Daily Threat Briefing: NSW Gov Strategy Launch, Vic Schools Breached & Critical AI Flawsc

Welcome to today's threat briefing. As we approach the end of January, the Australian cyber landscape is seeing significant shifts in government policy and active exploitation of education and financial sectors. Below is a deep dive into the critical threats, incidents, and vulnerabilities observed over the last 24 hours.

Top Story: NSW Government Launches 2026–2028 Cyber Strategy

Just announced today, the New South Wales Government has officially launched its Cyber Security Strategy 2026–2028. This new framework marks a pivotal shift in how the state manages digital risks, introducing a mandatory 24-hour reporting window for cyber incidents—a significantly tighter timeframe designed to improve visibility and rapid response.

Key Takeaways for Gov & Enterprise:

• Supply Chain Focus: The strategy explicitly targets third-party supply chain risks, a vector that has plagued Australian organisations over the last year.
• Critical Infrastructure (CI): Enhanced obligations for CI operators to ensure resilience against nation-state actors.
• Strategic Shift: Moving from a compliance-heavy model to a "resilience-first" approach, integrating identity support and faster intelligence sharing.

Sector Intelligence

1. Education & EdTech: Victorian Department of Education Breach

The Victorian Department of Education has confirmed a major data breach impacting over 1,700 government schools.

• The Incident: An unauthorised third party accessed a database containing student names, school details, and email addresses with encrypted passwords.
• Impact: While the department states no "sensitive" family details were accessed, the exposure of student identities creates a long-term risk of targeted phishing and identity fraud.
• SaaS Risk: This incident highlights the fragility of centralised databases in the EdTech sector. Administrators should enforce immediate password rotations and review third-party access logs.

2. FinTech & Insurance: Prosura Data Leak

In a severe blow to the financial services sector, Australian car rental insurer Prosura has suffered a breach exposing approximately 300,000 customers.

• Status: Threat actors have released 98 million lines of data on dark web forums.
• Data Exposed: Customer names, policy details, and travel destinations.
• Advisory: Financial institutions should be on high alert for social engineering attacks leveraging this fresh dataset to bypass identity verification checks.

3. Healthcare: Ransomware Success Rate at 95%

Recent reports from the Australian Signals Directorate (ASD) indicate a worrying trend for 2026: ransomware attacks on healthcare providers have doubled, with a 95% success rate for attackers once they gain initial access.

• Threat Actor: The BianLian group remains highly active, targeting Australian critical infrastructure and healthcare with exfiltration-based extortion (threatening data release rather than just encryption).

Vulnerability Watch: Web, Cloud & AI

The last 24 hours have highlighted critical vulnerabilities that penetration testers and SysAdmins must address immediately.

Web Application & APIs

• React Server Components (CVE-2026-23864): A High-Severity Denial of Service (DoS) vulnerability was disclosed on 26 January. This follows the critical RCE (CVE-2025-55182) from late last year.

  • Risk: Attackers can crash server-side rendering processes, taking down high-traffic React applications.
  • Action: Upgrade react-server-dom-webpack and related packages immediately.

• n8n Workflow Automation (CVE-2026-21858): A Critical Unauthenticated RCE exists in the popular workflow automation tool n8n.

  • Risk: This is a "game over" bug for SaaS providers using n8n for backend orchestration. It allows full server takeover without credentials.
  • Action: Patch or isolate instances behind a VPN immediately.

Cloud & AI Systems

• AI Cloud Misconfigurations: New research released yesterday details how "Agentic AI" deployments are introducing massive cloud risks. Specific incidents involving VyroAI and Chattee showed that misconfigured Cloud (Elasticsearch/Kafka) instances linked to AI models exposed millions of chat logs.
  • Attack Vector: Attackers are not attacking the AI model itself, but the infrastructure (Vector DBs, RAG pipelines) surrounding it.
  • Advisory: Ensure all AI-related data stores are not public-facing and enforce strict IAM roles.

Threat Actor Profile: The Rise of "Agentic AI" Attacks

We are observing a shift in 2026 where threat actors are utilising AI Agents to automate the exploitation of APIs. These autonomous agents can chain vulnerabilities (e.g., finding an exposed API endpoint, testing for BOLA/IDOR, and exfiltrating data) at a speed human teams cannot match.

Defensive Strategy: Traditional rate limiting is no longer sufficient. Organisations must implement behavioural analysis on API gateways to detect non-human traffic patterns that mimic legitimate user flows.

---

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Australia – 28 January 2026

Executive Summary

The Australian cyber threat landscape over the last 24 hours has been dominated by a significant data breach within the Victorian education sector and the emergency disclosure of critical vulnerabilities affecting widespread enterprise tools. Threat actors are actively exploiting zero-day vulnerabilities in Microsoft Office and Zoom, while a new supply chain attack targeting developers using AI tools has been uncovered. Australian organisations, particularly in Government, Education, and FinTech, must prioritise patching and threat hunting immediately.

Local Impact: Victorian Education Sector Breach

Victorian Department of Education Hit by Major Data Breach A significant incident has been confirmed involving the Victorian Department of Education, impacting approximately 1,700 government schools. Unauthorised third-party access has compromised the personal information of current and former students.

• Impact: Loss of PII (Personally Identifiable Information) creating heightened risk of identity theft and targeted phishing scams against students and families.
• Action: Educational institutions should be on high alert for follow-on social engineering attacks. Parents and staff should be warned to scrutinise unsolicited communications purportedly from the Department or schools.

Critical Vulnerabilities & Global Threats

1. Microsoft Office Zero-Day (CVE-2026-21509)

• Severity: Critical
• Status: Active Exploitation / Emergency Patch Issued (27 Jan 2026)
• Details: A remote code execution (RCE) vulnerability in Microsoft Office is being actively exploited in the wild. The flaw allows attackers to execute arbitrary code via specially crafted documents, often delivered via phishing emails.
• Recommendation: Apply the emergency patch immediately. Ensure EDR solutions are tuned to detect abnormal Office process behaviour.

2. Zoom Node Multimedia Routers RCE (CVE-2026-22844)

• Severity: Critical
• Details: A command injection flaw in Zoom Node Multimedia Routers (used in Meeting Connector and Hybrid deployments) allows for remote code execution.
• Relevance: High for organisations hosting on-premise or hybrid Zoom infrastructure.
• Recommendation: Update to version 5.2.1716.0 or later immediately.

3. Fortinet SSO Authentication Bypass (CVE-2025-59718/59719 Variant)

• Status: Active Exploitation of Patched Devices
• Details: Threat intelligence indicates active exploitation of a FortiCloud SSO authentication bypass, even on devices believed to be fully patched. Attackers are using crafted SAML messages to create persistent accounts and enable VPN access.
• Recommendation: Review audit logs for suspicious SAML assertions and anomalous VPN logins. Consider temporarily disabling SSO if suspicious activity is detected until further vendor guidance is clarified.

Emerging Trends: AI & Supply Chain Attacks

Malicious VS Code AI Extensions Cybersecurity researchers have identified two malicious Visual Studio Code extensions masquerading as AI coding assistants: "ChatGPT - 中文版" and "ChatGPT - ChatMoss".

• Threat: These extensions, with over 1.5 million combined installs, contain backdoor functionality that siphons source code and developer environment data to servers located in China.
• Sector Risk: High for SaaS Providers, FinTech, and DevOps teams where proprietary code is the crown jewel.
• Action: Audit developer environments for these extensions immediately and block their IDs (whensunset.chatgpt-china, zhukunpeng.chat-moss).

Sector-Specific Intelligence

• Healthcare: The Australian Signals Directorate (ASD) continues to report a surge in ransomware targeting healthcare providers, with incidents doubling compared to the previous period. Threat actors are leveraging the chaos of recent breaches to launch extortion campaigns.
• Government: The NSW Government is rolling out a new framework to make AI risk assessments less subjective. Agencies deploying AI tools must now undergo rigorous testing for bias and security vulnerabilities before deployment.
• IoT: With the exploitation of edge devices like Fortigate and Zoom routers, organisations must treat IoT and edge appliances as high-risk entry points. Ensure strict network segmentation is in place to prevent lateral movement.

Analyst’s Take

The breach in Victoria serves as a stark reminder that the education sector remains a soft target with high-value data. However, the technical sophistication seen in the Fortinet bypass and the malicious VS Code extensions indicates that threat actors are moving deeper into the supply chain and infrastructure layer. Defensive teams must look beyond the perimeter and scrutinise the tools their developers and remote workforce rely on daily.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Australia – 27 January 2026

The Australian cyber threat landscape has intensified significantly over the last 24 hours, with critical developments impacting the healthcare, retail, and SaaS sectors. Today’s briefing highlights a new zero-day exploit in Microsoft Office, a confirmed breach at a major fertility provider, and the emergence of "World Leaks" targeting global brands with Australian operations.

Top Priority: Critical Vulnerability Alerts

Microsoft Office Zero-Day (CVE-2026-21509) In the last 24 hours, Microsoft has issued emergency guidance for a high-severity zero-day vulnerability (CVE-2026-21509) currently being exploited in the wild. This flaw allows attackers to bypass security features locally by leveraging untrusted inputs in Office files.

• Impact: User interaction is required (opening a malicious file), but successful exploitation can lead to code execution.
• Action: Organisations must apply the out-of-band patch immediately, particularly for Office 2021 and Microsoft 365. Temporary registry mitigations are available for older versions.

ServiceNow AI "BodySnatcher" Vulnerability A severe privilege escalation flaw has been discovered in ServiceNow’s Now Assist AI agents. Dubbed "BodySnatcher", this vulnerability allows unauthenticated attackers to hijack AI workflows and create administrative backdoors. As Australian enterprises race to adopt AI-driven SaaS tools, this serves as a stark warning to audit AI permissions rigorously.

Sector Intelligence & Incidents

Healthcare: Genea Data Breach Confirmed

Australia’s healthcare sector continues to be a primary target. Genea, a leading fertility and IVF provider, has confirmed a cyber attack resulting in the exfiltration of sensitive patient data.

• Status: Stolen records have reportedly appeared on the dark web.
• Analysis: This incident follows a disturbing trend of extortion-based attacks on specialist medical clinics in Australia (e.g., the Point Lonsdale and O&G incidents late last year). The sensitivity of the data makes extortion attempts highly likely.

Retail & eCommerce: Nike Investigating "World Leaks" Claims

Global sportswear giant Nike is investigating claims by the "World Leaks" ransomware gang, who allege they have stolen 1.4TB of internal data. While the full impact on Australian customers is being assessed, this group is known for shifting from encryption to pure data-theft extortion.

• Risk: Potential exposure of customer PII and partner supply chain data.

Education: Fallout from Victorian Schools Attack

The education sector remains on high alert following the Victorian Department of Education breach earlier this month, which impacted over 1,700 government schools.

• Update: Forensic analysis suggests the initial vector involved compromised staff credentials. Educational institutions are urged to accelerate the rollout of phishing-resistant Multi-Factor Authentication (MFA) to prevent lateral movement.

FinTech: Regulatory Heat & Data Leaks

• Airwallex Audit: The Australian Transaction Reports and Analysis Centre (AUSTRAC) has ordered an external audit of FinTech unicorn Airwallex over suspected AML/CTF compliance failures. This signals a tougher regulatory stance on the FinTech sector’s risk management practices.
• Prosura Breach: Fallout continues from the Prosura (car rental insurance) breach, where 300,000 customer records were exposed. Attackers are actively selling this data, increasing the risk of targeted phishing campaigns against policyholders.

IoT & Edge Security

• WatchGuard Firebox Exploitation: Active exploitation of a critical vulnerability (CVE-2025-14733) in WatchGuard Firebox devices continues. Attackers are using this to gain initial access to small-to-medium business networks.
• Konni Threat Actor: New intelligence indicates the North Korean-linked threat actor Konni is targeting blockchain developers in Australia. The group is using malicious project documentation and AI-generated PowerShell backdoors to compromise development environments.

Summary & Recommendations

The last 24 hours have demonstrated that no sector is immune. From AI-driven SaaS vulnerabilities to zero-day exploits in ubiquitous office software, the attack surface is expanding.

Immediate Actions:

1. Patch Microsoft Office across all endpoints immediately.
2. Audit AI Integrations (specifically ServiceNow) for privilege escalation risks.
3. Monitor Vendor Risk, particularly if your organisation interacts with Genea or Nike.
4. Reinforce DevSecOps, especially for blockchain and FinTech teams targeted by state-sponsored actors like Konni.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Australia Day Cyber Risks, Active RCEs & EdTech Fallout

Executive Summary As the nation observes Australia Day, the cyber threat landscape over the last 24 hours has been anything but quiet. While many organisations are operating with skeleton staff due to the public holiday, threat actors are actively leveraging this window to exploit critical vulnerabilities in widely used infrastructure. Our analysts have observed a convergence of physical and digital threats, with heightened hacktivist chatter targeting government entities and continued fallout from the massive Victorian education sector breach.

For today’s briefing, we are issuing urgent alerts for Healthcare, Education, and Government sectors, alongside critical patch warnings for Cisco and Windows environments.

---

Sector-Specific Threat Intelligence

🏛️ Government & Critical Infrastructure

• Australia Day Hacktivism: We have detected increased chatter on dark web forums and Telegram channels encouraging DDoS and defacement campaigns against Australian government portals today. This aligns with historical trends of national holiday targeting.
• The "Salt Typhoon" Threat: Assessing the last 24 hours of telemetry, the China-backed APT group identified as Salt Typhoon is aggressively targeting authentication weaknesses in Ivanti Connect Secure gateways. They are leveraging the recently disclosed authentication bypass vulnerabilities (CVE-2025-0282) to gain initial access. Security teams should be on high alert for anomalous login activity, particularly from non-Australian IP addresses.

🎓 Education & EdTech

• Victorian Schools Breach Fallout: The ripple effects of the Victorian Department of Education data breach (confirmed mid-January) continue to widen. Over the weekend, fresh datasets appearing to contain student contact details and parent email addresses have surfaced on breach forums.
• SaaS Supply Chain Risk: EdTech platforms utilising the n8n workflow automation tool must urgently verify they have patched CVE-2026-21858. We have observed automated scanning for unpatched instances of this tool, which allow for Remote Code Execution (RCE).

🏥 Healthcare & IoT

• "MongoBleed" Resurgence (CVE-2025-14847): A new wave of attacks targeting unpatched MongoDB instances has been identified, specifically aiming at eHealth applications and IoT medical device gateways. Attackers are exfiltrating unstructured patient data.
• IoT Device Gateways: With the holiday reducing on-site staff, IoT monitoring systems in hospitals are prime targets. Ensure segmentation is strictly enforced to prevent lateral movement from compromised smart devices to patient record systems.

💳 FinTech & eCommerce

• Session Hijacking Campaigns: Retailers running extended Australia Day sales are being targeted by sophisticated phishing campaigns weaponising a new Microsoft Word RCE (CVE-2026-20944). These emails often masquerade as "Urgent Invoice" or "Order Query" attachments.
• Cisco UC Exploitation: FinTech firms relying on Cisco Unified Communications (UC) for internal comms need to patch CVE-2026-20045 immediately. This RCE flaw (CVSS 8.2) is being exploited in the wild to gain root privileges on unpatched systems.

---

Vulnerability Watch: The "Must-Patch" List

Security teams should prioritise the following vulnerabilities, which have seen active exploitation in the Australian region within the last 24 hours:

1. Cisco Unified Communications (CVE-2026-20045):

   • Type: Remote Code Execution (RCE).
   • Status: Active exploitation. Added to CISA KEV.
   • Action: Patch immediately. No workarounds available.

2. Microsoft Windows "DWM" (CVE-2026-20805):

   • Type: Privilege Escalation (to SYSTEM).
   • Target: Corporate workstations and government endpoints.
   • Status: Exploited in the wild as a post-compromise escalation tool.

