Michael Haarsma

URGENT: Australian Cyber Threat Landscape Update - 15 January 2026 The last 24 hours have marked a significant surge in cyber activity across Australia. Our latest analysis flags critical alerts for SaaS providers, government agencies, and the FinTech sector, driven by active exploitation of widely used infrastructure. Key highlights from today's intelligence report: - Critical n8n RCE (CVE-2026-21858): A severe, unauthenticated vulnerability in the n8n automation platform is currently being exploited, granting attackers potential "keys to the kingdom" for connected cloud services. - Microsoft Hyper-V Zero-Days: Following January's Patch Tuesday, we are seeing active exploitation of privilege escalation flaws allowing sandbox escapes in virtualized environments. - Prosura Data Breach: A confirmed incident involving the Australian insurer highlights a growing trend of "island hopping," where compromised infrastructure is used to launch phishing campaigns against customers. - AI Security Risks: A new code injection vulnerability in Open WebUI is threatening the integrity of self-hosted AI models in the Education and EdTech sectors. Immediate patching of n8n instances and Hyper-V environments is strongly recommended. For the detailed executive summary, technical specifics on these CVEs, and mitigation strategies, please read the full article on our website. https://lnkd.in/gFGCuceR #CyberSecurity #ThreatIntelligence #Australia #InfoSec #CloudSecurity

1

"Many organisations seek expert cybersecurity consulting services to assess vulnerabilities, implement best practices, and ensure compliance with frameworks like the Essential Eight." https://lnkd.in/gW4azkQ2

4

Some key highlights from Australian Signals Directorate (ASD)'s Cyber Threat Report 2024–2025: 1. There is a significant rise in cyber incidents and reports: The Australian Cyber Security Centre (ACSC) reported that in during 2024-2025 they have responded to over 1,200 major cybersecurity incidents which is a 11% increase from the previous year. 2. There is a steep rise in the financial impact due to cybercrimes: For businesses, the average loss due to cybercrimes is on the rise, Small businesses lost up to $56,571 a 14% increase from last year, Medium business lost up to $97,166 a 55% increase, and Large businesses lost up to $202,691 a 221% increase. It was also reported that an individual average self reported loss was $36,633 3. Critical infrastructure under increasing threat: Critical infrastructures have received notifications of 190 potential malicious cyber activity impacting their network which is a 111$ increase from last year. The Top 3 most common types of activity which led to infrastructure related incidents were: Scanning or Reconnaissance making up 41% DoS/DDoS making up 31% Phishing making up 20% 4. Credential compromise, email attacks and phishing remain the main methods of attack: It was reported that email compromise with no direct financial loss accounted for ~19% of business reports, Business email compromise with financial loss ~15%, identity fraud ~ 11% and phishing emails remains one of the most common attack methods. 5. New technologies are amplifying the risk like AI The report also warns the rise in the use of Generative AI by cybercriminals as they use these tools to automate the analysis of extensive datasets which allows them to find vulnerabilities, they also use generative AI to create content like videos, text, fake voices, websites etc. to help them trick their target easier. 💡 The big moves organisations must take: a. Implement Effective event logging - You can't defend what you can't see b. Manage legacy IT risks - Legacy technology lets threats thrive c. Effective Third-Party Risk Management (TPRM) - Shut the back door, choose sercure and verifable technologies d. Start preparing for Post Quantum Cryptography (PQC) more details: https://lnkd.in/gCVf9fSq

7

📢 The Australian Signals Directorate has released CI Fortify. A new framework providing practical, high-level cybersecurity guidance to help critical infrastructure (CI) operators strengthen their operational technology (OT) resilience during crisis or disruption. 🧩 What it is CI Fortify sets out clear actions to ensure essential services can continue even under sustained cyberattack or system isolation. 🎯 Why it exists Australia’s Critical Infrastructure remains a prime target for both state-sponsored and criminal actors. These systems were never designed to endure today’s cyber threats, making proactive resilience a national priority. ⚙️ What it requires CI Fortify challenges operators to: 🔹 Isolate vital OT systems for up to 3 months while maintaining operations. 🔹 Rapidly rebuild those systems from trusted backups. Preparation steps include: 1. Maintaining a current OT asset inventory 2. Identifying vital systems critical to service continuity 3. Defining isolation points and manual contingency workflows Don't wait for a cyber incident to be the first time in verifying operational resilience. In my recent presentation 'Safeguarding water utilities: From Reliability to Resilience' 👉 "Confidence in resilience comes from experience. Test and verify your controls — assumptions are never assurance." 💪 Who's up for the CI Fortify Challenge?? For more information on CI Fortify can be found here: https://lnkd.in/gQ9Z9iQs https://lnkd.in/gknZfqCX #CyberSecurity #OperationalTechnology #CriticalInfrastructure #Resilience #ASD #CIFortify #Australia #EA #CyberEngineer

32

Fortian's November 2025 cyber environment update is now available on the website! November saw steady activity across Australia’s cyber landscape, including new government sanctions on North Korea and Russia, emerging AI-enabled threats and several notable breaches affecting local organisations. Check out this month’s update written by SOC analyst Allan Grant on our website: https://lnkd.in/gnbwGb6Z

8