Why Long-Lived Cloud Credentials Are Your Biggest Identity Risk in 2025

Executive Summary

Across AWS, Google Cloud, and Microsoft Azure environments in Australia and globally, 59% of IAM users maintain access keys that have never expired—credentials that have been active for more than one year. These long-lived credentials represent a silent but catastrophic vulnerability in your cloud infrastructure. When credentials with persistent, unchanging authentication tokens are exposed—via GitHub repositories, container images, build logs, or compromised developer machines—attackers gain a direct, undetectable pathway to your most critical data and systems. For Australian organisations operating under the mandatory 72-hour ransomware reporting requirement (effective May 30, 2025) and strict Privacy Act breach notification rules, a credential compromise is not just a security incident—it is a regulatory nightmare. This blog explores why long-lived credentials have become the primary attack vector for identity-based breaches, how red teams exploit them during penetration tests, and what you must do today to eliminate this ticking time bomb.

---

The Scale of the Problem: Data That Demands Action

The Datadog 2025 State of Cloud Security Report reveals a stark reality that extends far beyond perception. In the last 12 months:

• 59% of AWS Identity and Access Management (IAM) users maintained access keys older than one year.
• 55% of Google Cloud service accounts possessed credentials that never rotated.
• 40% of Microsoft Entra ID applications had access keys active for over 12 months.

These are not one-off oversights. They represent systemic, organization-wide failures in credential lifecycle management. Many of these aged credentials are also unused and forgotten—sitting dormant in configurations, automations, and legacy integrations—making them both a security blind spot and a compliance violation waiting to be discovered.

In Australia, where identity-based attacks dominate the threat landscape, this credential sprawl has direct business implications. Long-lived credentials remain the root cause of publicly documented cloud data breaches globally. A single exposure can cascade into a complete infrastructure compromise, lateral movement across cloud environments, data exfiltration, and regulatory action.

Why Long-Lived Credentials Are the Attacker's Weapon of Choice

Long-lived credentials are attractive attack targets for several reasons that red teams exploit during penetration assessments:

• Static and unchanging: Once obtained, they remain valid indefinitely, providing persistence without requiring re-authentication attempts that might trigger alerts.
• High discovery value: They are frequently embedded in source code, Slack conversations, CI/CD logs, container images, and unencrypted backups—making them easier to find than live authentication sessions.
• Low detection risk: Unlike interactive authentication or multi-factor authentication (MFA) events, credential use from legitimate automation sources blends into normal traffic.
• Privilege escalation potential: Service account credentials often carry elevated permissions, enabling immediate privilege escalation and lateral movement.

When a red team discovers exposed AWS access keys in a GitHub repository, the test simulates exactly what an external attacker would do: use those keys to enumerate your cloud environment, discover overprivileged roles, access sensitive data, and establish persistence. The threat is not theoretical—it is operationalized every day.

---

How Long-Lived Credentials Compromise Your Cloud Security Posture

Where They Hide: The Four Common Exposure Vectors

1. Source Code Repositories

Developers often hardcode credentials to accelerate testing or troubleshooting. Even after deletion, these keys remain in repository history unless actively scrubbed. Attackers use GitHub dorks and similar search techniques to discover exposed AWS keys, API credentials, and database passwords within minutes of a commit.

2. Container Images and Build Artifacts

CI/CD pipelines inadvertently capture credentials in Docker images, build logs, and application artifacts. Once a container is deployed across multiple environments, the embedded credential grants access to the entire container ecosystem. A pentester scanning your container registry will identify and exploit these in seconds.

3. Embedded in Application Code and Environment Variables

Legacy automation often passes credentials as environment variables or in plaintext configuration files. Although modern secrets management tools exist, many organizations still rely on ad-hoc credential handling that bypasses centralized vaults.

4. Forgotten in Logs and Backup Systems

Credentials are logged during debugging, embedded in hardcoded configurations, or captured in application memory dumps. Attackers can use credential dumping utilities to extract these after gaining initial system access.

