Daily Threat Briefing: Ivanti Zero-Days, Healthcare Ransomware & The Identity Crisis

Executive Summary The Australian cyber threat landscape has remained volatile over the weekend, dominated by the active exploitation of critical zero-day vulnerabilities in Ivanti’s Endpoint Manager Mobile (EPMM). Simultaneously, the healthcare and FinTech sectors are grappling with fresh ransomware claims and data breaches, highlighting a persistent failure in credential management and API security.

Here is your deep dive into the last 24 hours of threat activity affecting Australian organisations.

Critical Infrastructure & SaaS: Ivanti Under Fire Again

The Threat: Two critical zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) affecting Ivanti Endpoint Manager Mobile (EPMM) are being actively exploited in the wild. Impact: These vulnerabilities allow unauthenticated attackers to execute arbitrary code (RCE) on target servers, granting full control over mobile device management (MDM) infrastructure. This effectively hands threat actors the keys to an organisation’s entire mobile fleet, including IoT devices. Australian Context: The Australian Signals Directorate (ASD) and Palo Alto Networks Unit 42 have observed widespread exploitation targeting government, healthcare, and manufacturing sectors. Action: Immediate patching to RPM 12.x is mandatory. If you cannot patch immediately, isolate the appliances from the internet.

Healthcare Sector: LockBit Resurfaces

The Incident: The Aeromedical Society of Australasia has confirmed a cyber incident following claims by the LockBit ransomware group. Analysis: Despite previous law enforcement disruptions, LockBit remains a potent threat to Australian healthcare. The group is threatening to publish stolen sensitive data by the end of the month. This follows a broader trend noted in the ASD’s recent Annual Cyber Threat Report, which highlighted that ransomware incidents involving the healthcare sector have doubled in the 2024-25 period. Key Risk: The encryption of patient data and operational disruption in critical care support services.

FinTech & SaaS: youX Data Breach

The Incident: Australian FinTech platform youX has confirmed a significant data breach. Details: Threat actors have begun sharing samples of the stolen data, which reportedly compromises hundreds of thousands of user records. Experts point to a "lack of adequate cyber hygiene" as the root cause—likely an unmonitored API endpoint or hardcoded credentials. Broader Trend: This incident comes days after FIIG Securities was penalised $2.5 million for cyber security failures, signalling that regulators are losing patience with financial institutions that neglect data protection.

Government & Education: The "Identity" Crisis

The Incident: The Victorian Department of Education is managing the fallout from an unauthorised third-party access incident. Deep Dive: Recent analysis suggests that Australia’s biggest breaches in 2026 are not resulting from sophisticated zero-days, but from access failures. Attackers are bypassing perimeter defences by exploiting:

• Forgotten service accounts.
• Long-lived API keys embedded in code.
• Exposed cloud tokens. Takeaway: "Identity is the new perimeter." Organisations must pivot from purely network-based controls to robust Identity Threat Detection and Response (ITDR).

Emerging Tech: AI & Web Application Security

AI Vulnerabilities: The Langflow Unauthorized Code Injection (CVE-2025-3248) continues to be a vector for compromising AI application infrastructure. As Australian organisations race to deploy LLM-backed tools, unvalidated inputs in AI pipelines remain a critical blind spot. Web Apps: The React2Shell (CVE-2025-55182) vulnerability in Next.js allows pre-authentication RCE and is still being scanned for by botnets. Ensure your web frameworks are updated to versions 15.1.0+ or 16.0.2+.

Recommendations for C-Level & Security Teams

1. Patch Ivanti EPMM: Treat CVE-2026-1281 as an emergency.
2. Audit Non-Human Identities: Review all API keys, service accounts, and OAuth tokens. Rotate anything older than 90 days.
3. Validate AI Supply Chains: Ensure any AI development platforms (like Langflow) are not exposed to the public internet without strict authentication.
4. Healthcare Resilience: Verify offline backups are immutable, given the resurgence of LockBit targeting the sector.

Contact us for a quote for penetration testing service or adversary simulation.

Australia Cyber Threat Briefing: AI-Driven API Attacks, FinTech Fallout & The Rise of "0APT"

Weekly Threat Briefing: 16–22 February 2026

As we close out the third week of February 2026, the Australian cyber landscape is being defined by a sophisticated pivot towards AI-enabled API exploitation and high-impact ransomware campaigns targeting the FinTech and Healthcare sectors. The "blast radius" of AI systems is widening, with the Model Context Protocol (MCP) emerging as a critical new attack surface.

