Alan Grant | SOC Analyst | 30 November2025        

‍

Welcome to Fortian’s November 2025 cyber environment update!

November saw a steady flow of developments across Australia’s cyber landscape, with a mix of government policy activity, emerging international threat trends and several notable incidents affecting local organisations. While none of these events represent a dramatic shift on their own, together they offer a useful snapshot of how the threat environment is evolving, from the growing use of AI in offensive operations to continued targeting of supply chains, third-party providers and high-trust platforms. This month’s update summarises the key developments and highlights the practical implications for organisations operating in Australia.

‍

Australian Government and Policy Updates

Australian cyber sanctions

In November, Australia utilised its sanctions framework on two separate occasions, to address several distinct cyber threats:

• ‍North Korea. On November 6, Australia, in coordination with the United States, imposed financial sanctions and travel bans on four North Korean entities and one individual involved in cybercrime, including large-scale cryptocurrency theft, to disrupt illegal revenue streams funding North Korea’s unlawful Weapons of Mass Destruction and ballistic missile programs. ( Minister for Foreign Affairs)
• Russia. On November 20, Australia, in a joint action with the United Kingdom and the United States, sanctioned two Russian cybercrime service providers (Media Land LLC and ML. Cloud LLC) and two of their key personnel. These entities were targeted for enabling malicious ransomware attacks against Australian financial institutions, businesses, and critical international infrastructure through the provision of "bulletproof hosting" services. Bulletproof hosting services are services offered by malicious providers allowing cybercriminals to securely and reliably host illegal content like ransomware and phishing sites. ( Minister for Foreign Affairs)

ASIO warns of Chinese cyber threats

In a speech to a Melbourne business Forum, Australian Security Intelligence Organisation (ASIO) Director-General Mike Burgess delivered a warning regarding the escalating threat of state-sponsored espionage and sabotage, explicitly calling out China-backed hackers. Burgess stated that Chinese foreign intelligence services are moving beyond traditional spying to engage in "high-harm" activities, primarily through the cyber domain. This threat has two critical dimensions: the ongoing theft of intellectual property and trade secrets which costs the Australian economy billions annually, and the concerning trend of pre-positioning for sabotage.

Specifically, Burgess warned that China-linked groups are targeting and mapping Australian critical infrastructure networks including telecommunications, water, and energy to gain persistent, undetected access. The intent of this pre-positioning is to gain the capability to conduct high-impact disruptions at a moment of their choosing, which could be devastating to national security and the economy.  (ABC news)

 

International Cyber Threats

Evolution in artificial intelligence use by malicious threat actors

In November, both Google and Anthropic released reports highlighting how malicious threat actors are mis-using their respective AI models, Gemini and Claude.

• The Google Threat Intelligence Group (GTIG) report detailed that adversaries are deploying novel, AI-enabled malware in active operations. GTIG identified the first use of "just-in-time" AI in malware families that use LLMs during execution to dynamically generate malicious scripts, obfuscate their own code to evade detection, or create malicious functions on demand. Furthermore, Google noted that state-sponsored actors from nations like North Korea, Iran, and China continue to use Gemini to enhance all stages of the attack lifecycle, from reconnaissance and phishing lure creation to command and control (C2) development and data exfiltration, often employing social engineering-like pretexts to bypass safety guardrails and gather harmful information. (Google)
• Meanwhile, Anthropic released a report detailing how it had disrupted the first reported AI-orchestrated cyber espionage campaign. Attributed with high confidence to a Chinese state-sponsored group, the attackers utilised the Anthropic’s Claude model as an autonomous agent to execute an attack targeting 30-40 companies. The AI performed an estimated 80 to 90 percent of the campaign's work, which involved manipulating the model to bypass safety guardrails, performing rapid reconnaissance on target systems, and then writing and executing exploit code to harvest credentials and exfiltrate data. (Anthropic)

Both report highlight that AI has shifted the calculus of cyber threats, moving LLMs from being productivity tools for criminals to being active, autonomous agents in attacks. To mitigate these threats, the reports highlight that organisations should adopt an AI-focussed defense posture, prioritizing zero trust, automated detection, and rigorous employee training.

Shai-Hulud 2.0

The Shai Hulud 2.0 attack, detected between 21 and 24 November 2025, marked a major escalation from the original Shai Hulud worm first seen in September. The initial wave focused on stealing developer keys, but the new variant was faster, stealthier and more technically advanced. It executed during the preinstall phase of the build process, giving it a much better chance of compromising developer workstations, build servers and CI environments before monitoring tools could intervene.

This early execution dramatically accelerated the spread. Any organisation importing an affected npm package was immediately exposed, as Shai Hulud 2.0 harvested high value secrets such as GitHub tokens and cloud credentials for AWS, Azure and Google Cloud. These credentials often provide access to customer data, production systems and sensitive source code, turning a single dependency into a high impact breach vector. The worm also included a destructive fallback mechanism sometimes described as a dead man’s switch, which attempted to wipe files if it could not exfiltrate secrets or propagate further. (Gitlab) Security researchers estimate that more than 600 to 800 npm packages were compromised, affecting tens of thousands of downstream projects, with over 25,000 GitHub repositories polluted with stolen secrets or malicious payloads.

To mitigate similar attacks, organisations should implement strict dependency management, lock packages to known safe versions, rotate exposed credentials, adopt short lived tokens, harden CI environments by restricting lifecycle scripts and outbound network access, and continuously monitor GitHub and cloud environments for anomalous activity. (Invicti)

 

Insider Recruitment by Scattered LAPSUS$ Hunters (SLSH)

November saw renewed scrutiny of the Scattered LAPSUS Hunters (SLSH), the alliance between Scattered Spider, ShinyHunters and Lapsus$.

