Daily Threat Briefing: Defence Supply Chain Breach, AI RCEs & Critical Telco Fines

As we settle into December, the Australian cyber threat landscape is already heating up. In the last 24 hours, we’ve seen a major breach in the Defence supply chain, significant regulatory action against a local telco for anti-scam failures, and the discovery of a critical vulnerability in a widely used AI inference engine.

For security teams across Healthcare, FinTech, and Government, today’s briefing highlights the critical need for supply chain vigilance and rigorous identity verification.

Top Story: Defence Supply Chain Compromise

Target: IKAD Engineering Sector: Government / Defence Industry Breaking news indicates a significant cyber incident involving IKAD Engineering, a key contractor in the Australian Defence supply chain. Reports suggest that threat actors have breached the organisation's network, exposing potential risks to Australia’s weapons programs and sensitive defence projects.

• Impact: This incident underscores the "soft underbelly" of national security—third-party suppliers. While government agencies harden their own perimeters, adversaries are aggressively targeting smaller contractors with privileged access or sensitive technical data.
• Action: Defence contractors and sub-contractors must immediately review their external attack surface and strictly enforce the Essential Eight maturity levels, particularly regarding remote access and patch management.

Regulatory & FinTech: Southern Phone Fined $2.5m

Sector: Telecommunications / FinTech The Australian Communications and Media Authority (ACMA) has handed down a massive $2.5 million penalty to Southern Phone Company.

• The Issue: An investigation revealed that the telco failed to comply with anti-scam rules on over 160 occasions. Scammers successfully bypassed identity verification processes, allowing them to hijack customer mobile numbers (SIM swapping).
• Why it Matters: For FinTech and banking sectors, this is a critical alert. SIM swapping is a primary vector for defeating SMS-based Two-Factor Authentication (2FA). The failure of a telco to verify identities directly threatens the integrity of financial accounts protected by mobile 2FA.
• Action: FinTechs should accelerate the move away from SMS-based 2FA towards FIDO2 hardware keys or app-based authenticators to mitigate reliance on telco security.

Emerging Tech: Critical AI Remote Code Execution (RCE)

Target: AI Systems / SaaS Providers Vulnerability: vLLM Inference Engine (Versions 0.10.2+) A critical vulnerability has been disclosed in vLLM, a popular high-throughput and memory-efficient LLM serving engine used by many SaaS and AI providers.

• The Threat: Security researchers discovered that attackers can trigger Remote Code Execution (RCE) or crash servers simply by sending malicious prompt embeddings to the Completions API.
• Significance: As Australian organisations rush to deploy private AI models, the security of the underlying inference infrastructure is often overlooked. This flaw allows an attacker to break out of the model sandbox and compromise the host server.
• Action: AI engineering teams must update vLLM immediately and isolate inference servers from critical internal networks.

Infrastructure & Cloud Security

Sector: SaaS / Cloud Two other notable technical threats have emerged in the last 24 hours:

1. HashiCorp Vault Misconfiguration (CVE-2025-13357): A default setting in the Vault Terraform Provider could allow anonymous LDAP binds, potentially exposing secrets and encryption keys. DevOps teams using Terraform to manage Vault must verify their deny_null_bind configurations immediately.
2. GitLab Credential Leaks: New research released yesterday identified over 17,000 exposed credentials (including Google Cloud and OpenAI keys) in public GitLab repositories. Developers are urged to rotate keys and implement automated secret scanning in their CI/CD pipelines.

Sector Watch: Healthcare & IoT

• Healthcare: Following the Point Lonsdale Medical Group incident late last month, the sector remains on high alert. Ransomware groups are actively scanning for unpatched VPN concentrators and RDP endpoints in Australian medical centres.
• IoT: A new Mirai-based botnet, ShadowV2, has been observed exploiting unpatched routers and NAS devices. A critical authentication bypass in ASUS routers (CVE-2025-59366) is currently being weaponised; organisations with remote workforce fleets should ensure home office devices are patched.

Conclusion

Today's events serve as a stark reminder that compliance and configuration management are just as critical as advanced threat detection. Whether it's a misconfigured Terraform provider, a lapse in identity checks at a telco, or an unpatched AI engine, basic hygiene failures continue to offer adversaries the easiest path to compromise.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Australia – 02 December 2025

Executive Summary

The last 24 hours have seen a significant surge in ransomware activity and critical infrastructure targeting across Australia. The Australian Cyber Security Centre (ACSC) and industry watchdogs have issued multiple alerts regarding active exploitation of network edge devices. Prominent threat actors, including KillSec, Space Bears, and RipperSec, have claimed successful breaches against Australian targets in the Government, FinTech, and Education sectors.

Organisations are urged to prioritise patching critical vulnerabilities in Cisco and Microsoft infrastructure immediately, as threat actors are weaponising these flaws for initial access.

---

Sector-Specific Threat Intelligence

Government & Public Sector

• Muswellbrook Shire Council Data Leak: Following a ransomware incident last month, the SafePay ransomware gang has reportedly published 175GB of stolen data. This highlights the persistent risk of "double extortion" where backups alone are insufficient to prevent data exposure.
• Legal Practice Board of Western Australia: Investigations into the May cyber incident continue, with reports indicating the Dire Wolf group may have re-published sensitive datasets on the dark web despite previous takedown efforts.

FinTech & Financial Services

• Austin’s Financial Solutions Breach: The Kairos ransomware group has claimed responsibility for a significant breach of the NSW-based wealth management firm, allegedly exfiltrating 147GB of sensitive financial data, including employee passports and payroll records.
• Vroom by YouX (API/Cloud Exposure): A critical lapse in cloud security was identified involving a non-password-protected database belonging to the FinTech lender. This exposure left thousands of driver’s licences and PII records vulnerable—a stark reminder of the dangers of API misconfigurations and improper access controls in cloud environments.

Education (EdTech)

• University of NSW Targeted: The hacktivist group RipperSec has claimed a distributed denial-of-service (DDoS) and potential defacement attack on the university’s physics department website. Educational institutions remain a prime target for politically motivated disruption.

Healthcare & Community Services

• Christian Community Aid Ransomware: The Space Bears ransomware gang has listed this community support organisation as a victim. With the healthcare sector already under strain, attacks on support services can have devastating downstream effects on vulnerable community members.

SaaS & Technology Providers

• Hexicor Breach: The KillSec ransomware gang has targeted IT services provider Hexicor, stealing client folders and security data (hashed passwords). This supply chain attack poses a risk to Hexicor's downstream clients, emphasising the need for rigorous third-party risk management.

---

Critical Vulnerabilities & Exploits (CVEs)

Penetration testers and defenders must be aware of the following vulnerabilities actively being exploited in the Australian wild:

1. Cisco ASA & FTD (CVE-2025-20333 & CVE-2025-20363):

   • Severity: Critical (CVSS 9.8)
   • Impact: Remote Code Execution (RCE) and unauthorised access.
   • Status: The ACSC warns that threat actors are chaining these vulnerabilities to bypass authentication on VPN web servers. Immediate patching of edge firewalls is mandatory.

2. Microsoft WSUS (CVE-2025-59287):

   • Severity: Critical
   • Impact: A vulnerability in the Windows Server Update Service allows attackers to compromise internal update mechanisms. This is a high-priority patch for enterprise environments.

3. SonicWall SSL VPN (CVE-2024-40766):

   • Status: continued active exploitation by the Akira ransomware group. Despite being an older CVE, unpatched devices remain a primary entry point for ransomware operators in Australia.

---

Strategic Recommendations

• Audit External Attack Surface: Immediately verify that no development databases or APIs are exposed to the public internet without authentication (as seen in the Vroom incident).
• Patch Edge Devices: Prioritise Cisco and SonicWall VPN/Firewall updates.
• Adversary Simulation: With groups like KillSec and Kairos bypassing traditional defences, organisations should conduct red teaming exercises to test their resilience against modern ransomware TTPs (Tactics, Techniques, and Procedures).

Contact us for a quote for penetration testing service or adversary simulation.

Monthly Threat Briefing: Australia – November 2025

As we approach the holiday season, the Australian cyber threat landscape has intensified, with November 2025 marking a significant surge in ransomware activity and sophisticated supply chain attacks. The Australian Signals Directorate (ASD) and private sector intelligence indicate that threat actors are increasingly capitalising on reduced staffing levels during weekends and public holidays, a trend expected to escalate as we head into December.

This month’s briefing analyses critical incidents and emerging vulnerabilities across key sectors, highlighting the urgent need for robust defence mechanisms in web applications, cloud environments, and AI systems.

Sector-Specific Threat Intelligence

Healthcare

The healthcare sector remains a primary target for extortion. In November, the Point Lonsdale Medical Group in Victoria confirmed a cyber attack resulting in the unauthorised access of personal information. This incident follows a broader trend of ransomware groups, such as INC Ransom, aggressively targeting medical centres and allied health providers. The critical nature of patient data makes these organisations prime targets for "double extortion" tactics, where attackers encrypt data and threaten to release it publicly.

