Daily Threat Briefing: Australia – 29 December 2025

Executive Summary

The last 24 hours have seen a surge in targeted activity against the Australian Education and IoT sectors, with critical infrastructure devices remaining a primary entry point for threat actors. The Australian Cyber Security Centre (ACSC) has flagged active exploitation of new vulnerabilities in network edge devices, while the 'KillSec' and 'Medusa' ransomware gangs have claimed significant breaches in local organisations.

Today's briefing highlights critical flaws in AI development frameworks and widespread attacks on educational institutions, underscoring the need for urgent patching and heightened vigilance across all sectors.

Top Critical Vulnerabilities

• WatchGuard Firebox (CVE-2025-14733): The ACSC has issued a critical alert regarding this vulnerability, which is currently being actively exploited in the wild. Attackers are using this flaw to gain unauthorised access to corporate networks. Immediate patching is non-negotiable.
• React Server Components (CVE-2025-55182): A critical severity vulnerability has been discovered in React Server Components, a popular web development framework. This flaw could allow remote code execution (RCE) on servers hosting modern web applications.
• LangChain Prompt Injection (AI Security): A core vulnerability has been identified in LangChain, a widely used framework for building AI applications. This flaw allows for prompt injection attacks that can lead to data exposure, posing a significant risk to SaaS providers integrating LLMs.
• Fortinet FortiCloud SSO (CVE-2025-59718 & CVE-2025-59719): Critical authentication bypass vulnerabilities continue to be targeted. These allow attackers to bypass login protections on the FortiCloud Single Sign-On service.

Sector-Specific Threat Intelligence

Education & EdTech The education sector is currently under siege. Waverley Christian College has confirmed a cyber incident after the Fog ransomware group claimed to have exfiltrated 5GB of data. Simultaneously, the KillSec ransomware gang has claimed a breach of the Australian educational support platform "Thanks For the Help" (TFTH). These incidents highlight the vulnerability of student data and the aggressive targeting of schools and their third-party providers.

Government Following the recent ransomware incident affecting Muswellbrook Shire Council, the SafePay ransomware gang has reportedly published 175GB of stolen data, intensifying the pressure on local government bodies to review their data resiliency and backup strategies. Additionally, the ACSC is monitoring a rise in "impersonation scams" where cybercriminals pose as Australian Federal Police to target cryptocurrency wallets.

Healthcare Harbour Town Doctors has reportedly suffered a patient data breach. With the healthcare sector accounting for a significant portion of all Australian breaches this year, this incident serves as a stark reminder of the value of medical records on the dark web. Medical practices are urged to audit their access logs and secure third-party remote access points immediately.

SaaS & IoT Netstar Australia, a technology and GPS firm, has suffered an alleged cyber attack, potentially impacting fleet management and IoT tracking services. This supply chain risk reinforces the importance of securing IoT endpoints. Meanwhile, the discovery of the LangChain vulnerability puts SaaS providers utilising AI features on high alert; developers must validate inputs rigorously to prevent prompt injection.

FinTech Austin’s Financial Solutions is dealing with the fallout of a claimed breach by the Kairos ransomware group, involving sensitive financial data and employee records. The Commonwealth Bank (CommBank) has also faced regulatory scrutiny, being fined over breaches of Consumer Data Right rules, emphasising the dual pressure of security threats and compliance mandates in the FinTech space.

Adversary Watch

• KillSec: Aggressively targeting Australian EdTech and service providers.
• Medusa: Claimed responsibility for a massive data theft (over 800GB) from Ainsworth Game Technology, showing a pivot towards high-revenue commercial targets.
• Pro-Russia Hacktivists: Continue to conduct opportunistic DDoS and defamation attacks against critical infrastructure, as noted in recent joint advisories.

Recommendation Organisations across Australia must prioritise patching WatchGuard and Fortinet devices immediately. Education and Healthcare providers should review their third-party risk management frameworks and ensure offline backups are immutable.

Contact us for a quote for penetration testing service or adversary simulation.

Weekly Threat Briefing: Australia (21 December – 28 December 2025)

Executive Summary

As we close out 2025, the Australian cyber threat landscape remains volatile. This week (21–28 December 2025) has been defined by a significant ransomware attack on critical telematics infrastructure, continued fallout from defence supply chain compromises, and a "Perfect 10" severity vulnerability in a widely used web framework.

Threat actors are aggressively targeting the convergence of IoT and critical infrastructure, while the Education and FinTech sectors face renewed pressure from data extortion groups. Below is your detailed briefing on the threats impacting Australian organisations this week.

Sector Intelligence

Government & Critical Infrastructure: The Netstar Incident

The most significant incident this week involves Netstar Australia, a Melbourne-based GPS and telematics provider heavily used by government and critical infrastructure operators. On 22 December 2025, the Black Shrantac ransomware group listed Netstar on its dark web leak site, claiming to have exfiltrated 800GB of data.

• Impact: Netstar provides fleet tracking for essential services. The compromise of real-time location data and customer databases poses a severe physical security risk.
• Threat Actor: Black Shrantac is a relatively new group (first detected September 2025). This is their first major Australian victim, signalling a shift towards targeting operational technology (OT) and IoT intermediaries.
• Defence Fallout: The sector is also managing the ongoing impact of the IKAD Engineering breach (reported earlier in December), where the J Group gang stole sensitive data related to the Hunter Class frigate program. These incidents highlight a critical weakness in the Australian defence and government supply chain.

Education: University of Sydney Breach

The University of Sydney is managing a serious data breach notified to staff and students on 18 December 2025, with containment efforts continuing this week.

• Vector: Unauthorised access to an online IT code library.
• Data Exposed: Historical data belonging to 13,000 staff, donors, and alumni.
• Analysis: This incident underscores the risk of "shadow IT" and forgotten repositories. Educational institutions remain high-value targets due to the vast amounts of PII and intellectual property they hold.

Healthcare: Ransomware Persistence

The healthcare sector remains the top target for data breaches in Australia.

• Point Lonsdale Medical Group (PLMG): Recently disclosed a cyber attack compromising patient information.
• Trend: Ransomware groups are moving away from pure encryption to "extortion-only" attacks, threatening to release sensitive medical records if payment is not made. With the Antidot Banker malware also circulating, healthcare apps on employee devices are at increased risk of credential theft.

FinTech & SaaS: Wealth Management Targeted

• Austin’s Financial Solutions: The Kairos ransomware group claimed responsibility for a breach this week, allegedly stealing 147GB of data, including employee passports and payroll records.
• SaaS Risk: FinTech platforms are on high alert due to the React2Shell vulnerability (see below), which allows attackers to execute code on servers running modern web applications.

---

Technical Spotlight: Critical Vulnerabilities

Security teams must prioritise the following exploited vulnerabilities identified this week:

1. React2Shell (CVE-2025-55182)

• Severity: Critical (CVSS 10.0)
• Target: Web Applications & SaaS
• Details: A remote code execution (RCE) vulnerability in React Server Components (versions 19.0 – 19.2.0).
• Risk: This flaw allows unauthenticated attackers to execute arbitrary code by sending a malicious payload to the server. It is being actively exploited by Chinese state-sponsored actors and cybercriminal syndicates to compromise Next.js applications commonly used in FinTech and eCommerce.
• Action: Patch immediately to version 19.2.1 or later.

2. WatchGuard Firebox (CVE-2025-14733)

• Severity: Critical
• Target: Network Edge / IoT
• Alert Date: 22 December 2025 (ASD ACSC Alert)
• Details: Active exploitation of a vulnerability in WatchGuard Firebox devices.
• Action: Apply emergency firmware updates. This is a primary vector for initial access into corporate networks.

3. Fortinet Cloud SSO Bypass (CVE-2025-59718)

• Severity: Critical
• Target: Cloud Management
• Details: An authentication bypass vulnerability in FortiCloud SSO.
• Risk: Allows attackers to gain administrative access to cloud-managed security appliances, effectively turning security tools into backdoors.

4. n8n Workflow Automation (CVE-2025-68613)

• Severity: Critical (CVSS 9.9)
• Target: AI Systems & Automation
• Details: RCE via expression injection in the n8n workflow tool.
• Relevance: As organisations rush to adopt AI automation, tools like n8n are becoming critical single points of failure. An attacker can use this to steal API keys and pivot into connected internal systems.

---

AI Security Watch

The rapid integration of AI into government systems is raising alarms. Reports this week indicate the Department of Home Affairs is deploying AI on sensitive data, coinciding with new warnings about Prompt Injection attacks. The exploitation of the n8n vulnerability (CVE-2025-68613) demonstrates that the infrastructure supporting AI agents is currently a softer target than the models themselves.

