Daily Threat Briefing: Australia – 12 February 2026

Executive Summary

The Australian cyber threat landscape for the last 24 hours has been dominated by a concerning breach of the national Early Warning Network (EWN) and a historic regulatory penalty in the FinTech sector. These events signal a shift from pure data theft to systemic disruption and regulatory accountability. Simultaneously, technical teams must urgently address critical vulnerabilities in AI agents and workflow automation tools that are being actively exploited in the wild.

Here is your deep dive into the threats impacting Australian organisations over the last 24 hours.

Sector Spotlight

Government & Critical Infrastructure: Trust Under Fire In a disturbing development confirmed yesterday (11 February), the Early Warning Network (EWN)—used by councils and emergency services to alert Australians to disasters—suffered a security breach. Threat actors gained unauthorised access to the broadcasting portal, sending false alerts to a subset of subscribers. While EWN officials state that only "white page" data (names and addresses) was accessed, the incident highlights a critical vulnerability in our national notification infrastructure. The ability for adversaries to hijack trusted communication channels poses a severe risk to public safety and trust.

FinTech: A $2.5 Million Warning The Federal Court has handed down a landmark penalty against fixed-income specialist FIIG Securities, ordering them to pay $2.5 million for cybersecurity failures related to a 2023 breach. This is the first time civil penalties have been applied purely for cyber resilience failures under Australian Financial Services (AFS) licence obligations. The court cited a lack of multi-factor authentication (MFA) and inadequate incident response testing. Key Takeaway: For Australian FinTechs, "tick-box" compliance is dead. The ASIC 2026 Outlook, released last week, explicitly flags "Agentic AI" fraud as the next frontier, warning that autonomous AI agents could be manipulated to authorise fraudulent transactions.

Healthcare: Psychological Warfare Epworth HealthCare remains in a standoff with the 0APT ransomware gang, which claims to have exfiltrated 920GB of sensitive surgical and billing records. As of today, Epworth maintains there is "no verified evidence" of the breach, suggesting this may be a "phantom" extortion attempt—a growing tactic where gangs bluff to force a payout. This follows the MediSecure fallout, reinforcing the immense pressure on the sector.

Education: The Long Tail of Breach The Victorian Department of Education is managing the escalating fallout of a massive breach confirmed in January, now known to impact all 1,700 government schools. Additionally, Loyola College is dealing with a confirmed ransomware attack by the Interlock gang, who have leaked nearly 600GB of data, including student passports, to the dark web.

Vulnerability Watch: What to Patch Now

1. AI Systems: OpenClaw 1-Click RCE (CVE-2026-25253) A critical vulnerability has been disclosed in OpenClaw (formerly Moltbot), a popular open-source AI agent used by developers. The flaw allows unauthenticated remote code execution (RCE) via a single malicious link.

• Risk: Attackers can steal authentication tokens and hijack the AI agent to execute commands on the host machine.
• Status: Active exploitation observed. Patch immediately to version 2026.1.29 or later.

2. SaaS & Cloud: Microsoft Office Zero-Day (CVE-2026-21509) Microsoft has issued an out-of-band patch for a "Security Feature Bypass" vulnerability in Office 365 and Office 2019/2021.

• Risk: Allows attackers to bypass the "Mark of the Web" and Protected View, enabling malicious macros to run without user warning.
• Intel: This is being actively exploited by state-sponsored actor APT28 (Fancy Bear) in campaigns targeting government and critical sectors.

3. Workflow Automation: n8n RCE (CVE-2026-21858) A critical RCE vulnerability in n8n, a workflow automation tool used to glue together SaaS apps, is being targeted. If you self-host n8n, ensure it is behind a VPN or strictly authenticated, as it often holds API keys for your entire SaaS stack (Salesforce, Slack, Google Workspace).

Strategic Outlook

The events of the last 24 hours confirm that we are entering an era of "Cyberthuggery"—where disruption and psychological pressure (as seen with Epworth and EWN) are becoming as valuable to attackers as data theft. With the launch of the Essential Eight Certification service yesterday, organisations have a new mechanism to prove their resilience, but compliance must be backed by genuine defensive depth.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: National Alert System Compromised, Landmark FinTech Penalty & New AI Workflow RCE

Executive Summary

In the last 24 hours, the Australian cyber security landscape has been dominated by a concerning breach of the national Early Warning Network and a historic regulatory penalty in the FinTech sector. Simultaneously, technical teams must urgently address critical vulnerabilities in workflow automation tools that power many modern SaaS and AI integrations.

---

Government & Critical Infrastructure: Early Warning Network Breach

Sector: Government / Critical Infrastructure Threat: System Compromise / Social Engineering

Yesterday, the Early Warning Network (EWN)—a critical system used by local councils and government agencies to alert Australians of natural disasters—was compromised. Unauthorised messages were broadcast to subscribers, falsely warning that their data was unsafe.

While EWN officials have stated that only "white page" data (names and addresses) may have been accessed, the incident highlights a severe vulnerability in IoT and notification infrastructure. The ability for threat actors to hijack a trusted emergency communication channel causes confusion and erodes public trust.

• Key Takeaway: Agencies must enforce stricter access controls (MFA) on broadcasting portals and audit third-party integrators who have API access to alert systems.

FinTech: A $2.5 Million Warning Shot

Sector: FinTech / Financial Services Impact: Regulatory Enforcement

In a landmark decision handed down yesterday, the Federal Court ordered FIIG Securities to pay a $2.5 million penalty for cyber security failures. This is the first time civil penalties have been applied for such failures under Australian Financial Services (AFS) licence obligations.

The penalty stems from a breach where FIIG failed to implement adequate controls, allowing threat actors to access sensitive client data.

• Key Takeaway: For FinTechs, security is no longer just an IT issue; it is a regulatory compliance mandate. The "reasonable steps" defence now requires demonstrable, mature security frameworks, not just policies on paper.

Education: Fallout from Victorian Schools Breach

Sector: Education / EdTech Threat: Third-Party Risk

The sector continues to reel from the Victorian Department of Education breach confirmed late last month, where third-party access compromised student data across 1,700 schools. New reports indicate that the initial entry point was a trusted vendor account with excessive privileges.

• Key Takeaway: EdTech providers must adopt "least privilege" access models. Schools should urgently review all external vendor accounts and revoke access for inactive or non-essential third parties.

Technical Focus: Web Apps, APIs & AI Systems

Critical RCE in n8n (CVE-2026-21858)

Target: SaaS / AI Automation Severity: Critical (CVSS 10.0)

A critical Unauthenticated Remote Code Execution (RCE) vulnerability has been identified in n8n, a popular workflow automation tool used extensively to glue together SaaS platforms and AI agents.

• The Risk: Threat actors can exploit this to execute arbitrary code on the server hosting the n8n instance. given n8n's role in handling API keys for services like OpenAI, Slack, and Salesforce, a compromise here is equivalent to handing over the keys to your entire SaaS estate.
• Action: Patch immediately. If you are using self-hosted n8n instances, ensure they are not exposed to the public internet without strict VPN/Auth layers.

Legacy Edge Devices Under Siege

Target: IoT / Network Infrastructure

The ASD and CISA have issued a joint warning regarding the active exploitation of End-of-Support (EOS) edge devices (routers, firewalls, and load balancers). Nation-state actors are using these unpatchable devices to maintain persistent access to Australian networks.

• Action: Audit your network perimeter. If you are running hardware that no longer receives firmware updates, it must be decommissioned or isolated behind a secure gateway immediately.

---

Conclusion

The events of the last 24 hours reinforce a clear message: trusted systems—whether they are emergency alerts, third-party vendors, or legacy hardware—are prime targets. Organisations must move beyond perimeter defence and assume that trusted channels can be subverted.

Contact us for a quote for penetration testing service or adversary simulation.

Australia Daily Cyber Threat Briefing: FIIG’s $2.5m Penalty, School Data Fallout & The Rise of 'Shadow AI'

Executive Summary

The Australian cyber threat landscape for the last 24 hours has been dominated by a landmark regulatory ruling in the FinTech sector and escalating extortion campaigns targeting education and healthcare. The Federal Court’s decision to impose a $2.5 million penalty on FIIG Securities sets a new precedent for governance failures, signalling that "tick-box compliance" is no longer a viable defence.

Simultaneously, the sheer scale of the Victorian Department of Education breach (impacting over 665,000 students) and the weaponisation of open-source AI agents like OpenClaw highlight the expanding attack surface facing Australian organisations.

---

Sector-Specific Updates

FinTech & Financial Services

Headline: FIIG Securities Hit with Historic $2.5m Penalty In a defining moment for Australian corporate responsibility, the Federal Court has ordered fixed-income specialist FIIG Securities to pay a $2.5 million penalty following action by ASIC.

• The Incident: The penalty stems from a 2023 breach where threat actors stole 385GB of sensitive client data, including passports and tax file numbers.
• The Ruling: The Court found FIIG failed to implement adequate cyber security measures, specifically noting a lack of multi-factor authentication (MFA), insufficient staff training, and a failure to test incident response plans.
• Takeaway: This is the first time civil penalties have been applied purely for cyber resilience failures under Australian Financial Services Licence (AFSL) obligations. Boards must view this as a warning: inadequate resource allocation to security is now a direct legal liability.

Education & EdTech

Headline: Victorian Schools Breach Exposure Widens The fallout from the Victorian Department of Education breach continues to grow. Confirmed reports indicate the incident affects all 1,700 government schools in the state.

• Impact: Personal data of approximately 665,000 current and former students has been exposed. Compromised data includes names, school-issued emails, and encrypted passwords.
• Ransomware Escalation: In a separate but related trend, Loyola College is currently managing a ransomware attack by the Interlock gang, who have leaked nearly 600GB of data to the dark web.
• Risk: The exposure of student emails and passwords creates a long-term phishing risk, as these credentials are often reused across external platforms.

Healthcare

Headline: 0APT Gang Targets Epworth HealthCare The emerging 0APT ransomware group has claimed responsibility for an attack on Epworth HealthCare, alleging the exfiltration of 920GB of data, including surgical records and billing information.

• Status: While Epworth has stated there is currently "no verified evidence" of the data theft, this aligns with modern "pressure tactics" where gangs announce a breach before releasing proof-of-concept data to force negotiation.
• Trend: This follows the MediSecure collapse, reinforcing that healthcare providers remain the primary target for extortion-based attacks due to the critical nature of their uptime and data privacy.

AI Systems & Emerging Tech

Headline: 'Shadow AI' and the OpenClaw Threat A new vector has emerged involving OpenClaw (formerly Clawdbot), a popular open-source AI agent framework.

• The Threat: Security researchers have identified malicious "skills" in the ClawHub registry. Unsuspecting developers or employees installing these agents to automate tasks are inadvertently downloading malware, including the Atomic Stealer infostealer.
• Corporate Risk: This represents a dangerous "Shadow AI" problem where unvetted AI agents installed on corporate endpoints have broad terminal and disk access, bypassing traditional perimeter controls.

IoT (Internet of Things)

Headline: Countdown to March 4 Mandate With the mandatory cyber security standards for IoT devices coming into effect on 4 March 2026, organisations have less than a month to prepare.

• Requirement: The new rules ban default passwords (e.g., "admin/admin") and mandate vulnerability reporting mechanisms for all smart devices sold in Australia.
• Action: Businesses should audit their office networks for non-compliant "legacy" IoT devices (smart TVs, unmanaged printers) that may become liabilities or insurance gaps after the deadline.

---

Technical Spotlight: Critical Vulnerabilities

1. SmarterTools SmarterMail RCE (CVE-2026-24423)

• Severity: Critical (CVSS 9.3)
• Status: Added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 6 Feb 2026.
• Details: An unauthenticated Remote Code Execution (RCE) vulnerability exists in the ConnectToHub API. Attackers can send a specially crafted HTTP request to execute arbitrary commands with SYSTEM privileges.
• Recommendation: Patch immediately to Build 9511 or later. If patching is not possible, restrict access to the /api/v1/settings/sysadmin/connect-to-hub endpoint.

2. Notepad++ Supply Chain Compromise

• Threat: State-sponsored actors have been confirmed to have compromised the WinGUp updater mechanism for Notepad++.
• Impact: Users who updated the software between June and December 2025 may have pulled malicious binaries.
• Recommendation: Verify the digital signature of the notepad++.exe binary and perform a clean install from the official repository if any discrepancy is found.

