Exploitation of security vulnerabilities Throughout this period, the ACSC has observed a continuing trend of state-sponsored actors and cybercriminals rapidly exploiting publicly reported security vulnerabilities to compromise large numbers of organisations. Malicious cyber actors monitored public reporting of vulnerabilities and used vulnerability scanning tools against internet-accessible networks to identify unpatched software and hardware appliances, as well as misconfigured devices and networks, for exploitation. Security vulnerabilities were sometimes exploited within hours of a patch release or technical write up – particularly if proof of concept (PoC) code was also available. While improving cyber hygiene and rapid patching can help protect organisations from being compromised via publicly reported security vulnerabilities, zero-day exploits are more difficult for organisations to defend their networks against. This is because a zero-day is a software exploit that has not been disclosed or patched by the software vendor. Both zero-day exploits and exploits of publicly reported security vulnerabilities can have significant impacts. For example, the 2021 ‘ProxyLogon’ Microsoft Exchange server vulnerabilities exploit was wide-scale and will have long lasting impacts for many vulnerable organisations that did not patch and remediate their systems in time. Similarly, malicious actors rapidly exploited 2020 mobile device management vulnerabilities, and a range of organisations were extorted after their data was stolen via compromised Accellion FTAs (see Case Study: Accellion FTA compromises Australian organisations and state government agencies, page 39). The ACSC assesses that exploitation of publicly reported vulnerabilities will continue to be a key vector used by malicious cyber actors into the future. The exploitation of such vulnerabilities is scalable, low cost and avoids the need to develop zero-day exploits. These exploits are not, and will not be, limited to the targeting of government entities and large organisations. The ACSC and national security partners have observed exploits for a number of publicly reported vulnerabilities being deployed across the full span of Australian networks, including private industry, small businesses and home users. 37