Recommendations for the Week Ahead

1. Audit Supply Chain Access: In light of the Netstar and IKAD breaches, review all third-party vendors who have physical or digital access to your infrastructure.
2. Patch React Environments: If your organisation uses Next.js or React Server Components, verify that the patch for CVE-2025-55182 has been applied. This is a "drop everything" patch.
3. Secure Code Repositories: The University of Sydney incident serves as a reminder to scan public and private code repositories for hardcoded credentials and sensitive historical data.

Contact us for a quote for penetration testing service or adversary simulation.

Australian Cyber Threat Briefing: Critical RCEs and Supply Chain Strikes

Executive Summary

The last 24 hours have closed a volatile week for Australian cybersecurity. As we approach the New Year, the threat landscape is dominated by the active exploitation of two critical Remote Code Execution (RCE) vulnerabilities—dubbed "React2Shell" and a severe flaw in WatchGuard Firebox appliances. Simultaneously, targeted ransomware campaigns by emerging groups like Black Shranac and Termite are heavily impacting the Healthcare and FinTech sectors.

This briefing analyses the most pressing threats observed over the weekend, highlighting a surge in supply chain compromises and "shadow data" risks in development environments.

Critical Vulnerability Alerts

1. "React2Shell" (CVE-2025-55182)

• Severity: Critical (CVSS 10.0)
• Target: React Server Components (React 19, Next.js).
• Status: Active Exploitation.
• Analysis: State-sponsored actors, including groups linked to China (Earth Lamia), are exploiting this flaw to achieve unauthenticated RCE. The vulnerability allows attackers to bypass authentication and execute arbitrary code via unsafe deserialisation.
• Impact: Over 500 Australian organisations are estimated to be vulnerable. We are observing attackers deploying XMRig miners and persistent backdoors into cloud environments within hours of scanning.
• Action: Immediate patching of react-server-dom-* packages is mandatory.

2. WatchGuard Firebox RCE (CVE-2025-14733)

• Severity: Critical (CVSS 9.3)
• Target: WatchGuard Firebox appliances (iked process).
• Status: Added to CISA KEV (Known Exploited Vulnerabilities).
• Analysis: Unauthenticated remote attackers can trigger an out-of-bounds write to gain root privileges. This is a primary vector for initial access brokers (IABs) looking to sell entry into corporate networks.
• Action: Upgrade to Fireware OS 2025.1.4 immediately.

---

Sector-Specific Threat Intelligence

Healthcare & Biotechnology

• Incident: Genea (Fertility Provider) has reportedly fallen victim to the Termite ransomware group.
• Impact: The group claims to have exfiltrated 700GB of highly sensitive patient data, including medical histories and diagnostic results.
• Observation: This follows a trend of ransomware groups targeting specialist medical providers where downtime is critical and privacy regulatory pressure is high.
• Emerging Threat: The Space Bears gang has also listed community support organisation Christian Community Aid, signaling a shift towards softer, community-focused targets.

FinTech & Financial Services

• Incident: Austin’s Financial Solutions (Wealth Management).
• Impact: The Kairos ransomware group has claimed responsibility for a breach allegedly exposing 147GB of data, including employee passports and payroll records.
• Web App Security: We are tracking a rise in AI Prompt Injection attacks against customer-facing chatbots in the FinTech sector. Attackers are manipulating Large Language Model (LLM) logic to bypass restrictions and elicit unauthorised account details.
• API Exposure: A critical lapse was identified at Vroom by YouX, where a non-password-protected database exposed thousands of driver's licences—a stark reminder of the risks of API misconfigurations in cloud environments.

Education / EdTech

• Incident: University of Sydney.
• Root Cause: "Shadow Data" in DevOps.
• Analysis: A breach impacting over 13,000 individuals was traced back to an internal code library used for development. This highlights a critical failure in DevSecOps: the use of production data in non-production environments.
• Hacktivism: The RipperSec group has claimed a DDoS and defacement attack on the UNSW Physics Department, continuing their campaign of disruption against Australian educational institutions.

Government & Defence Supply Chain

• Incident: IKAD Engineering (Defence Contractor).
• Impact: A supply chain breach involving the J Group ransomware gang has reportedly exposed data related to the Hunter Class frigate and Collins Class submarine programmes.
• Strategic Insight: This incident underscores that the "soft underbelly" of national defence is often the tiered supply chain. Adversaries are pivoting from hardened government networks to smaller, less secure contractors.

