Malicious cyber activity against the European Medicines Agency in late 2020, followed by the early 2021 targeting of an offshore university lab studying COVID-19, served to highlight the potential threat to Australia’s own vaccine supply chain. In tandem with this threat, the continued spate of ransomware attacks on health entities around the globe, including in Australia, demonstrated the tangible impacts cybercrime can have on critical infrastructure, particularly during a crisis. As a consequence of these attacks, medical staff were locked out of patient records, surgeries were delayed, and patients seeking emergency care were diverted to other facilities. The ACSC supported the Australian Government and key industry organisations, including the health sector, to reduce the risk of malicious cyber activity against the COVID-19 vaccine rollout. This included providing technical advice and assistance (including sector specific advice and assistance), earlier cooperation with vaccine supply chain entities, threat intelligence sharing, and vulnerability scanning of research, health, biotechnology, logistics and transport sectors. The ACSC provided cyber security advice and support to the delivery of national systems for the management of COVID-19, including the Eligibility Checker, the Service Finder, the Symptom Checker, the Register Your Interest platform and the National Booking System. What does the future hold? The coronavirus pandemic demonstrated the ways in which malicious cyber actors can take advantage of national and global crises to conduct a range of activities, from mass phishing campaigns through to targeted attacks against vulnerable entities – particularly those entities charged with responding to a crisis. As new crises emerge, malicious cyber actors will attempt to employ the same techniques against Australia, manipulating uncertainty to their advantage and relying on common security lapses to maximise their chances of success. ACSC Initiative: Collaboration with Telstra and Services Australia to combat malicious COVID-19 themed phishing On 15 September 2020, the then Minister for Defence announced that the ACSC, in collaboration with Telstra and Services Australia, had launched a pilot program to identify and reject illegitimate phishing text messages that impersonate myGov and Centrelink before they reached Telstra customers. The ACSC continues to work with the broader telecommunications industry towards an industry-wide solution, and strongly encourages all organisations and individuals to exercise caution and remain vigilant when clicking links. Any account can be compromised and malicious links can be sent from email accounts, messaging applications and SMS. 27