Skip to content
OriginalSign in
Image: SOCRadar

SOCRadarAmeer Owda

Australia reports 20% rise in cyber incidents in 2025-26

Part of the Storm-1567 story · since 28 Aug 2025

Developinglatest 2 hours ago33 articles13 outlets
28 Aug · Dark Reading first28 Mar8 Jun19 AugNowThis article33rd of 33
  • Thu 28 Aug, 21:10 UTC. Dark Reading, first report. Akira, Clop Top List of 5 Most Active Ransomware-as-a-Service Groups.
  • Thu 11 Sep, 02:55 UTC. SecurityOnline, its first report on the story. ACSC Warns of Active Exploitation of SonicWall SSL VPN Vulnerability (CVE-2024-40766).
  • Thu 11 Sep, 11:50 UTC. The Hacker News, its first report on the story. SonicWall SSL VPN Flaw and Misconfigurations Actively Exploited by Akira Ransomware Hackers.
  • Thu 11 Sep, 12:55 UTC. SecurityWeek, its first report on the story. Akira Ransomware Attacks Fuel Uptick in Exploitation of SonicWall Flaw.
  • Thu 11 Sep, 21:16 UTC. Security Affairs, its first report on the story. Akira Ransomware exploits year-old SonicWall flaw with multiple vectors.
  • Wed 17 Sep, 04:05 UTC. SecurityOnline. A Security Engineer’s Mistake Led to a Ransomware Breach.
  • Sun 28 Sep, 22:15 UTC. BleepingComputer, its first report on the story. Akira ransomware breaching MFA-protected SonicWall VPN accounts.
  • Mon 29 Sep, 01:45 UTC. SecurityOnline. Akira Ransomware Exploits SonicWall VPN Accounts With Lightning-Fast Intrusions.
  • Mon 29 Sep, 09:51 UTC. SecurityWeek. Akira Ransomware’s Exploitation of SonicWall Vulnerability Continues.
  • Mon 29 Sep, 11:21 UTC. Security Affairs. Akira Ransomware bypasses MFA on SonicWall VPNs.
  • Mon 29 Sep, 11:56 UTC. GBHackers, its first report on the story. Cybercriminals Target SonicWall Firewalls to Deploy Akira Ransomware via Malicious Login Attempts.
  • Mon 29 Sep, 21:31 UTC. Dark Reading. Akira Hits SonicWall VPNs in Broad Ransomware Campaign.
  • Thu 9 Oct, 11:05 UTC. Darktrace, its first report on the story. Akira SonicWall Campaign Uncovered.
  • Fri 10 Oct, 12:21 UTC. GBHackers. SonicWall SSL VPN Devices Targeted by Threat Actors to Distribute Akira Ransomware.
  • Mon 13 Oct, 01:15 UTC. SecurityOnline. Akira Ransomware Revives SonicWall Flaw CVE-2024-40766, Uses ‘UnPAC the Hash’ to Breach Networks.
  • Sat 1 Nov, 10:26 UTC. GBHackers. Akira Ransomware Strikes Apache OpenOffice, Allegedly Exfiltrates 23GB of Data.
  • Mon 3 Nov, 01:01 UTC. SecurityOnline. Open-Source AdaptixC2 Hacking Framework Adopted by Russian Cybercriminals and Akira Ransomware.
  • Fri 14 Nov, 06:01 UTC. GBHackers. CISA Warns: Akira Ransomware Has Extracted $42M After Targeting Hundreds.
  • Fri 14 Nov, 12:40 UTC. SecurityWeek. Akira Ransomware Group Made $244 Million in Ransom Proceeds.
  • Fri 14 Nov, 22:20 UTC. Dark Reading. Akira RaaS Targets Nutanix VMs, Threatens Critical Orgs.
  • Tue 18 Nov, 01:00 UTC. SecurityOnline. CISA/Europol Warn: Akira Ransomware Profits Hit $244M, Group Expands to Encrypt Nutanix AHV VMs.
  • Wed 19 Nov, 00:45 UTC. Unit 42, its first report on the story. Anatomy of an Akira Ransomware Attack: When a Fake CAPTCHA Led to 42 Days of Compromise.
  • Thu 20 Nov, 02:01 UTC. SecurityOnline. One Click, 42 Days: Akira Ransomware Used CAPTCHA Decoy to Destroy Cloud Backups and Cripple Storage Firm.
  • Wed 10 Dec, 14:01 UTC. DataBreaches, its first report on the story. Akira ransomware: FBI tallies 250 million in payouts.
  • Thu 2 Apr, 13:56 UTC. Infosecurity, its first report on the story. Researchers Observe Sub-One-Hour Ransomware Attacks.
  • Mon 27 Apr, 14:59 UTC. DataBreaches. Ransomware gang behind half of cyber claims via SonicWall.
  • Wed 27 May, 22:01 UTC. SANS ISC, its first report on the story. Akira ransomware breach exposed by missing SSLVPN log integration.
  • Wed 3 Jun, 12:06 UTC. SOCRadar, its first report on the story. Brazil faces surge in ransomware as top threat actors target 2026.
  • Tue 23 Jun, 04:11 UTC. SANS ISC. CVE-2024-40766 exposes SonicWall firewalls to ransomware. Cites a CVE in CISA KEV.
  • Thu 13 Aug, 10:31 UTC. Infosecurity. Akira Ransomware Fails After Safe Mode Trick on SonicWall VPN.
  • Mon 17 Aug, 07:47 UTC. Security Affairs. SonicWall VPN Gap Lets Akira Ransomware Try Safe Mode Evasion.
  • Wed 21 Oct, 12:22 UTC. Infosecurity. Ransomware Attacks Jump 50% as Data Theft Replaces Encryption.
  • Tue 27 Oct, 13:40 UTC. SOCRadar. Australia reports 20% rise in cyber incidents in 2025-26. This article, 33rd of 33.

Australia’s cyber security authority responded to 1,524 incidents in the 2025-26 financial year, up 20% on the previous year and 36% over five years, according to the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC). The authority also sent more than 4,400 warnings about potential malicious activity, almost 80% more than a year earlier. These figures cover different reporting channels and should not be treated as counts of unique victims.

Phishing featured in 39% of analysed incidents, followed by compromised accounts at 21%. ASD’s ACSC handled 98 data breach incidents, up 66%, and 139 ransomware incidents, broadly unchanged from the previous year. However, extensive ransomware compromises rose from 16 to 24, while extensive compromises across incidents increased from 26 to 40.

The report says most vulnerability exploitation happens within two weeks of disclosure, with some flaws exploited within 48 hours of patch or mitigation guidance; attackers also successfully exploited a vulnerability first identified in 2008.

The report describes AI as speeding up established techniques, including phishing, reconnaissance and exploit development. It also cites risks from stolen credentials and tokens used to access code repositories and compromise software packages. In one Akira ransomware investigation, information from multiple organisations helped ASD’s ACSC identify almost 1,000 potentially vulnerable devices and about 40 potentially vulnerable Australian organisations, many in critical infrastructure.

The authority issued targeted warnings, after which similar reported incidents declined. Its recommendations include faster patching, stronger identity protections, better logging, tighter control of supplier and software access, and tested plans to keep critical services running during incidents.

How the story developed

All 33 articles
Developinglatest 2 hours ago33 articles13 outlets

33 articles from 13 outlets since 28 Aug. Picked up again today after 6 days quiet. This was the 33rd report, 425 days after the first.

