Daily Threat Briefing: Australia – 28 January 2026

Executive Summary

The Australian cyber threat landscape over the last 24 hours has been dominated by a significant data breach within the Victorian education sector and the emergency disclosure of critical vulnerabilities affecting widespread enterprise tools. Threat actors are actively exploiting zero-day vulnerabilities in Microsoft Office and Zoom, while a new supply chain attack targeting developers using AI tools has been uncovered. Australian organisations, particularly in Government, Education, and FinTech, must prioritise patching and threat hunting immediately.

Local Impact: Victorian Education Sector Breach

Victorian Department of Education Hit by Major Data Breach A significant incident has been confirmed involving the Victorian Department of Education, impacting approximately 1,700 government schools. Unauthorised third-party access has compromised the personal information of current and former students.

• Impact: Loss of PII (Personally Identifiable Information) creating heightened risk of identity theft and targeted phishing scams against students and families.
• Action: Educational institutions should be on high alert for follow-on social engineering attacks. Parents and staff should be warned to scrutinise unsolicited communications purportedly from the Department or schools.

Critical Vulnerabilities & Global Threats

1. Microsoft Office Zero-Day (CVE-2026-21509)

• Severity: Critical
• Status: Active Exploitation / Emergency Patch Issued (27 Jan 2026)
• Details: A remote code execution (RCE) vulnerability in Microsoft Office is being actively exploited in the wild. The flaw allows attackers to execute arbitrary code via specially crafted documents, often delivered via phishing emails.
• Recommendation: Apply the emergency patch immediately. Ensure EDR solutions are tuned to detect abnormal Office process behaviour.

2. Zoom Node Multimedia Routers RCE (CVE-2026-22844)

• Severity: Critical
• Details: A command injection flaw in Zoom Node Multimedia Routers (used in Meeting Connector and Hybrid deployments) allows for remote code execution.
• Relevance: High for organisations hosting on-premise or hybrid Zoom infrastructure.
• Recommendation: Update to version 5.2.1716.0 or later immediately.

3. Fortinet SSO Authentication Bypass (CVE-2025-59718/59719 Variant)

• Status: Active Exploitation of Patched Devices
• Details: Threat intelligence indicates active exploitation of a FortiCloud SSO authentication bypass, even on devices believed to be fully patched. Attackers are using crafted SAML messages to create persistent accounts and enable VPN access.
• Recommendation: Review audit logs for suspicious SAML assertions and anomalous VPN logins. Consider temporarily disabling SSO if suspicious activity is detected until further vendor guidance is clarified.

Emerging Trends: AI & Supply Chain Attacks

Malicious VS Code AI Extensions Cybersecurity researchers have identified two malicious Visual Studio Code extensions masquerading as AI coding assistants: "ChatGPT - 中文版" and "ChatGPT - ChatMoss".

• Threat: These extensions, with over 1.5 million combined installs, contain backdoor functionality that siphons source code and developer environment data to servers located in China.
• Sector Risk: High for SaaS Providers, FinTech, and DevOps teams where proprietary code is the crown jewel.
• Action: Audit developer environments for these extensions immediately and block their IDs (whensunset.chatgpt-china, zhukunpeng.chat-moss).

Sector-Specific Intelligence

• Healthcare: The Australian Signals Directorate (ASD) continues to report a surge in ransomware targeting healthcare providers, with incidents doubling compared to the previous period. Threat actors are leveraging the chaos of recent breaches to launch extortion campaigns.
• Government: The NSW Government is rolling out a new framework to make AI risk assessments less subjective. Agencies deploying AI tools must now undergo rigorous testing for bias and security vulnerabilities before deployment.
• IoT: With the exploitation of edge devices like Fortigate and Zoom routers, organisations must treat IoT and edge appliances as high-risk entry points. Ensure strict network segmentation is in place to prevent lateral movement.

Analyst’s Take

The breach in Victoria serves as a stark reminder that the education sector remains a soft target with high-value data. However, the technical sophistication seen in the Fortinet bypass and the malicious VS Code extensions indicates that threat actors are moving deeper into the supply chain and infrastructure layer. Defensive teams must look beyond the perimeter and scrutinise the tools their developers and remote workforce rely on daily.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Australia – 27 January 2026

The Australian cyber threat landscape has intensified significantly over the last 24 hours, with critical developments impacting the healthcare, retail, and SaaS sectors. Today’s briefing highlights a new zero-day exploit in Microsoft Office, a confirmed breach at a major fertility provider, and the emergence of "World Leaks" targeting global brands with Australian operations.

Top Priority: Critical Vulnerability Alerts

Microsoft Office Zero-Day (CVE-2026-21509) In the last 24 hours, Microsoft has issued emergency guidance for a high-severity zero-day vulnerability (CVE-2026-21509) currently being exploited in the wild. This flaw allows attackers to bypass security features locally by leveraging untrusted inputs in Office files.

• Impact: User interaction is required (opening a malicious file), but successful exploitation can lead to code execution.
• Action: Organisations must apply the out-of-band patch immediately, particularly for Office 2021 and Microsoft 365. Temporary registry mitigations are available for older versions.

ServiceNow AI "BodySnatcher" Vulnerability A severe privilege escalation flaw has been discovered in ServiceNow’s Now Assist AI agents. Dubbed "BodySnatcher", this vulnerability allows unauthenticated attackers to hijack AI workflows and create administrative backdoors. As Australian enterprises race to adopt AI-driven SaaS tools, this serves as a stark warning to audit AI permissions rigorously.

Sector Intelligence & Incidents

Healthcare: Genea Data Breach Confirmed

Australia’s healthcare sector continues to be a primary target. Genea, a leading fertility and IVF provider, has confirmed a cyber attack resulting in the exfiltration of sensitive patient data.

• Status: Stolen records have reportedly appeared on the dark web.
• Analysis: This incident follows a disturbing trend of extortion-based attacks on specialist medical clinics in Australia (e.g., the Point Lonsdale and O&G incidents late last year). The sensitivity of the data makes extortion attempts highly likely.

Retail & eCommerce: Nike Investigating "World Leaks" Claims

Global sportswear giant Nike is investigating claims by the "World Leaks" ransomware gang, who allege they have stolen 1.4TB of internal data. While the full impact on Australian customers is being assessed, this group is known for shifting from encryption to pure data-theft extortion.

• Risk: Potential exposure of customer PII and partner supply chain data.

Education: Fallout from Victorian Schools Attack

The education sector remains on high alert following the Victorian Department of Education breach earlier this month, which impacted over 1,700 government schools.

• Update: Forensic analysis suggests the initial vector involved compromised staff credentials. Educational institutions are urged to accelerate the rollout of phishing-resistant Multi-Factor Authentication (MFA) to prevent lateral movement.

FinTech: Regulatory Heat & Data Leaks

• Airwallex Audit: The Australian Transaction Reports and Analysis Centre (AUSTRAC) has ordered an external audit of FinTech unicorn Airwallex over suspected AML/CTF compliance failures. This signals a tougher regulatory stance on the FinTech sector’s risk management practices.
• Prosura Breach: Fallout continues from the Prosura (car rental insurance) breach, where 300,000 customer records were exposed. Attackers are actively selling this data, increasing the risk of targeted phishing campaigns against policyholders.

IoT & Edge Security

• WatchGuard Firebox Exploitation: Active exploitation of a critical vulnerability (CVE-2025-14733) in WatchGuard Firebox devices continues. Attackers are using this to gain initial access to small-to-medium business networks.
• Konni Threat Actor: New intelligence indicates the North Korean-linked threat actor Konni is targeting blockchain developers in Australia. The group is using malicious project documentation and AI-generated PowerShell backdoors to compromise development environments.

Summary & Recommendations

The last 24 hours have demonstrated that no sector is immune. From AI-driven SaaS vulnerabilities to zero-day exploits in ubiquitous office software, the attack surface is expanding.

Immediate Actions:

1. Patch Microsoft Office across all endpoints immediately.
2. Audit AI Integrations (specifically ServiceNow) for privilege escalation risks.
3. Monitor Vendor Risk, particularly if your organisation interacts with Genea or Nike.
4. Reinforce DevSecOps, especially for blockchain and FinTech teams targeted by state-sponsored actors like Konni.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Australia Day Cyber Risks, Active RCEs & EdTech Fallout

Executive Summary As the nation observes Australia Day, the cyber threat landscape over the last 24 hours has been anything but quiet. While many organisations are operating with skeleton staff due to the public holiday, threat actors are actively leveraging this window to exploit critical vulnerabilities in widely used infrastructure. Our analysts have observed a convergence of physical and digital threats, with heightened hacktivist chatter targeting government entities and continued fallout from the massive Victorian education sector breach.

For today’s briefing, we are issuing urgent alerts for Healthcare, Education, and Government sectors, alongside critical patch warnings for Cisco and Windows environments.

---

Sector-Specific Threat Intelligence

🏛️ Government & Critical Infrastructure

• Australia Day Hacktivism: We have detected increased chatter on dark web forums and Telegram channels encouraging DDoS and defacement campaigns against Australian government portals today. This aligns with historical trends of national holiday targeting.
• The "Salt Typhoon" Threat: Assessing the last 24 hours of telemetry, the China-backed APT group identified as Salt Typhoon is aggressively targeting authentication weaknesses in Ivanti Connect Secure gateways. They are leveraging the recently disclosed authentication bypass vulnerabilities (CVE-2025-0282) to gain initial access. Security teams should be on high alert for anomalous login activity, particularly from non-Australian IP addresses.

🎓 Education & EdTech

• Victorian Schools Breach Fallout: The ripple effects of the Victorian Department of Education data breach (confirmed mid-January) continue to widen. Over the weekend, fresh datasets appearing to contain student contact details and parent email addresses have surfaced on breach forums.
• SaaS Supply Chain Risk: EdTech platforms utilising the n8n workflow automation tool must urgently verify they have patched CVE-2026-21858. We have observed automated scanning for unpatched instances of this tool, which allow for Remote Code Execution (RCE).

🏥 Healthcare & IoT

• "MongoBleed" Resurgence (CVE-2025-14847): A new wave of attacks targeting unpatched MongoDB instances has been identified, specifically aiming at eHealth applications and IoT medical device gateways. Attackers are exfiltrating unstructured patient data.
• IoT Device Gateways: With the holiday reducing on-site staff, IoT monitoring systems in hospitals are prime targets. Ensure segmentation is strictly enforced to prevent lateral movement from compromised smart devices to patient record systems.

💳 FinTech & eCommerce

• Session Hijacking Campaigns: Retailers running extended Australia Day sales are being targeted by sophisticated phishing campaigns weaponising a new Microsoft Word RCE (CVE-2026-20944). These emails often masquerade as "Urgent Invoice" or "Order Query" attachments.
• Cisco UC Exploitation: FinTech firms relying on Cisco Unified Communications (UC) for internal comms need to patch CVE-2026-20045 immediately. This RCE flaw (CVSS 8.2) is being exploited in the wild to gain root privileges on unpatched systems.

---

Vulnerability Watch: The "Must-Patch" List

Security teams should prioritise the following vulnerabilities, which have seen active exploitation in the Australian region within the last 24 hours:

1. Cisco Unified Communications (CVE-2026-20045):

   • Type: Remote Code Execution (RCE).
   • Status: Active exploitation. Added to CISA KEV.
   • Action: Patch immediately. No workarounds available.