---

The Penetration Testing Perspective: How Red Teams Exploit Credential Risks

During a cloud penetration test, credential discovery is typically the second phase after initial reconnaissance. Here is how red teams and adversaries attack your environment:

Phase 1: Reconnaissance

• Enumerate publicly exposed S3 buckets, GitHub repositories, and cloud resources.
• Search for exposed credentials using Shodan, Binary Edge, or GitHub-specific search tools.

Phase 2: Credential Harvesting

• Extract credentials from discovered sources (repositories, build logs, support documentation).
• Validate harvested credentials by attempting authentication to cloud platforms.
• Document access levels and permissioned resources.

Phase 3: Lateral Movement

• Use harvested credentials to enumerate additional cloud resources, IAM roles, and trust relationships.
• Identify overprivileged service accounts that can reach sensitive data.
• Escalate privileges using cloud-native enumeration scripts or directory attack tools.

Phase 4: Persistence and Impact

• Establish backdoor access or deploy long-term persistence mechanisms.
• Exfiltrate sensitive data such as customer information, API keys, and intellectual property.
• Create additional credential caches to maintain access even if the initial compromise is detected.

---

Real-World Breach Case Study: Football Australia

A concrete example illustrates the catastrophic impact. During the Football Australia data breach investigation, developers had embedded long-term AWS access keys directly into the website source code. The keys granted unrestricted access to publicly misconfigured S3 buckets containing unencrypted personal data. A single compromised credential became the attack vector for a massive data breach affecting thousands of individuals—and triggered mandatory breach notification obligations to the Office of the Australian Information Commissioner (OAIC).

The breach resulted from a toxic combination of:

• Hardcoded long-lived credentials in source code (insecure development practice).
• Overly permissive IAM policies granting full S3 access.
• Public misconfiguration of S3 buckets (lack of access controls).
• Absence of credential monitoring or rotation.

This preventable incident demonstrates that credential risk is not just a technical problem—it is a business continuity and regulatory compliance crisis.

---

Australian Compliance Context: The Regulatory Stakes

Mandatory Ransomware Reporting (72 Hours)

From May 30, 2025, Australian businesses with annual turnover exceeding AUD $3 million must report ransomware and cyber extortion payments to the Department of Home Affairs within 72 hours. A credential compromise that enables ransomware deployment is now a reportable incident with strict timing requirements.

Notifiable Data Breach Scheme (NDB)

Organizations must notify affected individuals and the OAIC of any eligible data breach likely to cause serious harm within 30 calendar days of assessment. The Privacy Act penalties have escalated significantly, with maximum civil penalties reaching AUD $50 million (or three times the benefit of the contravention) for serious invasions of privacy.

ASD Blueprint and Cloud Computing Standards

The Australian Signals Directorate (ASD) has issued guidance through the Blueprint for Secure Cloud, which emphasizes risk-managed approaches to cloud security aligned with the Information Security Manual (ISM). From July 1, 2026, government agencies and increasingly, critical infrastructure operators, must comply with the new Cloud Computing Standard.

OAIC Expanded Enforcement Powers

The OAIC can now:

• Request information about suspected data breaches.
• Conduct compliance assessments.
• Issue compulsory compliance notices.
• Levy medium- and low-level civil penalties without court intervention.

For organizations with compromised credentials leading to data breaches, this means faster regulatory scrutiny, higher penalties, and mandatory public disclosure.

---

Why Penetration Testing Is Essential for Credential Risk Assessment

A comprehensive penetration test—especially one focused on cloud infrastructure—serves as the only realistic way to validate your credential security posture before attackers do.

What Cloud Penetration Testing Reveals

Credential Exposure Assessment

• Automated and manual scanning of your cloud environment, repositories, and artifact storage.
• Discovery of active access keys, API tokens, and service account credentials.
• Validation of credential age and rotation status.
• Identification of credentials with excessive permissions (overprivilege analysis).

