Standards for Smart Devices) Rules officially coming into effect last month (March 2026), the baseline for IoT security has shifted, making generic default passwords illegal. However, legacy devices remain a critical vulnerability. Sophisticated threat actors are exploiting flaws in distributed IoT networks and edge-facing infrastructure to gain administrative privileges and establish persistent access, which serves as a launchpad to attack converged IT and OT environments.

Technology Highlights: Web Apps, APIs, Cloud, and AI Systems

AI Systems: The attack surface has expanded rapidly into Artificial Intelligence. Just yesterday (9 April), the ACSC urged organisations to adapt as advanced AI models are drastically speeding up the discovery of software vulnerabilities, significantly lowering the barrier to entry for cybercriminals. Furthermore, we are seeing the real-world impact of AI-specific vulnerabilities, such as flaws in AI-integrated browser extensions that allow attackers to tap into the browser environment and access local operating system files. Additionally, "data spills" caused by employees uploading sensitive commercial data into public-facing generative AI tools are creating a severe internal risk that requires immediate governance.
Web Applications & Cloud APIs: Attackers are moving away from traditional malware deployments, favouring identity-based attacks on APIs and cloud infrastructure. Misconfigured cloud buckets, over-privileged API keys, and unpatched web applications remain the most consistent initial access vectors I exploit during adversary simulations.

Conclusion

The speed at which threat actors are weaponising newly disclosed vulnerabilities demands a proactive and offensive security posture. Australian organisations can no longer rely on reactive monitoring. Regular testing of web applications, cloud configurations, and API endpoints is critical to identifying gaps before they are exploited.

Contact us for a quote for penetration testing service or adversary simulation.