---

Strategic Recommendations

1. Governance Review: In light of the FIIG penalty, review your cyber security budget and resource allocation. Ensure your Incident Response Plan (IRP) has been tested in the last 6 months.
2. AI Policy Enforcement: Update Acceptable Use Policies (AUP) to explicitly cover "Bring Your Own AI" (BYOAI). Block access to unverified AI agent registries like ClawHub on corporate networks.
3. Credential Hygiene: Given the education sector breaches, enforce a global password reset for any corporate accounts linked to .edu.au email addresses or potentially shared with school systems.

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: SmarterMail Zero-Day, Substack Breach & Healthcare Resilience

Executive Summary As we commence the week, the Australian cybersecurity landscape is dominated by active exploitation of a new vulnerability in the popular SmarterMail platform and a high-profile data disclosure involving Substack. Additionally, the healthcare sector sees a reprieve with the conclusion of the Epworth HealthCare investigation, though the threat level remains critical. This briefing covers the latest intelligence from the last 24-48 hours, essential for decision-makers in Healthcare, SaaS, and Government sectors.

1. Critical SaaS Vulnerability: SmarterMail Exploited in the Wild

Sector: SaaS, Government, Education Threat Level: Critical

Over the weekend, reports confirmed that a new vulnerability in SmarterTools’ SmarterMail is being actively exploited in the wild. SmarterMail, widely used by Australian SMEs and educational institutions for email hosting, has come under attack by threat actors leveraging this flaw to execute arbitrary code and gain persistence on mail servers.

• Impact: Unauthorised access to email communications, potential lateral movement into corporate networks, and data exfiltration.
• Action: Administrators using SmarterMail must verify their instances immediately. If a patch is available from the vendor, apply it instantly. If not, consider restricting external access to the webmail interface until mitigation advice is released.

2. Data Security: Substack Discloses Breach

Sector: SaaS, Media, Tech Threat Level: High

In a blow to the content platform economy, Substack has disclosed a significant data breach. The company's CEO confirmed the incident late last week, stating, "This sucks. I'm sorry." While specific details on the volume of Australian accounts affected are still surfacing, the breach highlights the persistent risk facing SaaS providers who aggregate massive amounts of user data.

• Risk: Exposure of subscriber emails, payment details (potentially), and private reading lists, which could be weaponised for targeted phishing campaigns.
• Action: Users are advised to change passwords and be vigilant against unsolicited emails mimicking Substack support.

3. Healthcare Update: Epworth HealthCare Investigation Concluded

Sector: Healthcare Threat Level: Moderate (De-escalated)

Following a ransomware scare that emerged earlier this month, Epworth HealthCare has completed its forensic investigation. The organisation announced it found no evidence that patient data was accessed or exfiltrated, despite claims made by hackers alleging the theft of 920GB of data.

• Analysis: This incident underscores the prevalence of "phantom claims" by ransomware groups attempting to extort victims without actual proof of compromise. However, the healthcare sector remains a prime target, and vigilance cannot be relaxed.

4. Retail & IoT: Bunnings Facial Recognition Ruling

Sector: eCommerce, Retail, IoT Threat Level: Regulatory/Compliance

A landmark ruling regarding Bunnings' use of facial recognition technology has sent shockwaves through the retail and IoT sectors. The Privacy Commissioner’s decision highlights the legal risks associated with deploying biometric surveillance IoT devices in consumer environments.

• Takeaway: Australian retailers and organisations using smart surveillance must review their data collection policies. The "collect first, ask later" approach is no longer viable under current privacy frameworks.

5. Emerging Trends: AI-Driven Cyber Threats

Sector: All (Focus on FinTech & EdTech)

Gartner’s latest "Top 2026 Cyber Security Trends" and recent alerts from the Australian Cyber Security Centre (ACSC) highlight a surge in AI-augmented attacks. Threat actors are now using Generative AI to craft hyper-realistic phishing emails and automate vulnerability scanning against APIs.

• Observation: We are seeing a rise in "Deepfake" social engineering attacks targeting legal and finance teams in Australian firms, aiming to authorise fraudulent fund transfers.

Key Vulnerabilities to Patch (Last 7 Days)

• SmarterMail: Zero-day (Immediate mitigation required).
• n8n Workflow Automation: CVE-2026-21858 (Critical RCE) – Ensure your automation workflows are behind a firewall or patched to the latest version.
• Ivanti Connect Secure: Ensure all January/February patches are applied as exploitation attempts persist.