Education & EdTech

Western Sydney University continues to manage the fallout from a major data breach revealed recently, which exposed sensitive data including tax file numbers, payroll figures, and health information. Forensic investigation suggests the unauthorised access occurred between June and September 2025, but the repercussions are currently being felt across the sector. This highlights the persistent persistence of threat actors within academic networks, often undetected for months.

Government

State-sponsored espionage remains a top concern. On 24 November 2025, federal parliamentarians and staff at Parliament House were issued a strict warning to disable Wi-Fi and Bluetooth on their devices during a high-profile visit by a foreign delegation. This precautionary measure underscores the heightened risk of close-access technical attacks and data interception targeting government officials.

Additionally, the Crisis24 OnSolve CodeRED platform, used by emergency services, faced disruptions due to a cyber attack claimed by the INC ransomware gang. This attack on critical emergency notification infrastructure demonstrates the willingness of cybercriminals to endanger public safety for financial gain.

SaaS & AI Systems

November saw a notable incident involving OpenAI and analytics provider Mixpanel. OpenAI severed ties with the vendor after a security lapse exposed non-content data associated with some API users, such as email addresses and organisation IDs. While no chat logs or API keys were compromised, this incident serves as a stark reminder of third-party supply chain risks in the AI ecosystem.

Furthermore, a breach at customer success platform Gainsight reportedly impacted Salesforce customer tokens, forcing companies to rotate credentials rapidly. For SaaS providers, these events highlight the fragility of trust in interconnected cloud ecosystems.

FinTech

The Australian Cyber Security Centre (ACSC) issued alerts this month regarding scammers impersonating police to target cryptocurrency users. These sophisticated social engineering campaigns aim to steal seed phrases and wallet funds. Financial institutions are also grappling with a rise in AI-driven fraud, where deepfake voice technology is used to bypass biometric authentication in phone banking.

IoT & Automotive

Vulnerabilities in connected vehicles took centre stage with the disclosure of a flaw in Subaru’s Starlink multimedia technology (CVE-2025-xxxx), which could potentially allow third parties to access user accounts. As vehicles become increasingly software-defined, the attack surface for IoT significantly expands, necessitating rigorous penetration testing of embedded systems and APIs.

Vulnerability Spotlight: Exploited & Critical CVEs

Organisations should prioritise patching the following vulnerabilities, which have been active or critical in November 2025:

• Oracle Identity Manager (CVE-2025-61757): A critical pre-authentication Remote Code Execution (RCE) vulnerability. Security researchers have observed this being exploited as a zero-day. Immediate patching is required for all identity governance implementations.
• Microsoft WSUS (CVE-2025-59287): A critical flaw in Windows Server Update Services allows attackers to intercept and manipulate updates. This is particularly dangerous for enterprise environments relying on internal update servers.
• Node-forge (CVE-2025-12816): A high-severity vulnerability in this popular JavaScript cryptography library can allow attackers to bypass signature verifications. Developers using this package in their web applications must upgrade immediately to prevent cryptographic bypass attacks.

Strategic Recommendations

As we enter the holiday period, Australian organisations must assume that "off-hours" are target hours. We recommend:

1. ** enforcing 24/7 monitoring** or managed detection and response (MDR) coverage during the holidays.
2. Reviewing third-party access auditing, especially for SaaS integrations (like the OpenAI/Mixpanel case).
3. Conducting adversary simulation to test resilience against ransomware encryption and data exfiltration tactics.

Contact us for a quote for penetration testing service or adversary simulation.

Australian Cyber Threat Briefing: Record DDoS, SaaS Supply Chain Risks, and Holiday Scams

Executive Summary

As we enter December, the Australian cyber threat landscape has escalated sharply. In the last 24 hours, security teams across the nation have faced a convergence of sophisticated state-sponsored activity, record-breaking DDoS attacks, and targeted supply chain compromises. The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and global intelligence feeds indicate a critical surge in threats targeting SaaS environments and healthcare infrastructure.

This briefing covers the most significant threats, threat actors, and vulnerabilities identified over the weekend and into today, specifically tailored for Australian organisations.

---

Sector-Specific Threat Intelligence

1. Cloud & SaaS Providers: The "Scattered LAPSUS$ Hunters" Campaign

A highly sophisticated threat actor, tentatively dubbed "Scattered LAPSUS$ Hunters" (a suspected fusion of Scattered Spider and Lapsus$ TTPs), has launched a campaign targeting Salesforce instances.

