Get 24/7 incident response assistance from our global team
Your guide to AI innovation, adoption, and acceleration in cybersecurity
Modern fraud isn't an event. It's an industrialised campaign that begins weeks before the payment. The transaction is where fraud ends, not where it happens. This paper shows how to disrupt the campaign weeks before the payment, not document it after.
Your guide to AI innovation, adoption, and acceleration in cybersecurity
Learn more
Group-IB’s intelligence report for July 2026 maps exactly who is targeting the Australia and New Zealand (ANZ) region right now — and what they will do next.
Drawing on Group-IB’s proprietary Threat Intelligence, dark web monitoring, and incident response data, this report details the ransomware, data-leak, infostealer, fraud, initial-access, and hacktivist activity shaping the region’s risk landscape between 1 and 31 July 2026.
This month, the ANZ region absorbed both financially driven cybercrime and geopolitical spillover. Australia bore the brunt with 89% of the 44 recorded incidents, while ransomware dominated the threat picture — 67% of incidents involved data encryption and extortion, followed by data sales and access-broker activity. The report gives security leaders a concise, evidence-based picture of the threats that matter, and a forward look at where August is likely to lead.
Every figure in this report is sourced from Group-IB’s own intelligence collection. It is written for defenders who need to prioritise, not just observe.
The Shai-Halud npm supply-chain worm redefined the risk.Ransomware pressure kept climbing across the region.Real Estate and Manufacturing were the most-hit ANZ sectors.The Origin Energy breach was the month’s most significant incident.Infostealers drove a large-scale credential-theft campaign.Initial access brokers advertised entry to major Australian businesses.Cross-border data sales exposed over 1.6 million Australian records.Healthcare targeting raised acute privacy concerns.CISOs and security leaders in Australia and New Zealand who need to prioritise defensive investment against the threats actually targeting the region.SOC and threat intelligence teams looking for current tactics, techniques, and procedures (TTPs) mapped to MITRE ATT&CK — including T1486 (Data Encrypted for Impact) and the exfiltration techniques seen in July’s hacktivist incidents.Fraud and financial-crime teams at banks, fintechs, and payment providers tracking compromised bank-card dumps and the Telegram-based distribution networks behind them.Risk, compliance, and board-level stakeholders who need a clear, evidence-based read on regional cyber risk and its regulatory implications.Software and DevSecOps teams responsible for open-source dependency risk in the wake of the Shai-Halud npm supply-chain attack.Government and critical infrastructure operators assessing nation-state and hacktivist spillover from the Middle East regional conflict.Download the ANZ Threat Landscape for July 2026 for the full breakdown of ransomware groups, infostealer trends, data leaks, initial-access activity, and the Adversary of the Month — sourced from Group-IB’s Threat Intelligence.
We see the full picture of the evolving cyber threat landscape thanks to unique tools for monitoring the infrastructure used by cybercriminals and data from battlefields:
