Summary Points
-
The cyber threat environment in Australia and New Zealand has become highly sophisticated in 2025, with cybercriminals actively selling compromised network access on a mature underground marketplace, mainly targeting data-rich sectors like retail, banking, and healthcare.
-
Retail organizations were most heavily targeted, accounting for about 34% of initial access sales, with key threat actors like cosmodrome and Shopify’s alias leading the fragmented marketplace, which collectively controls only 26% of listings.
-
Recent incidents include a major attack on an Australian airline compromising nearly six million customer records and a large Australian retail chain exposing 250 GB of data, exemplifying the tangible threats from this underground access economy.
-
The decentralized and scalable nature of this illicit access market significantly heightens cyber risks for organizations across Australia and New Zealand, as it facilitates diverse threat actors to monetize stolen credentials globally throughout 2026.
Underlying Problem
Throughout 2025, the cyber threat landscape in Australia and New Zealand significantly worsened. Threat actors, leveraging a highly sophisticated underground marketplace, successfully orchestrated numerous attacks mainly by selling compromised network access. This marketplace, documented by Cyble Research and Intelligence Labs, showed at least 92 instances of stolen access being bought and sold across cybercrime forums. Significantly, the most targeted industries were those rich in data, such as retail, banking, healthcare, and professional services. Retail organizations, in particular, became the prime targets, accounting for about one-third of access sales, which indicates that cybercriminals prioritize sectors with the highest potential for financial gain or valuable information. Notably, major attacks included a 6 million customer data breach involving an Australian airline by the group Scattered Spider, and a massive data leak from a retail chain advertised for sale online. These incidents underscore a decentralized yet potent underground ecosystem, with multiple cybercriminal groups, like cosmodrome and shopify, collectively controlling only a quarter of the listings despite their prominence. This thriving illicit market, fueled by diverse threat actors, increases the cyber risks faced by organizations across the region, emphasizing the critical need for enhanced cybersecurity measures in 2026.
Potential Risks
The issue of cyber threats, such as targeted attacks fueled by initial access sales and ransomware campaigns, poses a serious risk to any business—regardless of size or industry. When cybercriminals acquire and sell initial access, they can easily exploit vulnerabilities, allowing rapid infiltration. Subsequently, ransomware can lock your systems and demand hefty payouts, crippling operations. As a result, your business faces data loss, financial damage, and reputational harm. Moreover, these attacks often cause costly downtime, disrupt customer trust, and require extensive recovery efforts. Therefore, understanding this threat landscape is crucial, because any business could become a victim, leading to substantial operational and financial setbacks.
Possible Next Steps
In the rapidly evolving landscape of cyber threats targeting Australia and New Zealand, swift and effective remediation is crucial to minimize damage and restore security integrity, especially as these attacks are often facilitated by initial access sales and ransomware campaigns that can escalate quickly if not promptly addressed.
Assessment & Identification
- Conduct thorough threat hunting and vulnerability scans to identify compromised assets and intrusion points.
- Analyze attack vectors and entry points related to initial access sales and ransomware payloads.
Containment & Isolation
- Isolate affected systems immediately to prevent lateral movement of threats.
- Disable compromised accounts or network segments linked to the breach.
Remediation & Recovery
- Remove malicious files, unauthorized access tools, and ransomware payloads.
- Apply patches and update systems to close exploited vulnerabilities.
Communication & Coordination
- Notify relevant authorities, such as national cybersecurity agencies, and coordinate with incident response teams.
- Inform stakeholders while maintaining confidentiality to prevent further exploitation.
Prevention & Strengthening
- Implement multi-factor authentication and stricter access controls to limit initial access opportunities.
- Regularly back up critical data and test recovery procedures to ensure quick restoration.
Monitoring & Improvement
- Continuously monitor networks for anomalous activities post-remediation.
- Review and update cybersecurity policies and controls based on lessons learned from incidents.
Continue Your Cyber Journey
Explore career growth and education via Careers & Learning, or dive into Compliance essentials.
Access world-class cyber research and guidance from IEEE.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1cyberattack-v1-multisource