• The Attack Vector: The group is exploiting SaaS supply chain vulnerabilities, specifically compromising third-party integrations like the Gainsight app to pivot into broader corporate environments.
• Impact: unauthorised access to customer data and potential lateral movement into connected cloud infrastructure.
• Recommendation: SaaS providers and users must immediately audit connected applications and review OAuth token permissions.

2. Healthcare: Ransomware Persistence

Healthcare remains the most targeted sector in Australia, accounting for 17% of all recent attacks.

• Recent Incident: Victorian-based Point Lonsdale Medical Group has disclosed a cyber attack resulting in unauthorised access to personal information. This follows the major breach at Western Sydney University which compromised sensitive health data.
• Threat Actor: Ransomware gangs such as Akira and SafePay are actively targeting Australian medical centres, often exploiting unpatched VPN concentrators to gain initial access.

3. eCommerce: Holiday Season "Vibe Scamming"

With the Black Friday and Cyber Monday sales period concluding, a new AI-driven threat known as "Vibe Scamming" has emerged.

• The Tactic: Threat actors are using Generative AI to analyse social media activity and shopping history to craft hyper-personalised phishing lures that mimic the "vibe" and tone of legitimate brands perfectly.
• Supply Chain Risk: Retailers are also warned of third-party breaches, similar to the recent incident involving fashion retailer Mango, where marketing providers were compromised to harvest customer details.

4. Government & Critical Infrastructure: Record DDoS Mitigation

In a concerning development for national resilience, Microsoft and local ISPs successfully mitigated the largest Distributed Denial-of-Service (DDoS) attack ever recorded against an Australian endpoint.

• The Attack: Peaking at 15.72 Terabits per second (Tbps), the attack was orchestrated by the AISURU botnet, a TurboMirai-class variant powered by hundreds of thousands of compromised IoT devices (routers, cameras, and DVRs).
• Implication: This signals a capability leap in botnet infrastructure, likely available via "DDoS-for-hire" platforms targeting government services.

5. FinTech: Crypto Drains & Police Impersonation

The ASD’s ACSC has issued a medium alert regarding a surge in scams where criminals impersonate Australian police officers.

• Modus Operandi: Victims are contacted regarding "fraudulent activity" and coerced into transferring cryptocurrency or handing over seed phrases for "verification."
• FinTech Impact: Platforms are urged to enhance fraud detection triggers for sudden high-value crypto outflows.

---

Vulnerability Watch: Web, API, and AI

Penetration testers and defenders must prioritise the following vulnerabilities which are currently being exploited in the wild:

• Fortinet FortiWeb (CVE-2025-58034):

  • Severity: High (CVSS 6.7 - Actively Exploited).
  • Type: OS Command Injection.
  • Risk: Allows authenticated attackers to execute unauthorised code via crafted HTTP requests. Immediate patching of version 7.x and 8.x appliances is mandatory.

• Google Chrome V8 (CVE-2025-13223):

  • Severity: High.
  • Type: Type Confusion.
  • Risk: Remote Code Execution (RCE) via malicious web pages. This is a critical vector for client-side attacks against corporate endpoints.

• AI System Exploitation:

  • Threat: Security researchers have identified a new Remote Access Trojan (RAT) disguising its Command and Control (C2) traffic as LLM Chat API requests. By mimicking legitimate traffic to AI models, these tools bypass standard network detection rules.

---

Strategic Recommendations

1. Harden SaaS Integrations: treating third-party SaaS apps as untrusted entities. Implement strict "least privilege" policies for API tokens.
2. Patch Edge Devices: Prioritise Fortinet and VPN gateway updates immediately to prevent ransomware ingress.
3. Botnet Resilience: Ensure DDoS mitigation services are stress-tested against terabit-scale floods.
4. AI Traffic Analysis: Update network monitoring rules to inspect payloads within AI API traffic for anomalous encoding or patterns.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Australia’s Holiday Cyber Surge & Critical Sector Alerts

Executive Summary

As we wrap up the Black Friday weekend and move into the holiday season, the Australian cyber threat landscape has seen a significant escalation in activity over the last 24 hours. Our deep dive into the latest intelligence reveals a coordinated surge in campaigns targeting the government, healthcare, and retail sectors. Advanced Persistent Threats (APTs) and opportunistic criminal gangs are leveraging AI-driven automation to exploit new vulnerabilities in web applications and APIs.

Below is a detailed breakdown of the critical threats, exploited vulnerabilities, and active threat actors impacting Australian organisations today.

---

Sector-Specific Threat Intelligence

1. Government & Healthcare: The "MyGov" Impersonation Wave

In the last 24 hours, a massive phishing and credential harvesting campaign has been detected targeting Australian government services.

• The Threat: A high-volume email campaign purporting to be from Centrelink and Medicare is currently active, affecting over 270,000 Australians. These emails utilise sophisticated social engineering, claiming "benefit suspensions" or "tax refunds" to drive urgency.
• Technical Insight: The attack vectors are linked to stolen legacy data used to craft highly convincing lures. The redirected sites are hosting AiTM (Adversary-in-the-Middle) phishing kits capable of bypassing standard Multi-Factor Authentication (MFA) by capturing session tokens in real-time.
• Healthcare Alert: CyberCX reports indicate that the healthcare sector remains the top target (17% of all attacks). Threat actors are currently focusing on non-hospital clinical providers—such as GP clinics and allied health services—exploiting "tech debt" and unpatched legacy systems to pivot into larger health networks.

2. eCommerce & Retail: The Post-Black Friday Fallout

As transaction volumes peaked this weekend, so did the attacks on digital retail infrastructure.

• Active Exploits: We are observing active exploitation of critical vulnerabilities in major eCommerce platforms. Specifically, CVE-2025-54236 (Magento) and CVE-2025-47569 (WooCommerce Ultimate Gift Card plugin) are being weaponised to inject Magecart-style digital skimmers.
• AI-Driven Fraud: Retailers are facing a wave of AI-generated fake reviews and "synthetic" identities used to test stolen credit card data (carding) at scale. Malicious domains mimicking major Australian retail brands have surged, hosted on bulletproof networks to resist takedowns.

3. SaaS & Cloud: API Insecurity at the Forefront

Australia currently holds the unenviable title of having the highest frequency of API security incidents in the APAC region.

• The Incident: Intelligence suggests a recent breach of an Australian SaaS loan management provider involved the threat actor "Scattered Spider". This group is known for sophisticated social engineering of helpdesk staff to gain initial access.
• Attack Vector: The breach likely exploited an unsecured API endpoint (Broken Object Level Authorization - BOLA) that allowed the exfiltration of sensitive financial data without triggering traditional perimeter alarms.

4. IoT & Smart Infrastructure: The Home Front

With the rapid adoption of smart home devices, the attack surface has expanded into Australian homes and energy grids.

• Solar Inverter Risks: New reports highlight a critical risk in solar inverters, which are being targeted to potentially disrupt local energy grids.
• Smart Home Attacks: Australian households are now facing an average of 29 cyber attacks per day. The primary vectors are weak default credentials and unpatched firmware in smart TVs and IP cameras, which are being enslaved into botnets for DDoS attacks.

---

Technical Deep Dive: Critical Vulnerabilities

Penetration testers and security teams must urgently validate the following vulnerabilities in their environments:

• Fortinet FortiWeb (CVE-2025-58034 & CVE-2025-64446): These critical OS command injection vulnerabilities are being actively chained by attackers to bypass authentication and execute remote code. Immediate patching is mandatory.
• Oracle E-Business Suite (CVE-2025-61882): A new flaw allowing remote code execution is being targeted, particularly within the supply chains of large enterprises.
• API Misconfigurations: With 95% of Australian organisations reporting API incidents, teams must audit for "Zombie APIs" (outdated, undocumented endpoints) which are currently a preferred entry point for data exfiltration.

Emerging Threat Actors

• Scattered Spider: Continuing their aggressive targeting of SaaS and identity providers (Okta, Microsoft Entra ID) via social engineering.
• State-Sponsored Activity: There is elevated chatter regarding APT groups linked to China and Iran targeting Australian research institutes and education sectors (specifically universities) to harvest intellectual property and population-level data.

---

Recommendations for Australian Organisations

1. Validate your External Attack Surface: ensure no shadow IT or forgotten API endpoints are exposed.
2. Patch Critical Appliances: Prioritise Fortinet and eCommerce plugins immediately.
3. Strengthen Identity Security: Move to FIDO2/WebAuthn hardware keys where possible to neutralise AiTM phishing attacks targeting MyGov and corporate logins.
4. Review Third-Party Risk: Audit SaaS providers for compliance with the latest "Smart to Secure" guidelines.

Contact us for a quote for penetration testing service or adversary simulation.