Daily Threat Briefing: Australia – 27 January 2026
The Australian cyber threat landscape has intensified significantly over the last 24 hours, with critical developments impacting the healthcare, retail, and SaaS sectors. Today’s briefing highlights a new zero-day exploit in Microsoft Office, a confirmed breach at a major fertility provider, and the emergence of "World Leaks" targeting global brands with Australian operations.
The Australian cyber threat landscape has intensified significantly over the last 24 hours, with critical developments impacting the healthcare, retail, and SaaS sectors. Today’s briefing highlights a new zero-day exploit in Microsoft Office, a confirmed breach at a major fertility provider, and the emergence of "World Leaks" targeting global brands with Australian operations.
Top Priority: Critical Vulnerability Alerts
Microsoft Office Zero-Day (CVE-2026-21509) In the last 24 hours, Microsoft has issued emergency guidance for a high-severity zero-day vulnerability (CVE-2026-21509) currently being exploited in the wild. This flaw allows attackers to bypass security features locally by leveraging untrusted inputs in Office files.
- Impact: User interaction is required (opening a malicious file), but successful exploitation can lead to code execution.
- Action: Organisations must apply the out-of-band patch immediately, particularly for Office 2021 and Microsoft 365. Temporary registry mitigations are available for older versions.
ServiceNow AI "BodySnatcher" Vulnerability A severe privilege escalation flaw has been discovered in ServiceNow’s Now Assist AI agents. Dubbed "BodySnatcher", this vulnerability allows unauthenticated attackers to hijack AI workflows and create administrative backdoors. As Australian enterprises race to adopt AI-driven SaaS tools, this serves as a stark warning to audit AI permissions rigorously.
Sector Intelligence & Incidents
Healthcare: Genea Data Breach Confirmed
Australia’s healthcare sector continues to be a primary target. Genea, a leading fertility and IVF provider, has confirmed a cyber attack resulting in the exfiltration of sensitive patient data.
- Status: Stolen records have reportedly appeared on the dark web.
- Analysis: This incident follows a disturbing trend of extortion-based attacks on specialist medical clinics in Australia (e.g., the Point Lonsdale and O&G incidents late last year). The sensitivity of the data makes extortion attempts highly likely.
Retail & eCommerce: Nike Investigating "World Leaks" Claims
Global sportswear giant Nike is investigating claims by the "World Leaks" ransomware gang, who allege they have stolen 1.4TB of internal data. While the full impact on Australian customers is being assessed, this group is known for shifting from encryption to pure data-theft extortion.
- Risk: Potential exposure of customer PII and partner supply chain data.
Education: Fallout from Victorian Schools Attack
The education sector remains on high alert following the Victorian Department of Education breach earlier this month, which impacted over 1,700 government schools.
- Update: Forensic analysis suggests the initial vector involved compromised staff credentials. Educational institutions are urged to accelerate the rollout of phishing-resistant Multi-Factor Authentication (MFA) to prevent lateral movement.
FinTech: Regulatory Heat & Data Leaks
- Airwallex Audit: The Australian Transaction Reports and Analysis Centre (AUSTRAC) has ordered an external audit of FinTech unicorn Airwallex over suspected AML/CTF compliance failures. This signals a tougher regulatory stance on the FinTech sector’s risk management practices.
- Prosura Breach: Fallout continues from the Prosura (car rental insurance) breach, where 300,000 customer records were exposed. Attackers are actively selling this data, increasing the risk of targeted phishing campaigns against policyholders.
IoT & Edge Security
- WatchGuard Firebox Exploitation: Active exploitation of a critical vulnerability (CVE-2025-14733) in WatchGuard Firebox devices continues. Attackers are using this to gain initial access to small-to-medium business networks.
- Konni Threat Actor: New intelligence indicates the North Korean-linked threat actor Konni is targeting blockchain developers in Australia. The group is using malicious project documentation and AI-generated PowerShell backdoors to compromise development environments.
Summary & Recommendations
The last 24 hours have demonstrated that no sector is immune. From AI-driven SaaS vulnerabilities to zero-day exploits in ubiquitous office software, the attack surface is expanding.
Immediate Actions:
- Patch Microsoft Office across all endpoints immediately.
- Audit AI Integrations (specifically ServiceNow) for privilege escalation risks.
