ANZ Threat Landscape — May 2026
← Research Hub

ANZ Threat Landscape — May 2026

Actionable threat intelligence and sharp insights into the threats, attack trends and adversaries shaping the Australia & New Zealand cybersecurity landscape.

Report Highlights (Key Stats to Feature)

26 ransomware incidents recorded in ANZ — down 3.70% from April 202626 ransomware incidents recorded in ANZ — down 3.70% from April 2026

390,967 compromised accounts — up 32.96% from April, led by RedLine Stealer (146,021 credentials)390,967 compromised accounts — up 32.96% from April, led by RedLine Stealer (146,021 credentials)

61,894 compromised bank cards — a 1,044% spike from April, driven by the B1ack's Stash darkweb dump (49,791 Australian cards + 4,498 NZ cards)61,894 compromised bank cards — a 1,044% spike from April, driven by the B1ack's Stash darkweb dump (49,791 Australian cards + 4,498 NZ cards)

Most targeted industries: Commerce & Shopping (6), Education (3), Healthcare (2), Financial Services (2)Most targeted industries: Commerce & Shopping (6), Education (3), Healthcare (2), Financial Services (2)

New threat actor Bavacai emerged and immediately targeted Australian businesses (Strategic Imports, Palmers Relocations)New threat actor Bavacai emerged and immediately targeted Australian businesses (Strategic Imports, Palmers Relocations)

Most Active Threat Actors Section

Most Active Threat Actors Section

Adversary of the Month

TrickMo — Android banking trojan (variant TrickMo.C) confirmed targeting Australian financial services users in 2026. Designed to intercept OTPs and bypass 2FA on banking apps including ANZ bank, Telstra, Optus, PayPal, and cryptocurrency platforms.

Local Incidents Highlighted

B1ack's Stash card dump (May 18): ~54,000 ANZ cards leaked on darkwebB1ack's Stash card dump (May 18): ~54,000 ANZ cards leaked on darkweb

Australian Medical Council attacked by ransomware group 3AM (May 27)Australian Medical Council attacked by ransomware group 3AM (May 27)

VSP Solutions attacked by STORMOUS (May 23)VSP Solutions attacked by STORMOUS (May 23)

5 hacktivism incidents — DXPLOIT targeted healthcare (#OpAustralia), Z-Pentest compromised SCADA systems in Perth5 hacktivism incidents — DXPLOIT targeted healthcare (#OpAustralia), Z-Pentest compromised SCADA systems in Perth