3. Ivanti Connect Secure (CVE-2025-0282):

   • Type: Authentication Bypass / RCE.
   • Target: VPN Gateways.
   • Status: Critical. Being weaponised by ransomware groups like Qilin.

---

Analyst Comment

The convergence of a public holiday with critical RCE vulnerabilities creates a "perfect storm" for defenders. The reduced staffing levels today mean detection times may be slower, giving adversaries a larger window to establish persistence. We strongly recommend that SOC teams maintain heightened vigilance and that on-call engineers are prepared to mobilise for out-of-band patching of the Cisco and Windows flaws.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Airwallex Under Scrutiny, Copilot AI Vulnerability & Critical SaaS RCEs

The Australian cyber threat landscape has seen significant activity over the last 24 hours, with major developments across the FinTech and SaaS sectors. From regulatory crackdowns on financial platforms to novel attacks targeting AI systems, organisations must remain vigilant. Below is a deep dive into the most critical threats, exploited vulnerabilities, and industry updates relevant to Australian businesses today.

FinTech: Airwallex Audited by AUSTRAC

In a major development for the FinTech sector, the Australian Transaction Reports and Analysis Centre (AUSTRAC) has ordered an external audit of payment platform Airwallex. Announced yesterday (23 January), the regulator suspects compliance failures regarding Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) laws.

• The Risk: AUSTRAC is concerned that Airwallex’s transaction monitoring program has not adequately kept pace with the risks associated with its cross-border fund transfers.
• Impact: This highlights the increasing regulatory pressure on Australian FinTechs to robustly define their customer base and report suspicious matters. Financial institutions should review their own AML/CTF controls immediately to avoid similar scrutiny.

AI & SaaS Systems: The 'Reprompt' Attack on Copilot

As AI integration deepens, so do the attack vectors. Security researchers have unveiled a new "Reprompt" attack targeting Microsoft Copilot.

• The Exploit: This sophisticated technique allows attackers to silently siphon data from Copilot sessions. By crafting specific prompts that the AI interprets as system instructions, malicious actors can trick the model into retrieving and exfiltrating sensitive internal data without the user's knowledge.
• AdMob Settlement: In broader SaaS news, Google has agreed to pay USD $8.25 million (approx. AUD $13 million) to settle allegations that its AdMob platform illegally tracked children’s data, violating privacy norms—a critical reminder for EdTech and SaaS providers handling minor's data.

Critical Vulnerabilities: Web Apps & IoT

The last 24 hours have underscored the criticality of patching, with active exploitation observed in workflow automation and network devices.

• n8n Workflow Automation (CVE-2026-21858): A critical Unauthenticated Remote Code Execution (RCE) vulnerability has been identified in the n8n platform.

  • Severity: Critical (CVSS 10.0).
  • Attack Vector: Attackers can execute arbitrary code on the underlying server via form-based workflows without needing valid credentials.
  • Action: SaaS providers and businesses using n8n for automation must apply the latest patches immediately or restrict public access to these instances.

• WatchGuard Firebox (CVE-2025-14733): The Australian Signals Directorate’s ACSC continues to warn of active exploitation of this critical vulnerability. It affects small to medium businesses and government networks relying on WatchGuard devices for perimeter security.

Healthcare & Education: Sector-Specific Threats

• Healthcare: The sector remains under fire, with Diabetes WA identified as the latest victim in a string of attacks against Australian health organisations. This follows the trend of ransomware groups targeting patient data for extortion.
• Education: Reports are emerging regarding the fallout of a cyber attack on Victorian schools, with concerns raised about the exposure of student data and the resilience of EdTech platforms used in the state's curriculum.

Strategic Advice

The emergence of AI-specific attacks like the Copilot 'Reprompt' and the severity of the n8n RCE demonstrates that threat actors are rapidly pivoting to exploit the tools that drive modern business efficiency. Australian organisations must move beyond basic compliance and stress-test their controls against these advanced techniques.

Contact us for a quote for penetration testing service or adversary simulation.