SaaS & Technology Providers

• Incident: NetStar Australia (Fleet Management).
• Threat Actor: Black Shranac (New Group).
• Impact: The attackers claim to hold 800GB of telemetry and client data. As a provider to critical infrastructure, this breach poses significant downstream risks.
• Supply Chain: IT services provider Hexicor was also targeted by KillSec, resulting in the theft of client security data (hashed passwords), necessitating immediate credential rotation for all their downstream clients.

---

Recommendations for the Week Ahead

1. Audit Your External Attack Surface: With the WatchGuard and React vulnerabilities being scanned for automatically, ensure no unpatched appliances or development servers are internet-facing.
2. Review Dev Environments: Ensure your development and UAT environments do not house live production data (PII).
3. Harden AI Interfaces: If you deploy GenAI chatbots, implement strict input validation and "guardrails" to prevent prompt injection.
4. Verify Third-Party Security: If you use MSPs or SaaS providers mentioned in recent breaches (e.g., fleet management, IT support), proactively rotate credentials and review logs for suspicious lateral movement.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Australia – 27 December 2025

Executive Summary

The last 24 hours have highlighted significant volatility in Australia’s cyber threat landscape, with critical infrastructure, healthcare, and education sectors facing intensified pressure. Of particular concern today is the active exploitation of critical vulnerabilities in widely used network security devices and a surge in ransomware activity targeting Australian schools. This briefing breaks down the most urgent threats, exploited vulnerabilities, and strategic risks for Australian organisations observed over the past day.

Top Critical Vulnerabilities (Active Exploitation)

• WatchGuard Firebox (CVE-2025-14733): The Australian Cyber Security Centre (ACSC) has escalated its warning regarding this critical vulnerability. Threat actors are actively exploiting it to gain unauthorised access to corporate networks. If your organisation utilises WatchGuard Firebox devices, immediate patching is mandatory.
• Fortinet FortiCloud (CVE-2025-59718 & CVE-2025-59719): These critical flaws allow for a Single Sign-On (SSO) authentication bypass, potentially granting attackers administrative control over cloud-managed security appliances. Exploits are now being observed in the wild targeting Australian government and enterprise networks.
• React Server Components (CVE-2025-55182): A severe Remote Code Execution (RCE) vulnerability has been discovered in this popular web framework. This poses a massive risk to SaaS providers and modern web applications, particularly those utilizing server-side rendering.

Sector-Specific Threat Intelligence

1. Healthcare & SaaS Providers The healthcare sector remains a primary target. A significant supply chain breach involving Phreesia (via its subsidiary ConnectOnCall) has reportedly impacted over 910,000 individuals. This incident underscores the fragility of the SaaS supply chain; attackers compromised a third-party integration to access sensitive patient data. Additionally, a recent audit of NSW Health revealed that clinicians have been bypassing security controls to expedite workflows, creating internal vulnerabilities that attackers are eager to exploit.

2. Education / EdTech Australian schools are currently in the crosshairs of the Fog ransomware gang. The group has claimed responsibility for an attack on Waverley Christian College, allegedly exfiltrating 5GB of sensitive data. This follows a broader campaign against the education sector, including a breach at the University of Sydney and the "Thanks for the Help" support platform. Educational institutions must urgently review their data egress monitoring and backup immutability.

3. FinTech & Banking The Antidot Banker malware campaign is aggressively targeting Australian financial institutions. The malware is being distributed via fake recruitment emails and SMS lures, tricking users into downloading malicious Android CRM applications. Once installed, it intercepts 2FA codes and harvests banking credentials. FinTech applications should enforce rigorous device integrity checks to detect these compromised environments.

4. Government & Critical Infrastructure A joint advisory has warned of renewed activity by pro-Russia hacktivist groups targeting Australian critical infrastructure. These attacks are largely opportunistic, utilising DDoS vectors and basic exploit scripts to disrupt energy and transport operations. Concurrently, concerns are mounting over the Department of Home Affairs' deployment of AI systems on sensitive data, with experts warning of "prompt injection" attacks that could lead to data leakage.

5. AI Systems & Emerging Tech A new vulnerability has been identified in Vincent AI (vLex), a legal AI assistant used by law firms. The flaw allows for "AI phishing," where attackers use hidden HTML code in documents to steal user credentials. This highlights a growing trend of "adversarial machine learning" where AI models themselves become the attack vector.

