Get 24/7 incident response assistance from our global team
Please review the following rules before submitting your application:
1. Our main objective is to foster a community of like-minded individuals dedicated to combatting cybercrime and who have never engaged in Blackhat activities.
2. All applications must include research or a research draft. You can find content criteria in the blog. Please provide a link to your research or research draft using the form below.
Your guide to AI innovation, adoption, and acceleration in cybersecurity
The High-Tech Crime Trends Report 2026 reveals how this shift has industrialized cybercrime, exposed the limits of perimeter-based defenses, and elevated identity and trust as the new primary attack surfaces.
Your guide to AI innovation, adoption, and acceleration in cybersecurity
Learn more
ANZ faces a rapidly evolving cyber threat environment with ransomware operators, hacktivist groups and financially motivated threat actors all active in the region. Group-IB’s February 2026 ANZ Newsletter provides a deep dive into ransomware, hacktivism, compromised accounts and financial fraud with local context, named victims and adversary profiles specific to the ANZ market.
Unlike aggregated open-source reports, this intelligence is drawn directly from Group-IB’s proprietary telemetry, dark web monitoring and infostealer tracking.
Ransomware Drops But Complacency Remains a Risk. Australian Water and Irrigation Systems Under Sustained OT Attack. Three ANZ Data Breaches Tracked by Group-IB in February 2026Account Compromises Down, but Volume Remains High. ANZ Bank Card Fraud Falls, but Telegram Remains the Primary Distribution Channel.Qilin, Play, Lockbit, Space Bears, INC Blog and Kairos were all active in the ANZ region during February 2026. Qilin targeted Distinctive Systems Ltd, Lockbit struck the Aeromedical Society of Australasia, and Play attacked Sika Technology Limited in New Zealand. Industrial manufacturing was the most targeted sector, followed by healthcare and retail. Despite the overall decline in incident volume, the breadth of active groups means ANZ organisations should not interpret lower numbers as reduced risk.
Water, irrigation and energy infrastructure rely on operational technology (OT) that is increasingly internet-connected but often inadequately secured. Groups like NONAME057(16), the Infrastructure Destruction Squad and the TAZ-Pentest Alliance specifically target OT environments including ICS, SCADA and HMI interfaces because access to these systems enables disruption of essential services, manipulation of physical processes, and persistent covert surveillance. Australia recorded six hacktivist incidents in February 2026, all involving OT access techniques.
FulcrumSec is a financially motivated threat actor active since October 2025, targeting victims through open-asset scanning and vulnerability identification. Following the youX breach – one of the most significant financial data compromises in Australian history involving 300GB of sensitive B2B FinTech data – the group has claimed access to the LexisNexis Legal and Professional database and states it holds tens of terabytes of additional data yet to be disclosed. ANZ financial services and legal organisations should treat FulcrumSec as an active and ongoing threat.
Infostealers in ANZ are primarily delivered as Malware-as-a-Service (MaaS), distributed through ClickFix attacks via social media, phishing emails with malicious attachments, and fake websites. Affiliates rotate between malware families based on detection rates and infrastructure availability, which explains sharp month-on-month swings such as AMOS rising from approximately 600 to nearly 11,000 victims between January 2026 and February 2026. Vidar, Stealc and RedLine Stealer together accounted for 74.17% of all compromised accounts in ANZ during February 2026.
Group-IB monitors the cyber dimension of the Iran–Israel–U.S. escalation continuously. ANZ organisations can track developments in real time by setting up a hunting rule in Group-IB’s Threat Intelligence platform, or by accessing the Group-IB Threat Intelligence Portal directly. Group-IB’s Global Investigation Team and CERT-GIB provide 24/7 monitoring and publish finished intelligence as new threats are identified.
An essential 15-minute read for ANZ Security and Risk Professionals:
Chief Information Security Officers (CISOs), Chief Information Officers (CIOs) and Heads of Security.Fraud, Risk and Compliance Leaders.Government and Law Enforcement Professionals.Security Operations Center (SOC), Incident Response (IR) and Threat Intelligence (TI) Teams.Board Level and Executive Decision Makers.
If you are responsible for protecting digital assets, customers or national infrastructure in Australia or New Zealand, this newsletter is for you.
We see the full picture of the evolving cyber threat landscape thanks to unique tools for monitoring the infrastructure used by cybercriminals and data from battlefields:
