The cyber threat landscape has evolved at lightning speed. Attackers are no longer lone hackers; they’re organised, AI-powered, and industrialised. For businesses and their customers, this means the risks are bigger, faster, and harder to detect.
Here’s what’s happening now and the strategic priorities boards should be focusing on next.
WHO ARE TODAY’S MOST ACTIVE THREAT ACTORS IN JANUARY 2026?
Cybercrime in 2026 is no longer driven by lone operators. It is fuelled by highly organised groups with geopolitical and financial motives. These are the key players shaping the threat landscape right now and the ones most likely to impact your business and your customers.
Before discussing what businesses must do, it is critical for boards to understand who is targeting Australian organisations and why.
APT40
- Targets Australian government, healthcare research and financial services
- Exploits VPN weaknesses and zero-day vulnerabilities to steal sensitive data and intellectual property
Lynx Ransomware Group
- Actively breaching Australian SMBs and professional services using ransomware-as-a-service
- Uses double extortion tactics, encrypting systems and threatening public data leaks
Qilin & Rhysida
- Target healthcare providers, aged-care facilities and finance supply chains
- Focus on low cyber maturity environments with high operational impact
EMERGING TRENDS
Healthcare
- IoMT (Internet of Medical Things) API exploits
- Ransomware disrupting patient care
Finance
- AI-driven voice cloning used to authorise fraudulent transactions
SMBs and NFPs
- Legacy VPNs and weak MFA targeted by ransomware-as-a-service gangs
WHY ARE THESE THREAT ACTORS GROUPS ATTACKING AUSTRALIAN BUSINESSES?
The groups attacking Australian organisations today are motivated by two things: geopolitical advantage and financial gain. State-sponsored actors like APT40 seek intellectual property and sensitive data to strengthen national interests, while ransomware gangs such as Lynx, Qilin, and Rhysida exploit sectors with high operational impact and low cyber maturity, knowing disruption forces quick ransom payments. Healthcare, finance, SMBs, and not-for-profits are prime targets because they hold valuable personal and financial data, rely on complex supply chains, and often lack enterprise-grade security. For boards, this means cyber risk is not just an IT issue and it’s a strategic threat to business continuity, reputation, and compliance.
THE THREATS YOU CAN’T IGNORE
- AI-Driven Attacks
Cybercriminals are using artificial intelligence to automate attacks, making them faster and more evasive. AI powers hyper-realistic phishing, voice cloning, and deepfake impersonations, tricking even the savviest employees!
- Identity-Centric Breaches
Passwords and traditional MFA are under siege. Advanced phishing kits and session hijacking mean attackers can bypass old defenses with ease.
- Industrialised Cybercrime
Ransomware-as-a-Service continues to surge, with criminal groups now using double and even triple extortion. They encrypt data, steal it and apply pressure by threatening customers and partners.
- Supply Chain & Cloud Exploits
Attackers target vendors and cloud misconfigurations, injecting malicious code into software pipelines and exploiting trust relationships.
- Trust Abuse
From fake VPN portals to fraudulent collaboration invites, attackers manipulate perception and exploit trusted platforms to gain access.
THE 7 CYBER TRUTHS BOARDS MUST ACT ON
- Build a Zero Trust Foundation
Move beyond passwords. Verify every user and device continuously. Adopt passwordless authentication and biometrics.
- Prepare for Ransomware Before It Hits
Keep immutable backups offline or in secure cloud vaults. Combine layered defenses with 24/7 monitoring. Run tabletop exercises so leaders know what to do when systems go dark.
- Secure Your Supply Chain
Demand security certifications from vendors. Request a Software Bill of Materials (SBOM) for transparency. Have clear playbooks for vendor breaches.
- Protect Against Identity Attacks
Encourage long passphrases, block known breached passwords, and enforce MFA, while monitoring for MFA fatigue attacks.
- Close AI Governance Gaps
Define what staff can and cannot do with AI tools. Monitor usage and train employees on AI risks; just like financial compliance.
Introduce “AI and Data Governance” as a standing board agenda item covering: AI use cases, model/data risk, third-party AI, and compliance.
- Build a Cyber-Resilient Culture
Technology alone won’t save you. Regular training reduces phishing success rates dramatically. Include cyber risk metrics in board dashboards. Treat cybersecurity like financial risk, because that’s exactly what it is.
- Ensure the Board is Accountable
Mandate at least annual independent cyber maturity assessment and pen testing, with results presented directly to the board, this would include business impact focused risk reporting (top 5 cyber risks, trend, residual risk, and treatment plans).
Schedule at least one cyber crisis tabletop exercise per year that includes the board and C-suite, focused on ransomware and data breach scenarios.
CYBER SECURITY IN 2026
Cybersecurity in 2026 is about trust, resilience, and reputation. Boards must lead the charge by prioritising identity security, AI governance, and supply chain resilience.
Every organisation faces attacks. The differentiator is how effectively you’re prepared to handle them.
CALL TO ACTION
Not sure where to start? You’re not alone. Cybersecurity can feel overwhelming, but standing still is the only guaranteed way to fall behind.
We’re offering a complimentary 1-hour board cyber risk briefing to give executives real clarity on their exposure, the actions that matter and a practical resilience plan they can put to work immediately.
If you want continued support, our vCISO service becomes your security translator. We turn threat intel into clear board language, guide policy and investment decisions and handle the heavy lifting of risk registers, remediation tracking and compliance evidence for regulators, insurers and customers.
Book your session and give your leadership team the confidence to act, not react.
Sources:
APT40
Australian Cyber Security Centre Advisory
Lynx Ransomware Group
LinkedIn Threat Advisory
Qilin & Rhysida
https://securityaffairs.com/2025/11/qilin-ransomware.htm & https://thehackernews.com/2025/12/rhysida-ransomware-hits-healthcare.html
AI-Driven Attacks & Social Engineering
https://www.tenable.com/blog, https://www.forbes.com/cybersecurity, https://cloud.google.com/blog/topics/security, https://www.cybersecurity-insiders.com
Identity-Centric Breaches & MFA Bypass
https://www.cybersecurity-insiders.com, https://exploresec.com
Industrialised Cybercrime & Ransomware Evolution
https://www.fortinet.com/blog, https://www.cybersecurity-insiders.com
Supply Chain & Cloud Exploits
https://www.forbes.com/cybersecurity
Trust Abuse & Perception Manipulation
https://www.firecompass.com, https://exploresec.com