- Monitor Vendor Risk, particularly if your organisation interacts with Genea or Nike.
- Reinforce DevSecOps, especially for blockchain and FinTech teams targeted by state-sponsored actors like Konni.
Contact us for a quote for penetration testing service or adversary simulation.
Daily Threat Briefing: Australia Day Cyber Risks, Active RCEs & EdTech Fallout
As the nation observes Australia Day, the cyber threat landscape over the last 24 hours has been anything but quiet. While many organisations are operating with skeleton staff due to the public holiday, threat actors are actively leveraging this window to exploit critical vulnerabilities in widely used infrastructure. Our analysts have observed a convergence of physical and digital threats, with heightened hacktivist chatter targeting government entities and continued fallout from the massive Victorian education sector breach.
Executive Summary As the nation observes Australia Day, the cyber threat landscape over the last 24 hours has been anything but quiet. While many organisations are operating with skeleton staff due to the public holiday, threat actors are actively leveraging this window to exploit critical vulnerabilities in widely used infrastructure. Our analysts have observed a convergence of physical and digital threats, with heightened hacktivist chatter targeting government entities and continued fallout from the massive Victorian education sector breach.
For today’s briefing, we are issuing urgent alerts for Healthcare, Education, and Government sectors, alongside critical patch warnings for Cisco and Windows environments.
Sector-Specific Threat Intelligence
🏛️ Government & Critical Infrastructure
- Australia Day Hacktivism: We have detected increased chatter on dark web forums and Telegram channels encouraging DDoS and defacement campaigns against Australian government portals today. This aligns with historical trends of national holiday targeting.
- The "Salt Typhoon" Threat: Assessing the last 24 hours of telemetry, the China-backed APT group identified as Salt Typhoon is aggressively targeting authentication weaknesses in Ivanti Connect Secure gateways. They are leveraging the recently disclosed authentication bypass vulnerabilities (CVE-2025-0282) to gain initial access. Security teams should be on high alert for anomalous login activity, particularly from non-Australian IP addresses.
🎓 Education & EdTech
- Victorian Schools Breach Fallout: The ripple effects of the Victorian Department of Education data breach (confirmed mid-January) continue to widen. Over the weekend, fresh datasets appearing to contain student contact details and parent email addresses have surfaced on breach forums.
- SaaS Supply Chain Risk: EdTech platforms utilising the n8n workflow automation tool must urgently verify they have patched CVE-2026-21858. We have observed automated scanning for unpatched instances of this tool, which allow for Remote Code Execution (RCE).
🏥 Healthcare & IoT
- "MongoBleed" Resurgence (CVE-2025-14847): A new wave of attacks targeting unpatched MongoDB instances has been identified, specifically aiming at eHealth applications and IoT medical device gateways. Attackers are exfiltrating unstructured patient data.
- IoT Device Gateways: With the holiday reducing on-site staff, IoT monitoring systems in hospitals are prime targets. Ensure segmentation is strictly enforced to prevent lateral movement from compromised smart devices to patient record systems.
💳 FinTech & eCommerce
- Session Hijacking Campaigns: Retailers running extended Australia Day sales are being targeted by sophisticated phishing campaigns weaponising a new Microsoft Word RCE (CVE-2026-20944). These emails often masquerade as "Urgent Invoice" or "Order Query" attachments.
- Cisco UC Exploitation: FinTech firms relying on Cisco Unified Communications (UC) for internal comms need to patch CVE-2026-20045 immediately. This RCE flaw (CVSS 8.2) is being exploited in the wild to gain root privileges on unpatched systems.
Vulnerability Watch: The "Must-Patch" List
Security teams should prioritise the following vulnerabilities, which have seen active exploitation in the Australian region within the last 24 hours:
Cisco Unified Communications (CVE-2026-20045):
- Type: Remote Code Execution (RCE).
- Status: Active exploitation. Added to CISA KEV.
- Action: Patch immediately. No workarounds available.
Microsoft Windows "DWM" (CVE-2026-20805):
- Type: Privilege Escalation (to SYSTEM).
- Target: Corporate workstations and government endpoints.
- Status: Exploited in the wild as a post-compromise escalation tool.
Ivanti Connect Secure (CVE-2025-0282):
- Type: Authentication Bypass / RCE.
- Target: VPN Gateways.
- Status: Critical. Being weaponised by ransomware groups like Qilin.
Analyst Comment
The convergence of a public holiday with critical RCE vulnerabilities creates a "perfect storm" for defenders. The reduced staffing levels today mean detection times may be slower, giving adversaries a larger window to establish persistence. We strongly recommend that SOC teams maintain heightened vigilance and that on-call engineers are prepared to mobilise for out-of-band patching of the Cisco and Windows flaws.
Contact us for a quote for penetration testing service or adversary simulation.
Daily Threat Briefing: Airwallex Under Scrutiny, Copilot AI Vulnerability & Critical SaaS RCEs
The Australian cyber threat landscape has seen significant activity over the last 24 hours, with major developments across the FinTech and SaaS sectors. From regulatory crackdowns on financial platforms to novel attacks targeting AI systems, organisations must remain vigilant. Below is a deep dive into the most critical threats, exploited vulnerabilities, and industry updates relevant to Australian businesses today.
The Australian cyber threat landscape has seen significant activity over the last 24 hours, with major developments across the FinTech and SaaS sectors. From regulatory crackdowns on financial platforms to novel attacks targeting AI systems, organisations must remain vigilant. Below is a deep dive into the most critical threats, exploited vulnerabilities, and industry updates relevant to Australian businesses today.
FinTech: Airwallex Audited by AUSTRAC
In a major development for the FinTech sector, the Australian Transaction Reports and Analysis Centre (AUSTRAC) has ordered an external audit of payment platform Airwallex. Announced yesterday (23 January), the regulator suspects compliance failures regarding Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) laws.
- The Risk: AUSTRAC is concerned that Airwallex’s transaction monitoring program has not adequately kept pace with the risks associated with its cross-border fund transfers.
- Impact: This highlights the increasing regulatory pressure on Australian FinTechs to robustly define their customer base and report suspicious matters. Financial institutions should review their own AML/CTF controls immediately to avoid similar scrutiny.
AI & SaaS Systems: The 'Reprompt' Attack on Copilot
As AI integration deepens, so do the attack vectors. Security researchers have unveiled a new "Reprompt" attack targeting Microsoft Copilot.
- The Exploit: This sophisticated technique allows attackers to silently siphon data from Copilot sessions. By crafting specific prompts that the AI interprets as system instructions, malicious actors can trick the model into retrieving and exfiltrating sensitive internal data without the user's knowledge.
- AdMob Settlement: In broader SaaS news, Google has agreed to pay USD $8.25 million (approx. AUD $13 million) to settle allegations that its AdMob platform illegally tracked children’s data, violating privacy norms—a critical reminder for EdTech and SaaS providers handling minor's data.
Critical Vulnerabilities: Web Apps & IoT
The last 24 hours have underscored the criticality of patching, with active exploitation observed in workflow automation and network devices.
n8n Workflow Automation (CVE-2026-21858): A critical Unauthenticated Remote Code Execution (RCE) vulnerability has been identified in the n8n platform.
- Severity: Critical (CVSS 10.0).
- Attack Vector: Attackers can execute arbitrary code on the underlying server via form-based workflows without needing valid credentials.
- Action: SaaS providers and businesses using n8n for automation must apply the latest patches immediately or restrict public access to these instances.
WatchGuard Firebox (CVE-2025-14733): The Australian Signals Directorate’s ACSC continues to warn of active exploitation of this critical vulnerability. It affects small to medium businesses and government networks relying on WatchGuard devices for perimeter security.
Healthcare & Education: Sector-Specific Threats
- Healthcare: The sector remains under fire, with Diabetes WA identified as the latest victim in a string of attacks against Australian health organisations. This follows the trend of ransomware groups targeting patient data for extortion.
- Education: Reports are emerging regarding the fallout of a cyber attack on Victorian schools, with concerns raised about the exposure of student data and the resilience of EdTech platforms used in the state's curriculum.
Strategic Advice
The emergence of AI-specific attacks like the Copilot 'Reprompt' and the severity of the n8n RCE demonstrates that threat actors are rapidly pivoting to exploit the tools that drive modern business efficiency. Australian organisations must move beyond basic compliance and stress-test their controls against these advanced techniques.
Contact us for a quote for penetration testing service or adversary simulation.
Daily Threat Briefing: Australia - 17 January 2026
The Australian cyber threat landscape remains volatile this weekend following a chaotic 48 hours. Security teams across the country are currently responding to a major breach affecting the Victorian education sector and managing the fallout from critical vulnerabilities in Microsoft Windows and workflow automation tools.
Executive Summary
The Australian cyber threat landscape remains volatile this weekend following a chaotic 48 hours. Security teams across the country are currently responding to a major breach affecting the Victorian education sector and managing the fallout from critical vulnerabilities in Microsoft Windows and workflow automation tools.
For Saturday, 17 January 2026, our analysts are highlighting active exploitation of a Windows zero-day (CVE-2026-20805), a critical RCE in the n8n automation platform affecting SaaS providers, and continued data leakage risks in the healthcare sector.
Top Story: Victorian Schools Data Breach
In a significant blow to the Education/EdTech sector, the Victorian Department of Education confirmed yesterday (16 January) that a cyber attack has compromised data across 1,700 government schools. Threat actors gained unauthorised access to a database containing personal information of current and former students, including names and email addresses.
- Impact: While passwords have been reset, the exposure of student contact details creates a long-term risk of targeted phishing and identity fraud.
- Recommendation: Education providers must urgently review third-party access controls and enforce Multi-Factor Authentication (MFA) on all parent and student portals.
Critical Vulnerability Alerts
1. Microsoft Windows "Desktop Window Manager" Zero-Day (CVE-2026-20805)
- Severity: Critical (Active Exploitation Confirmed)
- Sector Impact: Government, FinTech, Corporate Enterprise
- Details: A privilege escalation vulnerability in the Desktop Window Manager (DWM) is being actively exploited in the wild. Attackers are using this to gain 'SYSTEM' privileges on compromised workstations, often as a second stage after initial access.
- Action: Immediate patching of the January 2026 "Patch Tuesday" updates is mandatory. Prioritise high-value workstations in finance and government networks.
2. n8n Workflow Automation RCE (CVE-2026-21858)
- Severity: Critical (CVSS 9.8)
- Sector Impact: SaaS Providers, FinTech, Startups
- Details: A remote code execution (RCE) flaw in the popular n8n workflow automation tool allows unauthenticated attackers to take full control of self-hosted instances. Many Australian FinTechs use n8n to glue together APIs and backend services.
- Action: Isolate n8n instances from the public internet immediately and apply the latest vendor patches.
Sector-Specific Intelligence
FinTech & Insurance: The Prosura data breach (confirmed 14 January) continues to escalate, with reports that stolen data (affecting ~300,000 customers) is now being actively traded on dark web forums. Financial institutions should be on high alert for customers being targeted by "vishing" (voice phishing) attacks using the leaked policy data to build credibility.
Healthcare: The "MongoBleed" vulnerability (CVE-2025-14847) remains a persistent threat. We are observing automated botnets scanning Australian IP ranges for unpatched MongoDB instances, specifically targeting eHealth applications. Attackers are exfiltrating unstructured patient data without needing authentication.
eCommerce: Retailers are urged to audit their session storage mechanisms. The recent Microsoft Word RCE (CVE-2026-20944) is being weaponised in phishing campaigns targeting retail employees, disguised as "Invoice" or "Order Query" attachments. Exploitation occurs simply via the Preview Pane—no click is required.
IoT & Edge Security: Organisations using WatchGuard Firebox devices at network edges must verify they have patched CVE-2025-14733. We have detected scanning activity originating from compromised IoT botnets attempting to exploit this flaw to breach corporate perimeters.
Analyst's Comment
The convergence of a Microsoft zero-day and a critical SaaS infrastructure flaw (n8n) creates a "perfect storm" for weekend attacks. Ransomware groups are known to accelerate operations during off-hours. We strongly advise Australian organisations to maintain heightened monitoring on outbound traffic and privileged account usage over the next 48 hours.
Contact us for a quote for penetration testing service or adversary simulation.
Daily Threat Briefing: Critical n8n RCE, Microsoft Zero-Days & Prosura Breach
The Australian cyber threat landscape has seen a significant surge in activity over the last 24 hours. Critical alerts have been issued for widely used workflow automation platforms and cloud infrastructure, placing SaaS providers, government agencies, and FinTech organisations on high alert.
