Ben Watson & Alan Grant | SOC Analyst | 4 April 2025        

‍

Welcome to Fortian's March 2025 cyber environment update!

U.S.-China Cyber Tensions

March saw new revelations of historical Chinese state-sponsored cyber activities targeting U.S. critical infrastructure. A report revealed new details that the threat actor known as Volt Typhoon had infiltrated the U.S. electricity grid in February 2023, maintaining undetected access for approximately 300 days until November 2023. During this period, they allegedly exfiltrated sensitive data, including geographic information system data detailing the layout of energy systems. (SecurityWeek)

In response to Chinese incursions into U.S. critical infrastructure, including the Salt Typhoon attacks against U.S. telecommunications sector companies, a coalition of Senate Republicans urged the Trump administration to initiate offensive cyber operations against China. They highlighted the persistent nature of Chinese cyber threats and advocated for decisive action to secure America's critical networks. (NextGov)

U.S. Releases Intelligence Community's 2025 Annual Threat Assessment

Further emphasising concerns about China, March saw the release of the U.S. Intelligence Community's 2025 Annual Threat Assessment, which identified China as the most comprehensive and robust cyber threat to the U.S., noting its likely increase in coercive actions towards Taiwan and ambitions to surpass U.S. advancements in artificial intelligence by 2030. (DNI.gov)

Aside from China, the Threat Assessment identified that:

• Russia has developed advanced cyber capabilities and has attempted to pre-position access to U.S. critical infrastructure, making it a persistent cyber threat. Russian cyber activities have been linked to multiple high-profile breaches, including the 2023 hack of Microsoft.
• Iran continues to enhance its cyber operations, posing a serious threat to U.S. networks and data. Iran's opportunistic approach to cyber attacks puts U.S. infrastructure at risk, demonstrating Tehran's willingness to target countries with stronger cyber capabilities than itself.
• North Korea is bolstering its strategic and conventional capabilities, including cyber operations aimed at targeting U.S. forces and allies in the region, as well as the U.S. homeland. North Korea's deepening ties with Russia have provided it with greater financial, military, and diplomatic support, enhancing its cyber capabilities.
• There is increasing cooperation among these adversaries, which is enhancing their collective cyber capabilities and poses a growing threat to U.S. national security. (DNI.gov)

Policy Shifts Continue to Impact U.S. Cybersecurity Initiatives

Despite ongoing cyber threats, the Trump administration implemented cuts affecting cybersecurity resources. In March, the Department of Homeland Security terminated the Critical Infrastructure Partnership Advisory Council (CIPAC), a key forum for public-private collaboration on cybersecurity policies and threat intelligence sharing. This raised concerns about weakened information sharing with the private sector and increased vulnerabilities in critical infrastructure. (Axios)

Additionally, the administration dismantled the U.S. Agency for Global Media, which operated Voice of America and Radio Free Asia—organizations established to counter disinformation from adversarial nations. This action has sparked debate over the potential impact on the U.S.'s ability to combat foreign propaganda. (DarkReading)

In the wake of these layoffs, reports emerged of a Chinese network attempting to recruit recently dismissed U.S. federal employees, particularly those with expertise in artificial intelligence. The nature and intent of these recruitment efforts have raised suspicions about potential connections to the Chinese government and its strategic objectives. (Reuters)

It remains to be seen how these changes to U.S. cybersecurity policy and operational capability affect the broader international cybersecurity environment.  

• In the short term, the concern is that a reduction in U.S. operational capability may create vulnerabilities through the disruption of critical information-sharing channels and a diminished capacity to respond to emerging cyber threats. Given the leadership role the U.S. has historically played, these effects will likely extend beyond the U.S.
• In the long term, these policy shifts could lead to a decline in international cyber collaboration.  Allies who perceive the U.S. as unreliable or retreating from its leadership role may seek alternative alliances or develop independent frameworks, potentially fragmenting global cybersecurity efforts. This could in turn complicate collective responses to transnational cyber threats.
• The reduction in information sharing and joint initiatives could also impede the development of deterrence strategies against state-sponsored cyber activities, emboldening some nations to exploit these divisions.
• While too soon to tell, the ultimate result could mean diminished capability and a reduced emphasis on cybersecurity cooperation, which in turn could weaken collective defence mechanisms that help maintain security and resilience.

Global Cybersecurity Concerns

Globally, the Medusa ransomware-as-a-service operation continued to pose a major challenge. As of February 2025, Medusa developers and affiliates had impacted over 300 victims across sectors including medical, education, legal, insurance, technology, and manufacturing. The group employs tactics such as encrypting victim data and threatening to release it publicly unless a ransom is paid. Organisations are advised to implement robust cybersecurity measures to defend against such attacks. (CISA)

In other news, Oracle, a U.S. software and technology company suffered a major cyber incident potentially impacting over 140,000 clients. A threat actor reportedly breached one of Oracle's federated SSO login servers at login.us2.oraclecloud.com by exploiting an unpatched vulnerability. They were then able to exfiltrate over 6 million client records. Organisations can check whether they were impacted by visiting exposure.cloudsek.com/oracle.

Federal investigators in the U.S. linked a $150 million cryptocurrency theft to the 2022 LastPass data breach. The attackers reportedly cracked master passwords for the password vaults stolen from LastPass in 2022 and once cracked, used information gathered to access cryptocurrency wallets, particularly targeting users who had stored their seed phrases and private keys in the 'Secure Notes' feature of LastPass. The breach highlights the long-tail impact of credential compromise and underscores the concentration risk of storing highly sensitive information within password managers. (KrebsOnSecurity).

Australia’s 2025 Budget and Cybersecurity

Australia's 2025 Federal Budget revealed no new spending on cybersecurity in 2025. While the budget mentions $60 million that was previously committed to support small business cybersecurity capabilities, no major new initiatives to enhance national cyber resilience were introduced. (CyberDaily)

In his response, while Opposition Leader Peter Dutton criticised the Budget’s lack of emphasis on national security and defence, Dutton only mentioned cyber once – in the context that the Coalition would “encourage new areas of the economy… like… cyber security” (PeterDutton))

Given the above, it would appear that cybersecurity is not a top-tier issue for either party, possibly taking a back seat to other political concerns.

ACSC Critical Advisories

In March, the ACSC advised organisations urgently patch two critical vulnerabilities that have proof of concept (POC) exploit code available. So far there have been no reports of exploitation in the wild, however, the availability of POC code makes the likelihood of these vulnerabilities being targeted by threat actors very high.  Fortian recommends Australian organisations review their usage of the vulnerable software and patch urgently if impacted. (cyber,.gov.au)

• The ACSC warned of a vulnerability in open-source react framework next.js (CVE-2025-29927) that if exploited, could allow a threat actor to bypass security checks, including many forms of authentication.
• The ACSC also warned of a vulnerability in Ingress-NGINX Controller for Kubernetes that could allow unauthenticated remote code execution and cluster takeover.  Organisations using Ingress-NGINX are advised to update to the latest version, and ensure their admission webhook endpoint is not exposed externally.

Other Australian Cybersecurity Issues

The Australian Securities and Investments Commission (ASIC) has initiated legal action against FIIG Securities Limited (FIIG), alleging that between March 13, 2019, and June 8, 2023, FIIG failed to implement adequate cybersecurity measures. This purported negligence led to a cyber intrusion beginning on May 19, 2023, during which approximately 385GB of data, including sensitive personal information of FIIG's clients, was stolen and subsequently published on the dark web.

ASIC contends that FIIG's inadequate cybersecurity measures include the lack of appropriately configured and monitored firewalls, failure to update and patch software to address security vulnerabilities, absence of mandatory cybersecurity training for staff, and insufficient allocation of resources to manage cybersecurity risks. These failures purportedly exposed FIIG and its clients to heightened and unreasonable cybersecurity risks, culminating in the May 2023 data breach. (ASIC)

Brydens Lawyers suffered a cyber incident after an unknown threat actor gained unauthorised access to the firm's servers. An unknown party claimed responsibility for the breach online and stated they had exfiltrated 600 gigabytes of data, including case, client and staff data, and would release the data unless a ransom was paid. Brydens Lawyers obtained an injunction after the breach to prevent the further dissemination of the data by other entities. (lawyer's weekly)‍

The NSW Online Registry website suffered a major data breach.  Approximately 9000 sensitive court files, including apprehended violence orders and affidavits were downloaded by an unknown third party. NSW Police confirmed they were investigating and advised any party who believes they may have been impacted to report their case through ReportCyber. (Itnews)

Finally, Sydney Tools exposed over 5000 employee records and 34 million customer orders after one of their Clickhouse databases was left unprotected online. The data included sensitive payroll information and personal identifiable data. News of the data leak emerged on the 26th March, when researchers stated the database was still exposed online. (Daily Security Review)

Key takeaways for Australian organisations

Australian organisations should undertake the following tactical actions:

• Oracle customers should check whether are impacted by the cybersecurity incident and take action accordingly.  exposure.cloudsek.com/oracle.
• Read both ACSC advisories mentioned above and determine if they are exposed to the Ingress-NGINX and next.js vulnerabilities and take action accordingly.

‍