IAM and Access Control Testing

• Enumeration of IAM policies, roles, and trust relationships.
• Identification of overpermissive roles (e.g., AdministratorAccess assigned to non-admin users).
• Assessment of service account configuration and privilege escalation potential.
• Testing of cross-account access and assume-role abuse scenarios.

Lateral Movement Simulation

• Simulated credential harvesting and validation.
• Testing of privilege escalation paths using harvested credentials.
• Assessment of network segmentation and API-level access controls.
• Detection capability validation (determining what telemetry would have been triggered).

Data Perimeter and Restrictive Access Controls

• Validation of data perimeters—policies that restrict cloud API calls to approved networks and trusted accounts.
• Testing of resource-level access controls and public access blocks.
• Assessment of encryption and secret management practices.

Actionable Deliverables from Penetration Testing

• Risk-ranked findings with exploitation evidence.
• Remediation roadmaps prioritized by exploitability and business impact.
• Detection gaps report showing what your security tooling missed.
• Credential lifecycle recommendations aligned with your architecture and compliance obligations.

Penetration Testing Assessment Components

Assessment Component	Objective	Expected Outcome
Credential Exposure Scan	Identify exposed credentials in repositories, logs, and artifacts.	Inventory of discoverable credentials ranked by sensitivity.
IAM Policy Analysis	Detect overpermissive roles and trust relationships.	Findings of excessive permissions and privilege escalation paths.
Credential Harvesting Simulation	Simulate real-world credential theft and validation.	Evidence of whether harvested credentials grant access.
Lateral Movement Testing	Test privilege escalation and cross-account access.	Attack paths from low-privilege to sensitive resources.
Detection Validation	Assess whether your security tools detected credential-based attacks.	Coverage gaps in logging, monitoring, and alerting.
Remediation Roadmap	Prioritize findings by exploitability and business impact.	Clear, sequenced recommendations for credential lifecycle improvements.

---

Best Practices: Eliminating Long-Lived Credentials from Your Cloud Environment

Immediate Actions (0–30 Days)

1. Audit All Active Credentials

Conduct a comprehensive inventory of all AWS IAM users, Google Cloud service accounts, and Azure application identities. Document:

• Credential creation and last rotation date.
• Associated permissions and privilege level.
• Usage patterns (active vs. dormant).
• Location (embedded in code, logs, or configuration).

2. Implement Credential Rotation Policies

• Rotate all credentials older than 90 days (ideally 30–45 days for sensitive roles).
• Establish automated rotation using native tools like AWS Secrets Manager, Azure Key Vault, and Google Secret Manager.
• Document and monitor rotation events in centralized logging.

3. Eliminate Unused Credentials

• Deactivate and remove service accounts no longer in use.
• Revoke access for terminated employees and offboarded contractors.
• Close inactive IAM user accounts with old access keys.

Medium-Term Initiatives (1–3 Months)

4. Transition to Temporary, Short-Lived Credentials

• Deploy AWS STS and temporary session tokens for human access.
• Implement AWS IAM Identity Center for centralized federated authentication.
• Use Google Cloud Workload Identity and Azure Managed Identities for application-to-application access.
• Enforce MFA for all human access and enable MFA for programmatic access where supported.

5. Centralize Secrets Management

• Adopt enterprise-grade secrets management solutions (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault).
• Enforce automatic credential injection into applications and CI/CD pipelines.
• Implement audit logging for all credential access and usage events.
• Restrict human access to secrets to emergency scenarios only.

6. Implement Data Perimeters

A data perimeter restricts sensitive cloud API calls to succeed only when made from approved networks, trusted cloud accounts, or legitimate automation services. Even if a credential is compromised, the attacker cannot use it to access sensitive resources outside of approved contexts.