Executive Summary
The Australian cyber threat landscape has seen a significant surge in activity over the last 24 hours. Critical alerts have been issued for widely used workflow automation platforms and cloud infrastructure, placing SaaS providers, government agencies, and FinTech organisations on high alert.
Our analysis for today highlights a critical unauthenticated Remote Code Execution (RCE) in the n8n platform, the fallout from Microsoft’s January Patch Tuesday involving actively exploited Hyper-V zero-days, and a confirmed breach affecting Australian insurance provider Prosura.
Top Priority: Critical n8n Workflow Automation RCE
Target: SaaS Providers, API Integrators, FinTech Vulnerability: CVE-2026-21858 (Critical)
The Australian Cyber Security Centre (ACSC) and global threat intelligence firms have flagged active exploitation of a critical vulnerability in the n8n workflow automation platform.
- The Threat: CVE-2026-21858 allows unauthenticated threat actors to execute arbitrary code on the underlying server via malformed form-based workflows.
- Impact: As n8n is often used to glue together disparate APIs and handle sensitive data pipelines (FinTech data, customer details), a compromise here effectively grants attackers the "keys to the kingdom," allowing lateral movement into connected cloud services.
- Action: Organisations using n8n must isolate instances immediately and apply the latest hotfix.
Sector Watch: Key Incidents & Trends
FinTech & eCommerce: Prosura Data Breach
Australian rental car insurance provider Prosura has confirmed a significant cyber incident resulting in unauthorised access to customer data.
- Details: Threat actors accessed internal IT systems, exposing driver's licences and policy documents. The attackers also utilised the compromised infrastructure to send fraudulent emails to customers.
- Response: Prosura has paused its online self-service portal while forensic investigations continue.
- Takeaway: This incident underscores the growing trend of "island hopping"—where attackers compromise a trusted service provider to launch phishing campaigns against its user base from a legitimate domain.
Government & Cloud Infrastructure: Microsoft Patch Tuesday Fallout
Following the January Patch Tuesday (13 Jan), security teams across the Australian Government and enterprise sectors are racing to patch eight zero-day vulnerabilities.
- Critical Focus: CVE-2025-21333, CVE-2025-21334, and CVE-2025-21335 are actively exploited Privilege Escalation vulnerabilities in Windows Hyper-V.
- Risk: These flaws allow an attacker with a foothold on a guest virtual machine to escape the sandbox and gain SYSTEM privileges on the host server. This is a "Code Red" risk for private cloud providers and government data centres relying on virtualised environments.
AI Systems: Open WebUI Code Injection
As AI adoption accelerates in Education and EdTech, a new vulnerability has emerged in Open WebUI (formerly Ollama WebUI), a popular self-hosted interface for LLMs.
- Vulnerability: CVE-2025-64496 permits remote code injection via the 'Direct Connection' feature.
- Risk: Attackers can hijack the AI interface to execute commands on the host, potentially poisoning models or exfiltrating proprietary training data.
Healthcare & IoT: WatchGuard & Trend Micro Alerts
- Network IoT: A critical vulnerability in WatchGuard Firebox devices (CVE-2025-14733) is seeing active exploitation. Healthcare clinics using these appliances for edge security are urged to update firmware immediately to prevent perimeter breaches.
- Security Management: Trend Micro Apex Central has patched a critical RCE (CVE-2025-69258) that allows attackers to execute code as SYSTEM without user interaction.
Threat Actor Activity
- Medusa Ransomware: The group remains highly active in the region, recently claiming attacks on non-profits and healthcare adjacents. Their tactics continue to involve double extortion—encrypting data and threatening to leak sensitive medical records.
- Crimson Collective: Following the Brightspeed breach, this group is showing increased aggression towards telecommunications and infrastructure targets.
Recommendations
- Patch n8n and Hyper-V: These are the most volatile vectors currently being exploited in the wild.
- Review Third-Party Risk: With the Prosura incident, verify the security posture of insurance and API partners.
- Secure AI Workloads: Ensure self-hosted AI tools like Open WebUI are not exposed to the public internet without strict access controls.
Contact us for a quote for penetration testing service or adversary simulation.