• ‍CrowdStrike confirmed that it had terminated an internal employee who admitted selling screenshots and single sign on cookies to the group for USD 25,000. Access was cut quickly and no customer data was impacted, although SLSH still published screenshots on Telegram and claimed they attempted to purchase additional internal reports. This reinforced the group’s increasing reliance on insider recruitment, which now sits at the centre of their global Salesforce extortion operations and their emerging ransomware as a service ecosystem under the ShinySp1d3r brand.
• Around the same time, KrebsOnSecurity identified “Rey,” the teenage administrator and technical operator of SLSH, as Saif Al Din Khader, a 15 year old from Jordan, after a series of OPSEC failures linked reused passwords, infostealer logs and old defacement activity back to him. Saif acknowledged involvement when contacted.‍
• Zendesk impersonation attacks. SLSH also appears to be expanding into support platform impersonation attacks. Researchers have identified more than 40 typosquatted Zendesk domains that were being used to phish credentials and submit malicious support tickets. These fake portals closely mirrored Zendesk SSO pages and followed the same pattern as SLSH’s earlier Salesforce impersonation campaign, indicating an ongoing phase of their 2025 to 2026 operations. (Reliaquest)
• The group has boasted that they are running three to four campaigns in parallel and warned incident responders to monitor logs closely into early 2026. Given Zendesk’s role in more than 100,000 organisations, any compromise potentially offers a direct route into high trust workflows, amplifying the scale and impact of SLSH’s identity driven extortion model.

Given what we know about SLSH’s modus operandi, organisations should proactively enforce SSO with phishing resistant MFA, restrict administrator roles and make regular use of Zendesk’s security posture dashboard and best practice guidance to close high risk gaps such as weak passwords, unused admin accounts and insecure API tokens.

It is also critical to ensure that outsourced providers, including call centres and helpdesks, maintain strong security controls. This includes targeted security awareness training for call centre agents, secure and well governed password reset processes and strict limits on access to large repositories of sensitive customer data.

Australian Cyber Breaches

Medusa Ransomware Attack on Oscars Group

The Medusa ransomware group claimed responsibility for a 5 November attack on Oscars Group, a major hospitality operator with more than 35 venues across NSW. Medusa has threatened to leak sensitive business data, highlighting why large, distributed hospitality operators remain attractive targets for extortion crews. (Dexpose)

Kelly Legal Listed by INC Ransom

Queensland law firm Kelly Legal was listed by INC Ransom, which claims to have stolen more than 447GB of contracts, financial documents, HR files and customer records. The firm had previously described the October event as an IT and phone system outage. INC Ransom, active since 2023 and responsible for hundreds of extortion operations globally, has stated it intends to release the stolen data later in November. This continues the group’s pattern of targeting Australian organisations, following the earlier-year Spectrum Medical Imaging breach in which substantial patient data was accessed. (Cyberdaily)

IKAD Engineering Breach

Australian defence supplier IKAD Engineering was listed on a ransomware leak site, with leaked files referencing major ADF projects, including submarine work relating to the Hunter class frigate and the Collins class submarine programs. The attackers, known as J Group, claim they maintained access for five months through an outdated VPN vulnerability and exfiltrated up to 800 GB of data, publishing tens of thousands of emails, identity documents and project-related files. IKAD acknowledges unauthorised access but disputes that sensitive defence information was taken, stating only non-sensitive project and HR material was accessed. (ABC news)

Redback infantry fighting vehicles plans exposed

An Iranian-linked hacking group known as Cyber Toufan has published sensitive design material relating to Australia’s $7 billion Redback infantry fighting vehicle program after compromising several overseas defence contractors involved in supplying components for the platform. According to reporting, the leaked data includes detailed 3-D renderings, blueprints and technical information for key subsystems such as remote-weapon stations, turret assemblies and protection suites destined for the Australian Army’s next-generation armoured vehicles. While the breach occurred through foreign suppliers rather than Australian prime contractors, the incident underscores the strategic risk posed by increasingly aggressive supply-chain targeting, where adversaries bypass well-defended government networks by compromising smaller defence partners to gain insight into classified or sensitive military capabilities. (the Australian)

Healthcare Email Compromise: SCENT and PLMG

The Sydney Centre for Ear, Nose & Throat (SCENT) disclosed an email-account compromise that allowed attackers to send phishing messages. Although SCENT reports that its main patient database was not accessed, any personal or medical information contained in the compromised mailbox may have been exposed, including medical histories, diagnoses, referrals, and treatment plans. Regulators have been notified and affected patients advised to remain alert for scams. A similar incident occurred at Point Lonsdale Medical Group (PLMG), where an email account was accessed and used for phishing. While investigators could not determine which messages were viewed, PLMG elected to notify all patients due to the sensitivity of typical mailbox content. Both cases demonstrate the high privacy impact of even isolated mailbox breaches within healthcare environments. (Cyberdaily)

Key Takeaways

For Australian organisations, the events of November reinforce several practical themes.

• ‍Supply-chain visibility remains critical, particularly as attackers continue to favour indirect entry points such as software dependencies, outsourced support partners and smaller defence or technology suppliers. Identity remains a common weakness, underlined by SLSH’s reliance on compromised credentials and insider access, and by the increasing use of AI to automate reconnaissance, deception and credential harvesting. Organisations should continue strengthening MFA, privileged-access governance and monitoring of high-trust workflows such as CRM and helpdesk systems.
• More broadly, the growing use of AI in malicious operations suggests that traditional detection approaches may need to evolve, with greater emphasis on behavioural monitoring, zero-trust design and ensuring staff are equipped to recognise increasingly convincing phishing and impersonation attempts.
• The defence sector incidents also highlight the importance of maintaining strong controls over legacy infrastructure, including VPNs and remote-access pathways, which remain common targets.

‍