Threat environment and key cyber security trends Australia faced a complex and evolving cyber threat environment in 2020 and 2021. This was in part due to the impacts of the coronavirus pandemic, but also to the increasing opportunities afforded to malicious actors, the rampant activities of cybercriminals and Australia’s geostrategic environment. The coronavirus pandemic continued to expand the boundaries of Australia’s computer networks, pushing corporate systems into homes across the nation as a large percentage of the workforce shifted to remote working arrangements. The speed at which this occurred saw many organisations rapidly deploy new remote networking solutions, sometimes to the detriment of their cyber security. Various malicious cyber actors repeatedly took advantage of Australia’s heightened vulnerability during this time to conduct espionage, steal money and sensitive data, and disrupt the services on which Australians rely. Alongside the virtualisation of Australian life, the disclosure of significant vulnerabilities in software used in Australian networks expanded the targeting opportunities available to adversaries. The Microsoft Exchange and Accellion File Transfer Application (FTA) vulnerabilities were notable examples where the ACSC observed multiple compromises after initial disclosure. In some cases, both state-sponsored actors and cybercriminals were able to rapidly exploit vulnerabilities at scale, including against targets in Australia. Across this period, Australia remained a key and regular target of state-sponsored actors. These actors employed a wide range of tactics to target Australian networks, seeking sensitive information that could be used to weaken Australia’s competitive advantage and degrade national security. Australians were also frequent victims of financially motivated cybercrime, particularly ransomware and business email compromise. Cybercriminals were prolific and overt in their targeting of Australian organisations, and the impacts of their operations were felt across the community. In some cases, these impacts included the disruption of essential services, as happened when the March 2021 ransomware attack against a Victorian public health service affected four hospitals and aged care facilities, and resulted in the postponement of elective surgeries. Ransomware attacks on an Australian media company and JBS Foods further demonstrated a move by cybercriminals away from low-level ransomware operations towards extracting hefty ransoms from large or high-profile organisations. To increase the likelihood of ransoms being paid, cybercriminals would encrypt networks and also exfiltrate data, then threaten to publish stolen information on the internet. These shifts in targeting and tactics have intensified the ransomware threat to Australian organisations across all sectors, including critical infrastructure. Cybercriminals also preyed on the community’s desire for information and resources on topical issues. In particular, the pandemic provided compelling content for email and SMS phishing campaigns. However, often poor cyber security controls – such as unpatched vulnerabilities and unsecured remote access solutions – allowed cybercriminals to launch their attacks with minimal targeting effort or technical expertise. The ease with which malicious actors could gain access to networks increased Australia’s susceptibility to cybercrime targeting. 23