GUEST OPINION: Cybercrime has become a structured, global enterprise, operating at a scale that rivals some of the world’s largest economies and influencing strategic risk conversations across government and industry.
Many threat groups have adopted commercial structures, offering ransomware kits, stolen credentials, and remote access tools through established distribution models. This level of professionalisation has lowered the technical threshold for participation and significantly increased the volume and complexity of attacks.
Australia continues to attract a growing share of this activity. Its advanced digital economy, strategic position in the Indo-Pacific, and close alignment with global powers heighten its visibility to both cybercriminal networks and state-aligned actors. The Australian Cyber Security Centre (ACSC) receives a report of cybercrime every six minutes, indicating sustained, deliberate targeting by well-resourced adversaries, rather than an isolated trend.[1]
Craig Searle, director, consulting and professional services (Pacific) and global leader of cyber advisory, Trustwave, said, “Much of the activity Australia sees is politically motivated. The nation’s position within alliances such as Five Eyes, AUKUS, and ANZUS increases its strategic value to state-aligned actors, as these groups actively pursue intelligence from governments, defence contractors, and critical infrastructure (CI) providers. Attackers have previously compromised multiple contractor systems connected to sensitive national projects, using those footholds to attempt deeper infiltration.
“These operations are rarely fast or noisy; they are slow, methodical, and deliberate. Most aim to gather information without being detected, making access the objective, not damage. Maintaining that access lets attackers monitor developments, steal data over time, and prepare for future disruption if needed.”
Cybercriminals are equally persistent. Their focus often falls on sectors with high-impact potential, including health, energy, telecommunications, and research. These industries rely on complex systems and multiple third parties, which creates opportunities for compromise. Attackers exploit gaps in network segmentation, software supply chains, and remote access controls, with many also targeting operational technology (OT) and connected devices that lack modern security controls. Compromising these systems can shut down essential services, damage CI, and create serious safety risks for the public.
However, not all threats come from outside, and a significant number of incidents begin with internal error. The Office of the Australian Information Commissioner (OAIC) reports that 30 per cent of data breaches result from human mistakes.[2] In some cases, these involve misdirected emails or misconfigured permissions. In others, staff provide access to malicious actors unknowingly through phishing or insecure credentials. These small lapses often create the initial opening that external attackers need to move deeper into critical systems.
Craig Searle said, “The goals remain consistent: financial gain; access to intellectual property; insight into political or military strategies; and long-term influence. What has changed is the method, as threat actors now use artificial intelligence (AI) to create convincing phishing messages. Some attackers purchase credentials from dark web marketplaces, while others exploit new vulnerabilities before security teams can respond. These campaigns are well-funded and highly targeted.”
Australia’s growing influence within global defence, policy, and technology development will also increase its appeal to foreign intelligence services. These actors will continue to seek footholds in systems that control CI and store sensitive data. Many will also target organisations connected to government, defence, or emerging technology programs, including research institutions, contractors, and consultancies. Access to these environments can provide insight into strategic plans, defence capabilities, or innovations that offer a competitive advantage.
Craig Searle said, “This means that cybersecurity must now be treated as a core business issue. Board members and senior executives need to understand the direct relationship between cyber risk and operational resilience. Strong governance, real-time threat intelligence, and cultural change are essential, and security must become part of daily operations across every level of an organisation.
“Australia holds a central position in global security partnerships and advanced digital development. That visibility creates opportunity and risk in equal measure. Protecting national interests demands a coordinated response that includes government, private enterprise, and critical service providers. The threat will continue to escalate; however, proactive leadership can determine the outcome.”
[1] https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2023-2024
[2] https://www.oaic.gov.au/privacy/notifiable-data-breaches/notifiable-data-breaches-publications/notifiable-data-breaches-report-january-to-june-2024