AUNZ Intelligence Insights Report, March 2026

DieNet is a politically motivated threat actor group active since 2025, conducting DDoS, hacktivism and defacement attacks across government, financial services, telecommunications, education, energy and critical infrastructure. In March 2026 alone, they claimed over 192 attacks – compressing the equivalent of their prior 12 months of output into a single month. Their primary MITRE ATT&CK technique is Network Denial of Service. DieNet targets any nation or organisation they perceive as misaligned with their political position, including Australian government agencies, universities and major consumer brands. Their impact profile over the past 12 months includes 401 Network Denial of Service attacks and 12 Exfiltration Over C2 events.

Serious, and directly relevant to any team running open-source tooling in automated pipelines. The Trivy scanner compromise attributed to TeamPCP on 20 March affected multiple release versions and GitHub Actions workflows simultaneously. The attack succeeded because pipelines use version tags – which attackers can overwrite – rather than cryptographic hashes. The malicious code enabled credential stealing and exfiltration from downstream environments without visible tampering indicators. ANZ organisations should audit all third-party tool dependencies in their CI/CD pipelines, enforce hash-based integrity checks, and review GitHub Actions workflows for unexpected modifications.

March 2026 produced two significant ANZ-specific underground incidents. Infinity Australia’s financial services data including passport details, driver’s licences, tax file numbers and bank statements were listed for sale on exploit[.]in on 31 March by threat actor einein786. Phonebot customer data, including account-specific loyalty balances, was separately posted by threat actor 2019, a newly active actor specialising in healthcare, ecommerce and business services databases. Both incidents carry risk of follow-on fraud, identity theft and targeted social engineering against affected individuals.

Hacktivist groups aligned with pro-Iran or pro-Palestine political positions have significantly increased global attack tempo in response to the escalating Iran-Israel-US conflict. By 25 March 2026, Group-IB had recorded more than 500 conflict-linked cyber attacks globally. In Australia, three incidents were recorded in March: RipperSec’s DDoS on ZFA Australia, Z-Pentest’s claimed access to food services surveillance infrastructure in Queensland, and Group 313’s DDoS attack on the Moodle education platform affecting university staff and students. These attacks are motivated by Australia’s perceived geopolitical alignment. Organisations should monitor threat actor chatter and scheduled attack announcements via Group-IB’s Threat Intelligence Platform for early warning of planned operations.