2. Microsoft Windows "DWM" (CVE-2026-20805):

   • Type: Privilege Escalation (to SYSTEM).
   • Target: Corporate workstations and government endpoints.
   • Status: Exploited in the wild as a post-compromise escalation tool.

3. Ivanti Connect Secure (CVE-2025-0282):

   • Type: Authentication Bypass / RCE.
   • Target: VPN Gateways.
   • Status: Critical. Being weaponised by ransomware groups like Qilin.

---

Analyst Comment

The convergence of a public holiday with critical RCE vulnerabilities creates a "perfect storm" for defenders. The reduced staffing levels today mean detection times may be slower, giving adversaries a larger window to establish persistence. We strongly recommend that SOC teams maintain heightened vigilance and that on-call engineers are prepared to mobilise for out-of-band patching of the Cisco and Windows flaws.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Airwallex Under Scrutiny, Copilot AI Vulnerability & Critical SaaS RCEs

The Australian cyber threat landscape has seen significant activity over the last 24 hours, with major developments across the FinTech and SaaS sectors. From regulatory crackdowns on financial platforms to novel attacks targeting AI systems, organisations must remain vigilant. Below is a deep dive into the most critical threats, exploited vulnerabilities, and industry updates relevant to Australian businesses today.

FinTech: Airwallex Audited by AUSTRAC

In a major development for the FinTech sector, the Australian Transaction Reports and Analysis Centre (AUSTRAC) has ordered an external audit of payment platform Airwallex. Announced yesterday (23 January), the regulator suspects compliance failures regarding Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) laws.

• The Risk: AUSTRAC is concerned that Airwallex’s transaction monitoring program has not adequately kept pace with the risks associated with its cross-border fund transfers.
• Impact: This highlights the increasing regulatory pressure on Australian FinTechs to robustly define their customer base and report suspicious matters. Financial institutions should review their own AML/CTF controls immediately to avoid similar scrutiny.

AI & SaaS Systems: The 'Reprompt' Attack on Copilot

As AI integration deepens, so do the attack vectors. Security researchers have unveiled a new "Reprompt" attack targeting Microsoft Copilot.

• The Exploit: This sophisticated technique allows attackers to silently siphon data from Copilot sessions. By crafting specific prompts that the AI interprets as system instructions, malicious actors can trick the model into retrieving and exfiltrating sensitive internal data without the user's knowledge.
• AdMob Settlement: In broader SaaS news, Google has agreed to pay USD $8.25 million (approx. AUD $13 million) to settle allegations that its AdMob platform illegally tracked children’s data, violating privacy norms—a critical reminder for EdTech and SaaS providers handling minor's data.

Critical Vulnerabilities: Web Apps & IoT

The last 24 hours have underscored the criticality of patching, with active exploitation observed in workflow automation and network devices.

• n8n Workflow Automation (CVE-2026-21858): A critical Unauthenticated Remote Code Execution (RCE) vulnerability has been identified in the n8n platform.

  • Severity: Critical (CVSS 10.0).
  • Attack Vector: Attackers can execute arbitrary code on the underlying server via form-based workflows without needing valid credentials.
  • Action: SaaS providers and businesses using n8n for automation must apply the latest patches immediately or restrict public access to these instances.

• WatchGuard Firebox (CVE-2025-14733): The Australian Signals Directorate’s ACSC continues to warn of active exploitation of this critical vulnerability. It affects small to medium businesses and government networks relying on WatchGuard devices for perimeter security.

Healthcare & Education: Sector-Specific Threats

• Healthcare: The sector remains under fire, with Diabetes WA identified as the latest victim in a string of attacks against Australian health organisations. This follows the trend of ransomware groups targeting patient data for extortion.
• Education: Reports are emerging regarding the fallout of a cyber attack on Victorian schools, with concerns raised about the exposure of student data and the resilience of EdTech platforms used in the state's curriculum.

Strategic Advice

The emergence of AI-specific attacks like the Copilot 'Reprompt' and the severity of the n8n RCE demonstrates that threat actors are rapidly pivoting to exploit the tools that drive modern business efficiency. Australian organisations must move beyond basic compliance and stress-test their controls against these advanced techniques.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Australia - 17 January 2026

Executive Summary

The Australian cyber threat landscape remains volatile this weekend following a chaotic 48 hours. Security teams across the country are currently responding to a major breach affecting the Victorian education sector and managing the fallout from critical vulnerabilities in Microsoft Windows and workflow automation tools.

For Saturday, 17 January 2026, our analysts are highlighting active exploitation of a Windows zero-day (CVE-2026-20805), a critical RCE in the n8n automation platform affecting SaaS providers, and continued data leakage risks in the healthcare sector.

Top Story: Victorian Schools Data Breach

In a significant blow to the Education/EdTech sector, the Victorian Department of Education confirmed yesterday (16 January) that a cyber attack has compromised data across 1,700 government schools. Threat actors gained unauthorised access to a database containing personal information of current and former students, including names and email addresses.

• Impact: While passwords have been reset, the exposure of student contact details creates a long-term risk of targeted phishing and identity fraud.
• Recommendation: Education providers must urgently review third-party access controls and enforce Multi-Factor Authentication (MFA) on all parent and student portals.

Critical Vulnerability Alerts

1. Microsoft Windows "Desktop Window Manager" Zero-Day (CVE-2026-20805)

• Severity: Critical (Active Exploitation Confirmed)
• Sector Impact: Government, FinTech, Corporate Enterprise
• Details: A privilege escalation vulnerability in the Desktop Window Manager (DWM) is being actively exploited in the wild. Attackers are using this to gain 'SYSTEM' privileges on compromised workstations, often as a second stage after initial access.
• Action: Immediate patching of the January 2026 "Patch Tuesday" updates is mandatory. Prioritise high-value workstations in finance and government networks.

2. n8n Workflow Automation RCE (CVE-2026-21858)

• Severity: Critical (CVSS 9.8)
• Sector Impact: SaaS Providers, FinTech, Startups
• Details: A remote code execution (RCE) flaw in the popular n8n workflow automation tool allows unauthenticated attackers to take full control of self-hosted instances. Many Australian FinTechs use n8n to glue together APIs and backend services.
• Action: Isolate n8n instances from the public internet immediately and apply the latest vendor patches.

Sector-Specific Intelligence

• FinTech & Insurance: The Prosura data breach (confirmed 14 January) continues to escalate, with reports that stolen data (affecting ~300,000 customers) is now being actively traded on dark web forums. Financial institutions should be on high alert for customers being targeted by "vishing" (voice phishing) attacks using the leaked policy data to build credibility.

• Healthcare: The "MongoBleed" vulnerability (CVE-2025-14847) remains a persistent threat. We are observing automated botnets scanning Australian IP ranges for unpatched MongoDB instances, specifically targeting eHealth applications. Attackers are exfiltrating unstructured patient data without needing authentication.

• eCommerce: Retailers are urged to audit their session storage mechanisms. The recent Microsoft Word RCE (CVE-2026-20944) is being weaponised in phishing campaigns targeting retail employees, disguised as "Invoice" or "Order Query" attachments. Exploitation occurs simply via the Preview Pane—no click is required.

• IoT & Edge Security: Organisations using WatchGuard Firebox devices at network edges must verify they have patched CVE-2025-14733. We have detected scanning activity originating from compromised IoT botnets attempting to exploit this flaw to breach corporate perimeters.

Analyst's Comment

The convergence of a Microsoft zero-day and a critical SaaS infrastructure flaw (n8n) creates a "perfect storm" for weekend attacks. Ransomware groups are known to accelerate operations during off-hours. We strongly advise Australian organisations to maintain heightened monitoring on outbound traffic and privileged account usage over the next 48 hours.

Contact us for a quote for penetration testing service or adversary simulation.