China, Russia and North Korea “routinely” bombard Australia’s critical infrastructure with sponsored cyber attacks to both spy and “preposition” for sabotage, according to newly released intelligence.
The Australian Signal Directorate’s latest threat report paints a picture of cyber attacks supercharged by artificial intelligence, as state-backed hackers and digital criminals alike lean on the technology to sow chaos wherever they can.
The agency responded to more than 1500 incidents in the 2025-26 financial year, marking a 20 per cent jump on the previous year.
It also issued 4400 suspicious activity notices to organisations – an 80 per cent surge.
ASD Director-General Abigail Bradshaw said “AI-enabled threats” were behind the numbers.
“Over the last year, frontier AI technologies have fundamentally changed the cyber security landscape,” she said.
“They are creating enormous opportunities, but they are also enabling malicious cyber actors to identify vulnerabilities and conduct attacks faster, at greater scale, and with greater precision than ever before.
“This shift will only accelerate.”
Ms Bradshaw warned organisations “must take action to improve basic cyber hygiene” or leave themselves exposed to AI-powered attacks.
That included attacks sponsored by hostile governments.
“As the global security environment remains challenging, state-sponsored cyber actors will increasingly leverage AI to enhance the scale, speed and effectiveness of their operations,” Ms Bradshaw said.
“The Threat Report shows state-actors continue to focus on Australian organisations to gain access to sensitive information, while also seeking to preposition within networks for future intelligence collection or disruption activities at a time of their choosing.”
‘Crisis or conflict’
The report put the risk plainly, warning that Australia’s adversaries “are possibly preparing for eventualities, such as crisis or conflict”.
“State-sponsored actors can use disruption to achieve strategic goals, such as limiting the ability to respond to an event or cause social unrest,” it said.
It said conflicts in the Middle East and Ukraine “are fuelling international instability” and that the world “is under greater strain than at any time since the end of the Cold War”.
“The global rules-based order, which has underpinned Australia’s security and prosperity for decades, is in transition,” the report said.
It named China, Russia and North Korea as common culprits that “have targeted Australia or its allies”, naming proxy hacker groups Volt Typhoon, APT29 and Lazarus Group.
Their attacks “could incapacitate Australia”, it said.
Ms Bradshaw said that while AI was driving new threats, it was also the solution.
“To strengthen our cyber defences, we must harness the technologies that are reshaping the threat environment,” she said.
“Cyber defenders can use AI tools to improve threat detection, identify new attack vectors and strengthen network defences. Looking ahead, we need AI tools to help automate our defences to stay ahead of AI-enabled attackers.”