---

Contact us for a quote for penetration testing service or adversary simulation.

Weekly Threat Briefing: Australia's Cyber Landscape (2–8 February 2026)

Executive Summary

The first week of February 2026 has seen a distinct escalation in targeted campaigns against Australian critical infrastructure and services. This week’s intelligence highlights a sophisticated pivot by threat actors towards human-led attacks on identity systems (SSO) and a resurgence of high-impact ransomware claims in the healthcare sector. Furthermore, critical vulnerabilities in widely used SaaS and collaboration tools demand immediate attention from security teams across the region.

Here is your deep dive into the threats impacting Australian organisations over the last 7 days.

Sector Spotlight

Healthcare: Ransomware Resurgence

The Australian healthcare sector remains in the crosshairs. On 5 February 2026, the Epworth HealthCare group was named as a victim by the emerging 0APT ransomware gang. The group claims to have exfiltrated 920GB of sensitive data, including surgical records and billing details. While Epworth has stated there is currently "no verified evidence" of the breach, this incident underscores the psychological pressure tactics increasingly used by adversaries to force negotiations. This follows closely on the heels of the MediSecure fallout, reinforcing the need for robust data segregation in medical environments.

Government & Education: Data Privacy Fallout

Public sector transparency is being tested this week. Fairfield City Council (NSW) formally published a data breach notification on 5 February 2026 regarding a cyber incident that occurred in late 2025. The investigation confirmed that unauthorised access led to the exposure of staff and resident information.

Simultaneously, the Victorian Department of Education is managing the aftermath of a major breach confirmed in January 2026, which impacted 1,700 schools. The sheer scale of these incidents highlights the "long-tail" effect of breaches in the public sector, where notification and remediation often lag behind the initial compromise.

SaaS & Cloud: Identity Under Siege

A new threat alliance dubbed "SLSH" (linking tactics from Scattered Spider, LAPSUS$, and ShinyHunters) has been observed targeting high-value enterprises, including Australian FinTechs. Their modus operandi involves human-led voice phishing (vishing) to bypass Multi-Factor Authentication (MFA) on Okta SSO instances. Unlike automated bots, these attackers speak fluent English and socially engineer helpdesk staff to reset credentials, granting them administrative access to cloud environments.

FinTech & AI: The "Agentic" Threat

On 4 February 2026, the Australian Securities and Investments Commission (ASIC) released its outlook for the year, explicitly flagging "Agentic AI" as a key risk. While not a traditional exploit, the unmonitored deployment of autonomous AI agents in FinTech is creating new attack surfaces—specifically, the risk of AI agents being manipulated to authorise fraudulent transactions or leak proprietary financial models.

Critical Vulnerabilities Explored

Security teams should prioritise the following vulnerabilities disclosed or actively exploited this week:

• Microsoft Office & 365 (CVE-2026-21509): A critical vulnerability is being actively exploited in the wild. This flaw allows attackers to bypass Object Linking and Embedding (OLE) security protections. If a user opens a crafted Office file, the attacker can execute arbitrary code. Patch immediately.
• Cisco Meeting Management (CVE-2026-20098): Disclosed on 4 February 2026, this high-severity flaw allows an authenticated, remote attacker to upload arbitrary files and elevate privileges to root. This is particularly dangerous for organisations relying on on-premise collaboration hardware.
• Notepad++ Supply Chain Attack: It was confirmed this week that a state-sponsored actor compromised the update infrastructure of the open-source editor Notepad++. Users who updated between June and December 2025 may have received a malicious binary. Security teams must verify the hash integrity of all developer tools installed in their environments.

Emerging Tactics: "Living off the Identity"

The shift from "Living off the Land" to "Living off the Identity" is the defining trend of early 2026. The SLSH campaign demonstrates that technical controls (like standard MFA) are insufficient against determined human adversaries.

• Recommendation: Australian organisations should enforce FIDO2 hardware keys for privileged accounts and implement "number matching" for MFA to reduce fatigue attacks.

Conclusion

As we move further into 2026, the barrier between "technical" and "social" attacks is dissolving. Whether it is a ransomware group coercing a hospital or a vishing crew tricking a FinTech helpdesk, the human element remains the most critical vulnerability.

Contact us for a quote for penetration testing service or adversary simulation.