Key Recommendations

• Patch Immediately: Prioritise WatchGuard and Fortinet updates.
• Audit Supply Chains: SaaS providers must rigorously assess third-party integrations (like the Phreesia incident).
• Harden Web Apps: Developers using React must review their implementation against CVE-2025-55182 immediately.
• User Awareness: Alert staff to the Antidot Banker recruitment scams and verify the authenticity of job-related communications.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Boxing Day Cyber Spike & Critical Edge Exploits

Executive Summary As Australian organisations operate with skeleton staff over the Boxing Day public holiday, the cyber threat landscape has intensified significantly in the last 24 hours. Threat actors are actively capitalising on reduced monitoring capabilities and the surge in e-commerce traffic. The Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC) has escalated warnings regarding critical exploits in edge devices, while the retail and fintech sectors face a barrage of sophisticated API abuse campaigns.

Critical Alert: WatchGuard Firebox Exploitation (CVE-2025-14733) The most pressing threat identified in the last 24 hours is the active, widespread exploitation of a critical authentication bypass vulnerability in WatchGuard Firebox devices (CVE-2025-14733).

• The Threat: Unauthenticated remote attackers are gaining administrative access to edge firewalls, allowing them to disable security controls and pivot into internal networks.
• Impact: This serves as a primary entry point for ransomware groups targeting the Education and Government sectors, which are currently vulnerable due to holiday shutdowns.
• Action: Immediate patching or isolation of management interfaces is mandatory.

Sector-Specific Threat Intelligence

• eCommerce & FinTech: The Boxing Day Siege With the Boxing Day sales in full swing, our analysis detects a sharp rise in Broken Object Level Authorisation (BOLA) attacks targeting retail APIs. Cybercriminals are manipulating API endpoints to access customer PII and loyalty points. Furthermore, FinTech payment gateways are seeing an uptick in "Deepfake" social engineering, where AI-generated voice vectors are used to authorise fraudulent high-value transactions, bypassing traditional voice biometric security.

• Healthcare: Persistent Targeting by Funksec Following the recent trend of targeting peripheral health organisations, the threat group 'Funksec' has been observed scanning for unpatched web applications in the Healthcare sector over the last 24 hours. Their focus has shifted to third-party API integrations used for patient booking systems, exploiting trusted connections to move laterally into core hospital networks.

• SaaS & Cloud: The React2Shell Fallout Exploitation of the 'React2Shell' vulnerability (CVE-2025-55182) in React Server Components continues to plague SaaS providers. Despite patches being available, threat actors are leveraging automated scanners to identify and compromise updated instances that failed to rotate compromised session keys. We are observing 'extortion-only' attacks where data is exfiltrated from cloud environments without encryption, aimed at forcing rapid payouts.

• Government & Critical Infrastructure State-sponsored actor Salt Typhoon remains active, with new indicators of compromise (IoCs) suggesting a focus on telecommunications infrastructure used by government agencies. This aligns with the recent ACT Audit Office findings on severe access control weaknesses, making identity management a critical vector.

• IoT & Smart Systems A new wave of attacks targeting IoT building management systems (BMS) has been detected, specifically exploiting legacy protocols in smart HVAC systems to gain a foothold in corporate networks. This 'shadow IoT' risk is critical as facilities are largely unmanned during the break.

Emerging Technologies: AI & API Threats

• Agentic AI: We are witnessing the deployment of "Agentic AI" malware that autonomously adapts its behaviour to evade detection. These AI-driven agents are currently being used to speed up privilege escalation in compromised cloud environments.
• API Security: The volume of API traffic during the sales period has masked low-and-slow data scraping attacks. Security teams must analyse traffic for anomalous data egress patterns, not just volumetric spikes.

Recommendations

1. Patch WatchGuard Devices Immediately: Prioritise CVE-2025-14733 remediation.
2. Monitor API Traffic: Implement strict rate limiting and behaviour analysis on checkout and payment APIs.
3. Verify High-Value Transactions: profound scepticism should be applied to urgent payment requests; verify via secondary channels to counter AI deepfakes.
4. Enhance On-Call Readiness: Ensure escalation paths are clear for the remainder of the holiday period.

Contact us for a quote for penetration testing service or adversary simulation.