Get 24/7 incident response assistance from our global team
Please review the following rules before submitting your application:
1. Our main objective is to foster a community of like-minded individuals dedicated to combatting cybercrime and who have never engaged in Blackhat activities.
2. All applications must include research or a research draft. You can find content criteria in the blog. Please provide a link to your research or research draft using the form below.
Your guide to AI innovation, adoption, and acceleration in cybersecurity
Modern fraud isn't an event. It's an industrialised campaign that begins weeks before the payment. The transaction is where fraud ends, not where it happens. This paper shows how to disrupt the campaign weeks before the payment, not document it after.
Your guide to AI innovation, adoption, and acceleration in cybersecurity
Learn more
Group-IB’s monthly threat intelligence report on the cybercriminal, hacktivist and nation-state activity targeting Australia and New Zealand between 1 and 31 August 2026. It documents 53 threat events across the region — led by a 8.7% rise in ransomware, a healthcare-sector surge, and the sudden emergence of Storm Ransomware — all sourced from Group-IB’s own intelligence collection.
August was defined by one word: intensification.
A brand-new group, Storm Ransomware, claimed five Australian victims in under three weeks and tied Qilin as the region’s most active operator — in its very first month. Healthcare became the most-targeted sector, with attacks more than tripling July’s count. And a Telegram-based carding ecosystem aimed squarely at Australian banks came into full view.
Australia was named in 89% of events. Every ransomware incident was rated amber severity — substantial business impact, real regulatory exposure.
Every figure here comes from Group-IB’s own collection. Written for defenders who need to prioritise, not just observe.
Storm Ransomware went from zero to #1 in weeks.Healthcare was August's hardest-hit sector.Ransomware kept climbing.A carding ecosystem locked onto Australian banks.Cross-border data sales widened.Compromised-account volume fell 90% — but don't relax.Rhadamanthys was the quiet riser.OT targeting reached New Zealand.CISOs and security leaders across Australia and New Zealand prioritising defence against the threats actually hitting the region.SOC and threat intelligence teams who need current tactics, techniques, and procedures (TTPs) mapped to MITRE ATT&CK.Fraud and financial-crime teams at banks and fintechs tracking the ANZ carding ecosystem and compromised-card channels.Government and critical infrastructure operators assessing nation-state and OT-focused hacktivist activity.Risk, compliance, and board stakeholders who need an evidence-based read on regional cyber risk and its regulatory implications.Group-IB documented 53 threat events across Australia and New Zealand in August 2026, including 25 ransomware incidents, 16 data-leak publications and 4 hacktivism events. Australia was named in 89% of events.
A ransomware group first observed by Group-IB on 13 August 2026. In its first month it claimed five Australian victims across agriculture, automotive and construction, tying Qilin as the region’s most active operator and running a Tor-based data-leak site.
Healthcare, with seven ransomware events — more than triple July’s count — spanning dental, medical, pharmaceutical and health-platform organisations.
They fell 90.13% to 26,766 records, mirroring an 86% global drop, because these counts reflect when stealer logs surface and are processed — not a like-for-like fall in infections. Figures typically rise as later logs are ingested.
Qilin and Storm Ransomware tied as the most active in August, followed by The Gentlemen and Cl0p.
Yes. The August 2026 ANZ Threat Landscape is a free download via the form on this page.
We see the full picture of the evolving cyber threat landscape thanks to unique tools for monitoring the infrastructure used by cybercriminals and data from battlefields:
