Weekly Threat Briefing: Australia (14-21 December 2025)

Executive Summary

As we approach the end of 2025, the Australian cyber threat landscape has experienced a volatile week, with significant incidents rocking the education and healthcare sectors. The last seven days have been defined by the active exploitation of critical vulnerabilities in modern web frameworks and a series of ransomware attacks targeting sensitive patient and staff data.

This week’s briefing highlights a major data breach at the University of Sydney, a ransomware attack on fertility provider Genea, and the "React2Shell" vulnerability that is currently reshaping cloud security priorities.

Sector Spotlight

Education: University of Sydney Code Library Breach On 17 December 2025, the University of Sydney notified its community of a significant cyber security incident involving unauthorised access to an online IT code library. While the environment was primarily used for development and code storage, it inadvertently hosted historical data files containing the personal information of approximately 27,000 individuals.

• Impact: The breach affects roughly 10,000 current staff, 12,500 former staff, and 5,000 alumni and students. Exposed data includes names, dates of birth, phone numbers, and addresses.
• Analysis: This incident underscores a critical "DevSecOps" oversight: the use of production (or production-like) data in non-production environments. Attackers are increasingly targeting these "softer" development pipelines to pivot into core systems or exfiltrate overlooked data.

Healthcare: Ransomware Surge and Security Audits The healthcare sector remains the primary target for extortionists this week.

• Genea Ransomware Attack: On 20 December, reports confirmed that Genea, one of Australia’s leading fertility service providers, fell victim to a cyber attack. The Termite ransomware gang has claimed responsibility, alleging the theft of 700GB of sensitive patient data, including medical histories and diagnostic results.
• Harbour Town Doctors: Earlier in the week, the Rhysida ransomware group listed the Queensland-based Harbour Town Doctors on its leak site, threatening to release patient data if ransom demands were not met.
• Systemic Risks: A concerning NSW Health audit released on 19 December revealed a "normalisation of non-compliance" among clinicians. Driven by time pressures, staff were found routinely sharing passwords and using personal devices for patient data, creating a massive, unmanaged attack surface.

SaaS & Cloud: The "React2Shell" Crisis SaaS providers and organisations running modern web applications are currently racing to patch CVE-2025-55182, dubbed "React2Shell".

• The Vulnerability: A critical (CVSS 10.0) unauthenticated Remote Code Execution (RCE) flaw in React Server Components, affecting React 19 and Next.js frameworks.
• Active Exploitation: Intelligence indicates that China-nexus threat groups, including Earth Lamia and Jackpot Panda, are actively exploiting this flaw to deploy cryptocurrency miners (XMRig) and persistent backdoors into cloud environments.
• Why it Matters: This is a supply-chain style risk for any Australian business relying on modern JavaScript frameworks for their customer-facing digital platforms.

Critical Infrastructure & Government The Australian Cyber Security Centre (ACSC) and global partners have issued alerts regarding Fortinet vulnerabilities.

• FortiCloud SSO Bypass (CVE-2025-59718): A critical flaw allowing attackers to bypass authentication on cloud-managed security appliances. With the holiday season approaching, unpatched edge devices are a prime target for initial access brokers.

Key Vulnerabilities Exploited (Week of 14-21 Dec)

• React Server Components (CVE-2025-55182): Critical RCE allowing full server takeover via a single HTTP request.
• Fortinet FortiCloud (CVE-2025-59718): Authentication bypass in Single Sign-On mechanisms.
• Windows Cloud Files Mini Filter (CVE-2025-62221): A privilege escalation flaw patched this week, which attackers are chaining with RCE bugs to gain SYSTEM privileges.

Conclusion

The events of this week demonstrate that "non-production" does not mean "non-critical." The University of Sydney breach highlights the dangers of data sprawl in development environments, while the Genea and React2Shell incidents remind us that both our physical health data and our digital infrastructure are under constant siege. Australian organisations must urgently audit their development pipelines and patch React-based applications immediately.

Contact us for a quote for penetration testing service or adversary simulation.

Weekly Threat Briefing: Critical Fortinet Flaws, AI Vulnerabilities & Nation-State Shifts

The Australian cyber security landscape has experienced a turbulent week (7–14 December), dominated by a "Critical" alert from the Australian Cyber Security Centre (ACSC) regarding widespread vulnerabilities in edge devices and a worrying escalation in AI-assisted development flaws. As we approach the holiday shutdown period—a traditional window for heightened ransomware activity—organisations across Healthcare, Government, and FinTech must urgently prioritise patching and detection.

Here is your deep dive into the threats impacting Australian organisations this week.

Top Priority: The Fortinet Authentication Bypass (CVE-2025-59718)

Sectors Impacted: Government, Education, Healthcare, Enterprise

The most significant development this week is the disclosure of CVE-2025-59718, a critical authentication bypass vulnerability affecting FortiOS, FortiProxy, and FortiSwitchManager.

• The Threat: The vulnerability allows an unauthenticated, remote attacker to bypass FortiCloud Single Sign-On (SSO) mechanisms by forging SAML responses.
• Why it matters: Fortinet devices are ubiquitous in Australian Healthcare and University networks. Successful exploitation grants administrative access, allowing attackers to disable defences, intercept encrypted traffic, or deploy ransomware.
• Status: The ACSC and industry partners have observed active scanning for this vulnerability.
• Action: Patch immediately. If patching is not possible, disable FortiCloud admin login features.

Emerging Threat: AI Systems & SaaS Supply Chain

Sectors Impacted: SaaS Providers, FinTech, EdTech

For the first time in a major weekly briefing, a vulnerability in an AI-assisted development tool has taken centre stage.

• GitHub Copilot RCE (CVE-2025-64671): A Remote Code Execution flaw was discovered in the GitHub Copilot extension for VS Code. Threat actors can exploit this by hosting a malicious repository; when a developer opens it, the AI model's context processing triggers code execution on the developer's machine.
• Impact on SaaS: This represents a massive supply chain risk for SaaS providers and FinTech firms where developers have high-level access to production environments.
• React Server Components (CVE-2025-55182): A critical flaw in the React framework (widely used in eCommerce and EdTech platforms) allows for potential server-side request forgery (SSRF). Attackers can manipulate component rendering to access internal metadata services, a technique often used to steal cloud credentials.

Sector-Specific Threat Intelligence

Government & Critical Infrastructure

On 10 December, the ACSC released a joint advisory regarding Pro-Russia hacktivist groups targeting critical infrastructure. Unlike sophisticated state actors, these groups (such as NoName057) are focusing on "opportunistic" DDoS attacks and website defacements to disrupt public services and erode trust. While the technical sophistication is low, the operational disruption to public-facing government portals has been significant.

Healthcare

With the Fortinet vulnerability actively targeted, hospitals are at high risk. Medical IoT devices often reside on network segments protected by these very firewalls. A breach at the perimeter could expose patient data and connected life-support systems to ransomware gangs like LockBit or BianLian, who have recently ramped up activity in the APAC region.

eCommerce & Retail

As the holiday shopping season peaks, the React (CVE-2025-55182) vulnerability poses a severe threat to online retailers. Attackers are actively scanning for unpatched React server implementations to inject credit card skimmers or steal customer databases.

Summary of Actions

1. Patch Fortinet Appliances: Prioritise CVE-2025-59718 immediately.
2. Review AI Tooling: SaaS and FinTech CISOs should audit the use of AI coding assistants and ensure developers are running the latest extension versions.
3. Harden Web Apps: Update React frameworks to the latest patched version to prevent SSRF attacks.
4. Prepare for Holidays: Ensure 24/7 monitoring is in place for the upcoming break, as hacktivist activity is expected to spike.

Contact us for a quote for penetration testing service or adversary simulation.

Australia Cyber Threat Briefing: React2Shell Crisis & Defence Supply Chain Breach (01–07 Dec 2025)

Executive Summary This week has seen a critical escalation in the Australian cyber threat landscape, dominated by a maximum-severity vulnerability in a widely used web framework and significant breaches in the Defence and Education sectors. The Australian Cyber Security Centre (ACSC) has issued urgent alerts, and organisations across all sectors—particularly those using React-based web applications—must take immediate action.

Here is your deep dive into the threats, incidents, and vulnerabilities shaping the last 7 days (01–07 December 2025).

Vulnerability Spotlight: "React2Shell" (CVE-2025-55182)

Severity: Critical (CVSS 10.0) Affected Sectors: All (SaaS, eCommerce, FinTech, Healthcare)

The most pressing threat this week is CVE-2025-55182, dubbed "React2Shell". This is a critical Remote Code Execution (RCE) vulnerability affecting React Server Components (versions 19.0.0 to 19.2.0).

• The Threat: Unauthenticated attackers can send specially crafted HTTP requests to vulnerable servers to execute arbitrary code.
• Active Exploitation: The ACSC and AWS security teams have confirmed that China-nexus threat actors (tracked as Earth Lamia and Jackpot Panda) are actively exploiting this flaw to compromise web servers.
• Action: Patch immediately to React version 19.0.1+ or apply WAF mitigations. If you use Next.js or similar frameworks, ensure you are on the latest secure release.

---

Sector-Specific Threat Intelligence

Government & Defence

• Target: IKAD Engineering
• Incident: A major supply chain breach has hit IKAD Engineering, a key contractor for Australia’s defence sector. The J Group (linked to RansomHub) has claimed responsibility, allegedly exfiltrating 800GB of sensitive data.
• Impact: The stolen data reportedly includes schematics and documents related to the Hunter Class frigate and Collins Class submarine programs. This highlights the critical risk posed by third-party suppliers in the defence industrial base.

Education / EdTech

• Target: Western Sydney University (WSU)
• Incident: In a significant development regarding insider threats, NSW Police charged a 27-year-old former student on 05 December 2025. Despite being on bail for previous offences, the individual allegedly continued to hack university systems, modifying a mobile phone to act as a terminal and sending over 100,000 fraudulent emails to students.
• Takeaway: This case underscores the persistence of insider threats and the necessity for robust identity management and behavioural monitoring within educational networks.

FinTech

• Target: Austin’s Financial Solutions
• Incident: The Kairos ransomware gang has listed the NSW-based wealth management firm as a victim. The group claims to have stolen 147GB of data, including employee passports, payroll records, and client contracts.
• Target: Vroom by YouX
• Incident: A cloud security lapse left a database non-password protected, exposing thousands of driver's licences and personal financial documents. This serves as a stark reminder to audit API endpoints and cloud storage permissions.

eCommerce

• Regional Warning: While primarily affecting South Korea, the massive Coupang breach confirmed on 02 December (33.7 million customers) is sending shockwaves through the region. The breach was traced to a former employee's active credentials, reinforcing the need for strict offboarding processes and "least privilege" access controls in Australian eCommerce platforms.

IoT & Critical Infrastructure

• Strategic Shift: On 03 December 2025, the ACSC, in collaboration with CISA, released the Principles for the Secure Integration of Artificial Intelligence in Operational Technology (OT).
• Relevance: As Healthcare and Energy sectors increasingly integrate AI into physical control systems (IoT), this guide provides the new baseline for securing these converged environments against manipulation and sabotage.

---

Recommendation for the Week

1. Audit for React: Immediately scan your external attack surface for applications running vulnerable versions of React Server Components.
2. Review Supply Chain Access: In light of the IKAD breach, review the access privileges of third-party vendors and enforce strict MFA.
3. Insider Threat Monitoring: Ensure your offboarding procedures instantly revoke access, especially for high-risk accounts.

Contact us for a quote for penetration testing service or adversary simulation.

Australian Weekly Threat Briefing: Defence Supply Chain Breached & SaaS Under Siege

Executive Summary This week has seen a significant escalation in cyber activity targeting Australian critical infrastructure and supply chains. The most alarming development is a confirmed breach of a major Defence contractor, potentially exposing sensitive naval data. Simultaneously, a sophisticated campaign by the "Scattered Lapsus$ Hunters" group is aggressively targeting SaaS platforms, with Qantas and Zendesk users in the crosshairs.

As we approach the holiday season, a new report warns that ransomware operators are leveraging Generative AI to time attacks for weekends and public holidays, specifically targeting periods of reduced staffing in Security Operations Centres (SOCs).

Sector Updates

Government & Defence

• IKAD Engineering Breach: In a concerning development for national security, Australian engineering firm IKAD Engineering has been listed by threat actors claiming to have stolen a "treasure trove" of sensitive data related to the Hunter and Collins class submarine programs. The attackers allege they maintained access to the network for five months, highlighting a critical dwell-time failure in the defence supply chain.
• ASD Annual Threat Report: The Australian Signals Directorate (ASD) released its Annual Cyber Threat Report for 2024-25, emphasising that state-sponsored actors are relentlessly targeting Australian networks to steal intellectual property and pre-position for disruptive effects.

Aviation & Travel

• Qantas Data Dump: Following a breach detected earlier this year, the "Scattered Lapsus$ Hunters" group has followed through on their extortion threats. After the ransom deadline passed this week, the group leaked the personal records of approximately 5 million Qantas customers on the dark web. The dump includes names, emails, frequent flyer numbers, and phone numbers, though no financial or passport data has been found in the leak so far.

SaaS & Technology

• Zendesk Targeted: The same threat group behind the Qantas extortion, Scattered Lapsus$ Hunters, has launched a new campaign targeting users of the customer support platform Zendesk. Intelligence indicates the group is using typosquatted domains (e.g., znedesk.com) and fake Single Sign-On (SSO) portals to harvest credentials and inject malicious tickets into helpdesk queues, attempting to infect support staff with Remote Access Trojans (RATs).

Healthcare

• Local Medical Breaches: Two incidents highlighted the vulnerability of smaller healthcare providers this week. Point Lonsdale Medical Group in Victoria disclosed a cyber attack exposing personal patient information. Similarly, the Sydney Centre for Ear, Nose & Throat (SCENT) warned patients of a compromised email account, risking the leak of sensitive medical correspondence.
• New Healthcare ISAC: On a positive note, the federal government has awarded a grant to CI-ISAC Australia to establish a dedicated information-sharing centre for the healthcare sector, aiming to improve resilience against these very types of attacks.

Vulnerability Watch

• Microsoft WSUS RCE (CVE-2025-59287): A critical Remote Code Execution vulnerability in Windows Server Update Services (WSUS) is being actively exploited in the wild.
  • Severity: Critical (CVSS 9.8).
  • Risk: Unauthenticated attackers can execute arbitrary code with SYSTEM privileges.
  • Action: Ensure the out-of-band security update from October is applied immediately. If patching is not possible, restrict access to WSUS ports (8530/8531) to trusted management hosts only.

Emerging Tactics

• AI-Driven Timing: SecurityBrief Australia reports that ransomware groups are increasingly using GenAI tools to profile organisational staffing rosters. These tools help attackers launch campaigns precisely when security teams are understaffed, such as weekends and the upcoming holiday break.

Recommendation Organisations should urgently review their third-party risk management frameworks, particularly regarding software supply chains (like Zendesk) and defence contractors. Additionally, ensure all WSUS servers are patched or isolated immediately.

Contact us for a quote for penetration testing service or adversary simulation.