Long-Term Architecture Changes (3–6 Months)

7. Enforce Least Privilege at Scale

• Review and reduce IAM permissions to match the principle of least privilege.
• Implement automated permission optimization tools.
• Establish RBAC governance with quarterly reviews.
• Use ABAC where supported to enable dynamic, context-aware permissions.

8. Continuous Monitoring and Detection

• Deploy CSPM tools to detect credential misconfigurations.
• Implement IAM monitoring to detect anomalous authentication patterns.
• Enable centralized logging of cloud API activity (CloudTrail, Cloud Logging, Activity Log).
• Configure alerts for unusual API calls, failed authentication attempts, and privilege escalation attempts.

9. Conduct Regular Penetration Testing

• Perform cloud-specific penetration tests annually or after significant infrastructure changes.
• Include credential harvesting and exploitation scenarios in scope.
• Validate detection and response capabilities through purple-team exercises.
• Update credential governance policies based on lessons learned.

---

The Business Case: Why Credential Risk Demands Immediate Board Attention

Financial and Reputational Impact

• A single credential compromise can lead to a data breach affecting millions of customers, triggering OAIC enforcement and public disclosure.
• Breach notification and remediation costs can reach millions of dollars in Australia.
• Regulatory fines under the Privacy Act can exceed AUD $50 million.
• Incident response, forensics, and remediation further escalate costs.
• Reputational damage and customer trust erosion can be long-lasting.

Competitive Risk

Organizations that do not actively manage credential lifecycle are more likely to suffer breaches that expose customer data and intellectual property, enable long-term attacker persistence, and result in public disclosure that undermines market position and shareholder confidence.

Compliance and Governance

Australian regulatory bodies—particularly the OAIC and ASD—are increasing enforcement actions against organizations with weak credential governance. Proactive credential management is no longer optional; it is a baseline expectation for regulated entities.

---

Conclusion: The Time to Act Is Now

Long-lived credentials remain the most cost-effective attack vector for threat actors and the most common root cause of documented cloud data breaches. Over half of organizations continue to rely on credentials that have never rotated—despite the availability of modern, short-lived credential mechanisms.

In Australia, where mandatory breach reporting, Privacy Act enforcement, and ASD compliance requirements converge, credential compromise is no longer just a security issue—it is a board-level business risk.

Your action items:

• Audit all active cloud credentials and identify those older than 90 days.
• Remediate by rotating sensitive credentials and removing unused accounts.
• Architect a transition to temporary, short-lived credentials using managed identity services.
• Test your credential security posture through a dedicated cloud penetration assessment.
• Monitor continuously for credential exposure and anomalous access patterns.

Organizations that treat credential lifecycle management as a strategic priority—not just a compliance checkbox—will dramatically reduce their risk of data breach, regulatory enforcement, and operational disruption.

---

Call to Action

Your cloud credentials are only as secure as your most hidden, least monitored access key. If you are uncertain whether your organization is adequately protecting against credential-based compromise, or if you want to validate your cloud security posture before an attacker does, schedule a consultation with our cloud penetration testing specialists.

We conduct rigorous, authorized assessments that simulate real-world credential harvesting and exploitation scenarios—revealing the gaps that matter most. Our detailed findings and remediation roadmaps help you eliminate long-lived credentials from your environment and implement the controls that prevent breach.

Contact us today to discuss your cloud credential risk assessment and penetration testing engagement.

---

Daily Threat Briefing: Australia – 27 December 2025

Executive Summary

The last 24 hours have highlighted significant volatility in Australia’s cyber threat landscape, with critical infrastructure, healthcare, and education sectors facing intensified pressure. Of particular concern today is the active exploitation of critical vulnerabilities in widely used network security devices and a surge in ransomware activity targeting Australian schools. This briefing breaks down the most urgent threats, exploited vulnerabilities, and strategic risks for Australian organisations observed over the past day.

Top Critical Vulnerabilities (Active Exploitation)

• WatchGuard Firebox (CVE-2025-14733): The Australian Cyber Security Centre (ACSC) has escalated its warning regarding this critical vulnerability. Threat actors are actively exploiting it to gain unauthorised access to corporate networks. If your organisation utilises WatchGuard Firebox devices, immediate patching is mandatory.
• Fortinet FortiCloud (CVE-2025-59718 & CVE-2025-59719): These critical flaws allow for a Single Sign-On (SSO) authentication bypass, potentially granting attackers administrative control over cloud-managed security appliances. Exploits are now being observed in the wild targeting Australian government and enterprise networks.
• React Server Components (CVE-2025-55182): A severe Remote Code Execution (RCE) vulnerability has been discovered in this popular web framework. This poses a massive risk to SaaS providers and modern web applications, particularly those utilizing server-side rendering.

Sector-Specific Threat Intelligence

1. Healthcare & SaaS Providers The healthcare sector remains a primary target. A significant supply chain breach involving Phreesia (via its subsidiary ConnectOnCall) has reportedly impacted over 910,000 individuals. This incident underscores the fragility of the SaaS supply chain; attackers compromised a third-party integration to access sensitive patient data. Additionally, a recent audit of NSW Health revealed that clinicians have been bypassing security controls to expedite workflows, creating internal vulnerabilities that attackers are eager to exploit.

2. Education / EdTech Australian schools are currently in the crosshairs of the Fog ransomware gang. The group has claimed responsibility for an attack on Waverley Christian College, allegedly exfiltrating 5GB of sensitive data. This follows a broader campaign against the education sector, including a breach at the University of Sydney and the "Thanks for the Help" support platform. Educational institutions must urgently review their data egress monitoring and backup immutability.

3. FinTech & Banking The Antidot Banker malware campaign is aggressively targeting Australian financial institutions. The malware is being distributed via fake recruitment emails and SMS lures, tricking users into downloading malicious Android CRM applications. Once installed, it intercepts 2FA codes and harvests banking credentials. FinTech applications should enforce rigorous device integrity checks to detect these compromised environments.

4. Government & Critical Infrastructure A joint advisory has warned of renewed activity by pro-Russia hacktivist groups targeting Australian critical infrastructure. These attacks are largely opportunistic, utilising DDoS vectors and basic exploit scripts to disrupt energy and transport operations. Concurrently, concerns are mounting over the Department of Home Affairs' deployment of AI systems on sensitive data, with experts warning of "prompt injection" attacks that could lead to data leakage.

5. AI Systems & Emerging Tech A new vulnerability has been identified in Vincent AI (vLex), a legal AI assistant used by law firms. The flaw allows for "AI phishing," where attackers use hidden HTML code in documents to steal user credentials. This highlights a growing trend of "adversarial machine learning" where AI models themselves become the attack vector.

Key Recommendations

• Patch Immediately: Prioritise WatchGuard and Fortinet updates.
• Audit Supply Chains: SaaS providers must rigorously assess third-party integrations (like the Phreesia incident).
• Harden Web Apps: Developers using React must review their implementation against CVE-2025-55182 immediately.
• User Awareness: Alert staff to the Antidot Banker recruitment scams and verify the authenticity of job-related communications.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Boxing Day Cyber Spike & Critical Edge Exploits

Executive Summary As Australian organisations operate with skeleton staff over the Boxing Day public holiday, the cyber threat landscape has intensified significantly in the last 24 hours. Threat actors are actively capitalising on reduced monitoring capabilities and the surge in e-commerce traffic. The Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC) has escalated warnings regarding critical exploits in edge devices, while the retail and fintech sectors face a barrage of sophisticated API abuse campaigns.

Critical Alert: WatchGuard Firebox Exploitation (CVE-2025-14733) The most pressing threat identified in the last 24 hours is the active, widespread exploitation of a critical authentication bypass vulnerability in WatchGuard Firebox devices (CVE-2025-14733).

• The Threat: Unauthenticated remote attackers are gaining administrative access to edge firewalls, allowing them to disable security controls and pivot into internal networks.
• Impact: This serves as a primary entry point for ransomware groups targeting the Education and Government sectors, which are currently vulnerable due to holiday shutdowns.
• Action: Immediate patching or isolation of management interfaces is mandatory.

Sector-Specific Threat Intelligence

• eCommerce & FinTech: The Boxing Day Siege With the Boxing Day sales in full swing, our analysis detects a sharp rise in Broken Object Level Authorisation (BOLA) attacks targeting retail APIs. Cybercriminals are manipulating API endpoints to access customer PII and loyalty points. Furthermore, FinTech payment gateways are seeing an uptick in "Deepfake" social engineering, where AI-generated voice vectors are used to authorise fraudulent high-value transactions, bypassing traditional voice biometric security.

• Healthcare: Persistent Targeting by Funksec Following the recent trend of targeting peripheral health organisations, the threat group 'Funksec' has been observed scanning for unpatched web applications in the Healthcare sector over the last 24 hours. Their focus has shifted to third-party API integrations used for patient booking systems, exploiting trusted connections to move laterally into core hospital networks.

• SaaS & Cloud: The React2Shell Fallout Exploitation of the 'React2Shell' vulnerability (CVE-2025-55182) in React Server Components continues to plague SaaS providers. Despite patches being available, threat actors are leveraging automated scanners to identify and compromise updated instances that failed to rotate compromised session keys. We are observing 'extortion-only' attacks where data is exfiltrated from cloud environments without encryption, aimed at forcing rapid payouts.

• Government & Critical Infrastructure State-sponsored actor Salt Typhoon remains active, with new indicators of compromise (IoCs) suggesting a focus on telecommunications infrastructure used by government agencies. This aligns with the recent ACT Audit Office findings on severe access control weaknesses, making identity management a critical vector.

• IoT & Smart Systems A new wave of attacks targeting IoT building management systems (BMS) has been detected, specifically exploiting legacy protocols in smart HVAC systems to gain a foothold in corporate networks. This 'shadow IoT' risk is critical as facilities are largely unmanned during the break.

Emerging Technologies: AI & API Threats

• Agentic AI: We are witnessing the deployment of "Agentic AI" malware that autonomously adapts its behaviour to evade detection. These AI-driven agents are currently being used to speed up privilege escalation in compromised cloud environments.
• API Security: The volume of API traffic during the sales period has masked low-and-slow data scraping attacks. Security teams must analyse traffic for anomalous data egress patterns, not just volumetric spikes.

Recommendations

1. Patch WatchGuard Devices Immediately: Prioritise CVE-2025-14733 remediation.
2. Monitor API Traffic: Implement strict rate limiting and behaviour analysis on checkout and payment APIs.
3. Verify High-Value Transactions: profound scepticism should be applied to urgent payment requests; verify via secondary channels to counter AI deepfakes.
4. Enhance On-Call Readiness: Ensure escalation paths are clear for the remainder of the holiday period.

Contact us for a quote for penetration testing service or adversary simulation.

Australian Cyber Threat Briefing: Critical RCEs and Ransomware Targeting SaaS & Education

As we wrap up the year, the Australian cyber threat landscape has intensified significantly over the last 24 hours. Critical vulnerabilities in widely used network appliances and targeted ransomware campaigns against key sectors—specifically Education, Healthcare, and SaaS providers—demand immediate attention from security teams.

Here is your daily briefing on the most critical threats impacting Australian organisations.

🚨 Critical Vulnerability Alert: WatchGuard Firebox (CVE-2025-14733)

Severity: Critical (CVSS 9.3) Status: Active Exploitation

A critical Remote Code Execution (RCE) vulnerability has been discovered in WatchGuard Firebox appliances. The flaw, tracked as CVE-2025-14733, resides in the iked process responsible for IKEv2 VPN negotiations.

• The Threat: Unauthenticated, remote attackers can exploit an out-of-bounds write condition to execute arbitrary code with root privileges. No user interaction is required.
• Impact: Full system compromise, allowing attackers to pivot into internal networks, intercept VPN traffic, or deploy ransomware.
• Action Required: Patch immediately to Fireware OS versions 2025.1.4, 12.11.6, or 12.5.15. CISA added this to its Known Exploited Vulnerabilities (KEV) catalog on 19 December, mandating urgent remediation.

---

Sector-Specific Threat Intelligence

🎓 Education / EdTech: University of Sydney Breach

The University of Sydney has confirmed a significant data breach impacting over 13,000 individuals, including current staff, alumni, and donors.

• Attack Vector: Threat actors accessed an internal online code library used for software development. While the system was non-critical, it contained historical datasets that were improperly stored.
• Exfiltrated Data: Names, dates of birth, residential addresses, phone numbers, and employment details.
• Analysis: This incident highlights the risk of "shadow data" in development environments. DevOps teams must ensure production data is never used in testing or coding repositories without sanitisation.

☁️ SaaS & Government: Netstar Australia Ransomware Attack

Melbourne-based Netstar Australia, a major provider of GPS telematics and fleet management solutions, has been hit by the Blackshrantac ransomware group.

• The Incident: The group claims to have exfiltrated 800GB of sensitive data and has listed the company on their dark web leak site.
• Criticality: Netstar’s client base includes government agencies and critical infrastructure operators. The compromise of real-time location data and fleet telemetry poses a severe national security and operational risk.
• Threat Actor Profile: Blackshrantac is a newer, aggressive group first observed in late 2025, known for double-extortion tactics and targeting mid-sized technology providers.

🏥 Healthcare: Harbour Town Doctors Data Leak

The Rhysida ransomware gang has claimed responsibility for an attack on Harbour Town Doctors, a Queensland medical centre.

• Status: The group has published samples of patient summaries, referral letters, and administrative records, demanding a ransom of 5 Bitcoin (~AUD 200,000).
• Sector Trend: Healthcare remains a primary target due to the high value of medical records (PHI) and the critical need for uptime. Small to medium clinics are increasingly targeted as "soft" entry points into the broader health ecosystem.

🛍️ eCommerce / Retail: BECKS Jewellery

Australian luxury jeweller BECKS has confirmed a cyber incident after the SafePay ransomware group listed them as a victim.

• Impact: Preliminary investigations suggest customer data and internal designs may have been compromised. Retailers are reminded that high-value brand reputation is a key lever used by extortionists.

---

Emerging Vulnerabilities & Exploits

Beyond WatchGuard, security teams should be vigilant regarding:

• Fortinet FortiCloud (CVE-2025-59718): A critical authentication bypass vulnerability allowing attackers to hijack sessions. Ensure all Fortinet SaaS integrations are reviewed.
• AI System Exploitation: We are observing an uptick in "prompt injection" attacks against customer-facing AI chatbots in the FinTech sector, used to bypass controls and elicit unauthorised account details.

Recommendations for the Weekend

1. Audit Edge Devices: specifically WatchGuard and Fortinet appliances. If you cannot patch immediately, disable IKEv2 VPN services where possible.
2. Review Code Repositories: Scan GitHub/GitLab instances for hardcoded secrets or production data (as seen in the USYD breach).
3. Supplier Risk Management: If you utilise Netstar for fleet tracking, assess the sensitivity of the data they hold and prepare for potential operational visibility loss.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Critical WatchGuard Exploits & Holiday Ransomware Spikes – 24 December 2025

Executive Summary

As we head into the Christmas break, the Australian cyber threat landscape has escalated significantly over the last 24 hours. The Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC) has issued a critical alert regarding active exploitation of WatchGuard Firebox devices. This comes alongside a surge in ransomware activity targeting the education and government sectors, with threat actors looking to capitalise on reduced staffing levels during the holiday period.

For security teams, the priority today is patching edge devices and ensuring on-call rotations are robust for the next 48 hours.

Sector-Specific Updates

Government

• ACT IT Systems Exposed: A scathing report released yesterday (23 December) by the ACT Audit Office has highlighted severe IT control weaknesses across multiple government agencies. The audit found that 68% of identified issues related to information security controls, specifically user access management and logging. This leaves agencies highly susceptible to fraud and unauthorised data exfiltration, a critical concern given the sensitive citizen data held.
• Critical Infrastructure Alert: The ASD has reiterated warnings regarding Salt Typhoon, a sophisticated state-sponsored actor targeting telecommunications infrastructure. Australian gov-tech providers are urged to review logs for "living off the land" techniques, particularly involving Cisco and Fortinet edge devices.

Education & EdTech

• Ransomware Hits Schools: The Fog ransomware gang has claimed responsibility for an attack on Waverley Christian College in Victoria. This follows a trend of late-year attacks on educational institutions when IT resources are often winding down.
• SaaS Platform Targeted: Australian educational support platform 'Thanks For the Help' (TFTH) has been listed as a victim by the KillSec ransomware group. This highlights the growing risk to EdTech SaaS providers who hold aggregated student data.

Healthcare

• Persistent Targeting: Following the CyberCX 2025 Threat Report, healthcare remains the most targeted non-government sector in Australia.
• Data Integrity Risks: Recent incidents involving Funksec (who targeted the Fresh Produce Safety Centre) demonstrate that even peripheral health-related non-profits are in the crosshairs. While the data leaks have been minor so far, the entry vectors often involve unpatched web applications and third-party API integrations.

eCommerce & FinTech

• API Security Crisis: New data indicates that 95% of Australian organisations experienced an API security incident this year. For eCommerce platforms bracing for Boxing Day sales, Broken Object Level Authorisation (BOLA) remains the top vulnerability.
• Gaming Sector Breach: Ainsworth Game Technology has been targeted by the Medusa ransomware group, with claims of over 800GB of data stolen. FinTechs and gaming operators should be on high alert for similar extortion attempts.

Emerging Vulnerabilities: Web, Cloud & AI

1. WatchGuard Firebox (CVE-2025-14733) – CRITICAL

• Status: Active Exploitation.
• Details: A critical authentication bypass vulnerability allows unauthenticated remote attackers to gain administrative access to the device.
• Action: Apply the hotfix immediately. If patching is not possible, restrict WAN access to the management interface.

2. Fortinet FortiCloud (CVE-2025-59718 & CVE-2025-59719)

• Status: High Risk.
• Details: These vulnerabilities allow for SSO Login Authentication Bypass. Attackers can hijack sessions to gain entry into cloud management consoles.
• Action: Verify all admin accounts have MFA enforced and review audit logs for suspicious logins from unknown IPs.

3. AI System Threats

• Adversarial AI: We are observing an uptick in "deepfake" social engineering attempts targeting finance teams for end-of-year invoice payments. Generative AI is being used to craft highly convincing phishing lures that bypass traditional email filters.

Threat Actor Activity

• Funksec: This group is currently active and opportunistic, targeting small to medium Australian enterprises (SMEs) with "double extortion" tactics—encrypting data and threatening to leak it.
• Pro-Russia Hacktivists: As flagged by the ACSC, these groups are conducting low-sophistication but high-impact DDoS attacks against critical infrastructure to disrupt holiday operations.
• Magecart / Digital Skimmers: With the Boxing Day sales approaching, eCommerce providers must ensure their Content Security Policies (CSP) are strict to prevent malicious JavaScript injection into checkout pages.

Recommendation

The "skeleton crew" approach to holiday staffing is a known vulnerability that adversaries exploit. Ensure your incident response plans are accessible and that key personnel are reachable.

Contact us for a quote for penetration testing service or adversary simulation.