Here is your deep dive into the threats impacting Australian organisations over the last 7 days.

Sector Spotlight

FinTech: Massive Data Breach at youX

In a significant blow to the Australian alternative lending sector, FinTech platform youX confirmed a major data breach this week. Threat actors have claimed to compromise a MongoDB Atlas cluster, exfiltrating approximately 141 gigabytes of sensitive data.

• Impact: The breach potentially exposes over 600,000 loan applications across nearly 100 lenders.
• Data Exposed: Driver’s licences, bank documents, and PII.
• Vector: Preliminary reports suggest a misconfigured cloud database was exploited, possibly leveraging the recently disclosed MongoDB Server Leak vulnerability (CVE-2025-14847).

Healthcare: Ransomware Resurgence (Termite & 0APT)

The healthcare sector remains under siege, with two major incidents dominating the headlines:

• Genea Fertility: Following suspicious activity detected in mid-February, the Termite ransomware group has claimed responsibility for an attack on this major IVF provider. While Genea disabled systems to contain the breach, fears remain regarding the theft of highly sensitive patient management data (PII and PHI).
• Epworth HealthCare: The emerging 0APT ransomware gang has listed Epworth as a victim, claiming possession of 920GB of data, including surgical records and billing details. This incident highlights the growing trend of "psychological pressure" tactics, where threat actors threaten to release sensitive medical diagnoses to force payment.

Government & Education

• Fairfield City Council (NSW): Formally notified residents of a data breach this week (stemming from a late 2025 incident), confirming unauthorised access to staff and resident information.
• Victorian Department of Education: Continues to manage the fallout from the January breach impacting 1,700 schools, with new phishing campaigns impersonating the department now circulating.

IoT: The "PolarEdge" Botnet

A new botnet dubbed "PolarEdge" has been identified recruiting Cisco RV series routers. Active since late 2025, the botnet has grown to over 2,000 infected devices in Australia, leveraging older command injection flaws to deploy web shells for persistent access.

---

Vulnerability Watch: Web, Cloud & AI

The last week has seen active exploitation of critical vulnerabilities, particularly in cloud-native and AI-integrated systems.

1. React2Shell (CVE-2025-55182) – CVSS 10.0

• Status: Active Exploitation.
• Details: Dubbed "React2Shell," this unauthenticated Remote Code Execution (RCE) flaw in React Server Components is being called a watershed moment for web security.
• Risk: It allows attackers to execute privileged JavaScript code with SYSTEM-level access. Approximately 39% of cloud environments are estimated to have vulnerable instances.
• Action: Immediate patching of React versions 19.x and downstream frameworks like Next.js is mandatory.

2. Fortinet FortiCloud SSO (CVE-2025-59719)

• Status: Critical.
• Details: An authentication bypass vulnerability in FortiCloud SSO allows attackers to log in as legitimate users without credentials.
• Risk: This is a "keys to the kingdom" flaw for managed service providers (MSPs) and organisations relying on Fortinet for network security management.

3. The AI Threat: Model Context Protocol (MCP)

• Emerging Threat: Research released this week indicates a 270% increase in vulnerabilities related to the Model Context Protocol (MCP).
• Context: MCP is becoming the standard for connecting AI agents to data sources. Attackers are exploiting over-permissioned agents to perform "Shadow AI" data exfiltration, bypassing traditional endpoint security.

---

Recommendations

1. Immediate Patching: Prioritise React2Shell (CVE-2025-55182) and Fortinet SSO patches. These are currently the primary vectors for initial access.
2. Database Hardening: Review all MongoDB instances for public exposure and ensure strict access controls are in place to prevent incidents like the youX breach.
3. AI Governance: Audit the use of AI agents and MCP integrations within your environment. Ensure "Shadow AI" tools are not granted excessive permissions to internal APIs.
4. Adversary Simulation: With groups like Termite and 0APT aggressively targeting Australian healthcare and finance, test your resilience against their specific TTPs (Tactics, Techniques, and Procedures).

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Major FinTech Breach & Critical AI Workflow RCE

Executive Summary

The Australian cyber threat landscape has escalated significantly in the last 24 hours. The headlines are dominated by a massive data breach affecting a Sydney-based FinTech lender, exposing the identity documents of hundreds of thousands of Australians. Simultaneously, critical vulnerabilities in widely used SaaS automation tools and AI frameworks are being actively exploited, prompting urgent warnings for organisations integrating AI agents into their workflows.

Here is your daily deep dive into the threats impacting Australian sectors today.

---

Sector Spotlight

FinTech: Massive Data Breach at youX

In what is shaping up to be one of the largest financial sector breaches of 2026, Sydney-based FinTech firm youX has confirmed a significant security incident.

• The Impact: Threat actors have claimed to exfiltrate the personal and financial data of approximately 444,538 borrowers.
• Critical Data Exposed: The stolen dataset reportedly includes over 200,000 Australian driver's licences, along with income details, debt profiles, email addresses, and residential addresses.
• Analysis: Initial reports suggest the breach stemmed from inadequate "cyber hygiene" and unauthorised access to a database that may have been left exposed. This incident highlights the critical need for robust Third-Party Risk Management (TPRM), as the data was allegedly captured from broker organisations relying on the youX platform.

Healthcare: Aeromedical Society Targeted by LockBit

The Aeromedical Society of Australasia has confirmed it is managing a cyber incident following claims by the notorious LockBit ransomware gang.

• The Threat: LockBit has listed the organisation on its leak site, threatening to publish internal data.
• Implication: For the healthcare sector, this reinforces the persistent threat of ransomware groups targeting critical support services. Medical NGOs and associations hold sensitive member and sometimes patient data, making them high-value targets for extortion.

Retail & Hospitality: Seagrass Hospitality Group Incident

The Seagrass Boutique Hospitality Group, known for its high-end dining venues across Australia, has confirmed it has fallen victim to a cyber attack.

• Threat Actor: The attack has been claimed by the Kairos ransomware group.
• Status: The group is currently investigating the extent of data exfiltration. Hospitality venues remain prime targets due to the high volume of processed payment card data and customer PII (Personally Identifiable Information).

SaaS & AI: The "Ni8mare" Vulnerability (n8n)

A critical alert has been issued for users of n8n, a popular workflow automation tool used heavily by SaaS providers and tech-forward businesses to connect APIs and AI agents.

• Vulnerability: CVE-2026-21858 (CVSS 10.0).
• The Risk: Dubbed "Ni8mare", this vulnerability allows unauthenticated attackers to execute arbitrary code (RCE) on the underlying server.
• Why it Matters: As Australian businesses rush to adopt AI agents that rely on tools like n8n for orchestration, this flaw provides a direct "keys to the kingdom" attack vector, allowing threat actors to hijack automated workflows and access sensitive API keys.

---

Technical Corner: Vulnerabilities & Exploits

Web Applications & APIs

The Wallarm 2026 API ThreatStats Report, released this week, reveals a disturbing trend: APIs now account for 17% of all published vulnerabilities.

• Key Insight: There is a 36% overlap between AI vulnerabilities and API security flaws. If you are securing AI, you must secure your APIs.
• Action: Security teams should prioritise "Runtime Enforcement" over simple gateway protection to detect logic abuse in real-time.

IoT & Infrastructure

The Australian Signals Directorate (ASD) continues to warn of active exploitation of edge devices.

• WatchGuard Firebox (CVE-2025-14733): Threat actors are actively exploiting this critical vulnerability to gain initial access to corporate networks. If your organisation utilises WatchGuard appliances, ensure the latest firmware is applied immediately.

---

Recommendations for Australian CISOs

1. Immediate Patching: Prioritise patching n8n instances (CVE-2026-21858) and WatchGuard devices. Isolate unpatched instances from the internet immediately.
2. Vendor Risk Assessment: FinTech and Mortgage Broking firms should urgently review their data-sharing arrangements with aggregators and lenders in light of the youX breach.
3. API Security Review: innovative "Agentic AI" workflows often bypass traditional WAFs. Conduct specific penetration testing on your internal APIs that service AI agents.

---

Contact us for a quote for penetration testing service or adversary simulation.

Daily Threat Briefing: Critical Ivanti Zero-Days, FinTech Breaches, and the Rise of LockBit 5.0

Executive Summary

The last 24 hours have seen a surge in high-impact activity targeting Australian organisations, particularly in the FinTech and Healthcare sectors. Of critical concern is the active exploitation of new zero-day vulnerabilities in Ivanti’s Endpoint Manager Mobile (EPMM), which poses a severe risk to government and enterprise mobile fleets. Simultaneously, the Australian lending platform youX has confirmed a significant data breach, and the Aeromedical Society of Australasia has become the latest victim of the resurrected LockBit 5.0 ransomware group.

This briefing outlines the urgent threats, exploited vulnerabilities, and regulatory shifts you need to know today.

---

Sector-Specific Deep Dives

1. SaaS & Cloud: Ivanti EPMM Under Siege

• Threat: Two critical zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) are being actively exploited in the wild.
• Impact: These flaws affect Ivanti Endpoint Manager Mobile (EPMM), allowing unauthenticated attackers to execute arbitrary code (RCE) and gain full control over mobile device management infrastructure.
• Observation: Threat actors are using these exploits to install webshells and establish reverse shells. Given the widespread use of Ivanti in Australian government and enterprise environments, this is a CRITICAL patching priority.
• Action: Immediate patching to the latest RPM versions (12.x.0.x or 12.x.1.x) is mandatory. Assume compromise if your instance has been internet-facing without mitigation.

2. FinTech: Data Breach at youX & Regulatory Warnings

• Incident: Australian digital lending platform youX confirmed yesterday (19 February) that unauthorised third-party access has compromised its systems.
• Data at Risk: Reports indicate threat actors claim to have exfiltrated 141 GB of data from a MongoDB Atlas cluster, potentially exposing loan applications, driver’s licences, and financial records.
• Regulatory Context: This incident follows the landmark Federal Court ruling earlier this week against FIIG Securities, ordering a $2.5 million penalty for failing to maintain adequate cybersecurity measures. This signals a new era of enforcement by ASIC, where "tick-box" compliance is no longer a defence against liability.

3. Healthcare: LockBit 5.0 Targets Critical Services

• Incident: The Aeromedical Society of Australasia, a key body for air medical transport professionals in Australia and New Zealand, has been listed on the LockBit 5.0 leak site.
• Threat Actor: LockBit 5.0 (the latest iteration of the notorious RaaS group) is aggressively targeting healthcare and non-profit entities.
• Risk: The potential leak of member data or operational details could disrupt critical medical transport coordination. This aligns with a broader trend of ransomware groups disregarding the "no-hospital" rule in 2026.

4. IoT & AI: The "Agentic" Threat

• Emerging Trend: New research released yesterday by Barracuda and Arctic Wolf highlights a shift in tactics. 90% of recent ransomware incidents in 2025-26 involved firewalls exploited via known vulnerabilities.
• AI Vector: We are observing an uptick in AI-driven social engineering, where deepfake voice and text are used to bypass biometric verification in FinTech applications. Additionally, "Shadow AI" remains a risk, with employees feeding sensitive corporate data into unvetted Large Language Models (LLMs), creating inadvertent data leaks.

---

Vulnerability Spotlight: The "Must-Patch" List

CVE ID	Severity	Affected Product	Status
CVE-2026-1281	Critical (9.8)	Ivanti EPMM	Active Exploitation. RCE via legacy bash scripts.
CVE-2026-1340	Critical (9.8)	Ivanti EPMM	Active Exploitation. Authentication bypass.
CVE-2026-20700	High (7.8)	Apple iOS/macOS	Memory corruption allowing code execution.
CVE-2026-1731	Critical (9.9)	BeyondTrust PRA	Remote command injection.

---

Recommendations for Australian CISOs

1. Hunt for Ivanti IOCs: Do not just patch. Proactively hunt for indicators of compromise (IOCs) such as unexpected child processes spawned by Apache or modified bash scripts in /mi/bin/.
2. Review Third-Party Risk: The youX breach underscores the risk of third-party data handlers. Audit your suppliers' security posture, particularly those managing sensitive financial data.
3. Harden Remote Access: With 65% of non-BEC breaches now starting with abused remote access tools, enforce strictly phishing-resistant MFA (FIDO2) for all external access points.
4. Test Your Defences: Compliance is not security. The FIIG ruling proves that having a policy is insufficient if it is not operationally effective.

Contact us for a quote for penetration testing service or adversary simulation.

Urgent: Chrome Zero-Day, Government Blind Spots & The AI Agent Threat

The last 24 hours have exposed critical fractures in Australia’s national cyber resilience, ranging from federal compliance failures to the active weaponisation of autonomous AI systems. For security teams across the country, the immediate priority is a critical zero-day patching cycle for web/SaaS access, while C-level executives must urgently review third-party governance and incident reporting protocols.

Here is your deep dive into the threats impacting Australian organisations over the last 24 hours.

Top Priority: Critical Vulnerabilities

Google Chrome Zero-Day (CVE-2026-2441)

• Severity: Critical (Actively Exploited)
• Target: Web Applications & SaaS Access
• Intel: Google has released an emergency update to address a Use-After-Free vulnerability in Chrome’s CSS processing component. Threat actors are actively exploiting this in the wild to execute arbitrary code on victim machines via crafted HTML pages.
• Action: Immediate patching to version 145.0.7632.75 is required. This poses a significant risk to organisations relying on browser-based SaaS platforms, as a single compromised endpoint can bypass perimeter defences.

BeyondTrust Remote Access (CVE-2026-1731)

• Severity: Critical
• Target: Cloud/Hybrid Infrastructure
• Intel: Arctic Wolf has confirmed active exploitation of this pre-authentication remote code execution flaw in self-hosted BeyondTrust environments. Attackers are using this to gain initial footholds in privileged networks.
• Action: Verify all instances are patched immediately. Cloud-hosted instances have been patched by the vendor, but on-premise/hybrid deployments remain vulnerable.

---

Sector Spotlight

Government: The "Silent" Breach Crisis

A concerning report tabled in Parliament yesterday reveals a massive visibility gap in our national defence. It has been confirmed that only 35% of federal government entities reported at least half of their observed cyber incidents to the Australian Signals Directorate (ASD) in the 2024-25 period.

• Impact: This lack of reporting creates a "fog of war" that allows sophisticated state-sponsored actors, such as the persistent Salt Typhoon group, to maintain long-term access to critical networks without detection.
• Takeaway: We expect a swift regulatory crackdown. Agencies and government contractors should prepare for stricter mandatory reporting audits in Q2 2026.

Healthcare: Ransomware Resurgence

The healthcare sector remains in the crosshairs of the 0APT ransomware gang. Following the attack on Epworth HealthCare earlier this month, intelligence indicates the group is now pivoting to smaller allied health providers to lateral move into larger hospital networks.

• Trend: Attackers are weaponising sensitive patient data not just for extortion, but to force "psychological pressure" negotiations, a tactic seen in the recent Medibank class action developments.

Retail & Hospitality: Seagrass Group Incident

Seagrass Boutique Hospitality Group has confirmed a cyber incident involving unauthorised network access, with the Kairos ransomware gang claiming responsibility.

• Analysis: Kairos is known for rapid data exfiltration before encryption. Retailers must assume that if their perimeter is breached, customer data is already gone before the ransom note appears.

FinTech: The Cost of Vendor Negligence

The regulatory patience for "tick-box" compliance has run out. The historic $2.5 million penalty handed down to FIIG Securities regarding vendor security failures sets a new precedent.

• Risk: FinTechs are no longer just liable for their own systems but are effectively the "security guarantors" for their entire supply chain.

IoT: The Spy in the Driveway

The Office of the Australian Information Commissioner (OAIC) has formally commenced investigations into connected vehicles.

• Threat: The ASD has identified instances of vehicles recording conversations without consent and transmitting telemetry that could be intercepted by foreign actors. For corporate fleets, this turns every company car into a potential mobile listening device.

AI Systems: The Rise of "AI Agents" as Vectors

A new frontier of threat has emerged in the last 24 hours. Vulnerabilities have been discovered in Moltbook (a social media platform for AI agents), and we are seeing the first weaponisation of OpenClaw tools.

• Scenario: Threat actors are compromising autonomous AI agents to inject poisoned data into corporate decision-making models. This is no longer theoretical; it is an active attack vector targeting automated procurement and customer support systems.

Summary & Recommendation

The threat landscape in February 2026 is defined by access exploitation—whether through unpatched browsers, forgotten service accounts, or unmonitored third-party vendors. The distinction between "internal" and "external" networks is gone.

Your immediate focus today must be:

1. Patch Chrome and BeyondTrust instances.
2. Audit your incident reporting pathways to ensure alignment with ASD requirements.
3. Review AI agent permissions to prevent automated data exfiltration.

Contact us for a quote for penetration testing service or adversary simulation.