Now28 Aug1982929 Mar22315526187First reportDark Reading · 28 Aug, 21:10This article33rd of 33 · day 425Exploited CVESANS ISC · 23 Jun
  • Thu 28 Aug, 21:10 UTC. Dark Reading, first report. Akira, Clop Top List of 5 Most Active Ransomware-as-a-Service Groups.
  • Thu 11 Sep, 02:55 UTC. SecurityOnline, its first report on the story. ACSC Warns of Active Exploitation of SonicWall SSL VPN Vulnerability (CVE-2024-40766).
  • Thu 11 Sep, 11:50 UTC. The Hacker News, its first report on the story. SonicWall SSL VPN Flaw and Misconfigurations Actively Exploited by Akira Ransomware Hackers.
  • Thu 11 Sep, 12:55 UTC. SecurityWeek, its first report on the story. Akira Ransomware Attacks Fuel Uptick in Exploitation of SonicWall Flaw.
  • Thu 11 Sep, 21:16 UTC. Security Affairs, its first report on the story. Akira Ransomware exploits year-old SonicWall flaw with multiple vectors.
  • Wed 17 Sep, 04:05 UTC. SecurityOnline. A Security Engineer’s Mistake Led to a Ransomware Breach.
  • Sun 28 Sep, 22:15 UTC. BleepingComputer, its first report on the story. Akira ransomware breaching MFA-protected SonicWall VPN accounts.
  • Mon 29 Sep, 01:45 UTC. SecurityOnline. Akira Ransomware Exploits SonicWall VPN Accounts With Lightning-Fast Intrusions.
  • Mon 29 Sep, 09:51 UTC. SecurityWeek. Akira Ransomware’s Exploitation of SonicWall Vulnerability Continues.
  • Mon 29 Sep, 11:21 UTC. Security Affairs. Akira Ransomware bypasses MFA on SonicWall VPNs.
  • Mon 29 Sep, 11:56 UTC. GBHackers, its first report on the story. Cybercriminals Target SonicWall Firewalls to Deploy Akira Ransomware via Malicious Login Attempts.
  • Mon 29 Sep, 21:31 UTC. Dark Reading. Akira Hits SonicWall VPNs in Broad Ransomware Campaign.
  • Thu 9 Oct, 11:05 UTC. Darktrace, its first report on the story. Akira SonicWall Campaign Uncovered.
  • Fri 10 Oct, 12:21 UTC. GBHackers. SonicWall SSL VPN Devices Targeted by Threat Actors to Distribute Akira Ransomware.
  • Mon 13 Oct, 01:15 UTC. SecurityOnline. Akira Ransomware Revives SonicWall Flaw CVE-2024-40766, Uses ‘UnPAC the Hash’ to Breach Networks.
  • Sat 1 Nov, 10:26 UTC. GBHackers. Akira Ransomware Strikes Apache OpenOffice, Allegedly Exfiltrates 23GB of Data.
  • Mon 3 Nov, 01:01 UTC. SecurityOnline. Open-Source AdaptixC2 Hacking Framework Adopted by Russian Cybercriminals and Akira Ransomware.
  • Fri 14 Nov, 06:01 UTC. GBHackers. CISA Warns: Akira Ransomware Has Extracted $42M After Targeting Hundreds.
  • Fri 14 Nov, 12:40 UTC. SecurityWeek. Akira Ransomware Group Made $244 Million in Ransom Proceeds.
  • Fri 14 Nov, 22:20 UTC. Dark Reading. Akira RaaS Targets Nutanix VMs, Threatens Critical Orgs.
  • Tue 18 Nov, 01:00 UTC. SecurityOnline. CISA/Europol Warn: Akira Ransomware Profits Hit $244M, Group Expands to Encrypt Nutanix AHV VMs.
  • Wed 19 Nov, 00:45 UTC. Unit 42, its first report on the story. Anatomy of an Akira Ransomware Attack: When a Fake CAPTCHA Led to 42 Days of Compromise.
  • Thu 20 Nov, 02:01 UTC. SecurityOnline. One Click, 42 Days: Akira Ransomware Used CAPTCHA Decoy to Destroy Cloud Backups and Cripple Storage Firm.
  • Wed 10 Dec, 14:01 UTC. DataBreaches, its first report on the story. Akira ransomware: FBI tallies 250 million in payouts.
  • Thu 2 Apr, 13:56 UTC. Infosecurity, its first report on the story. Researchers Observe Sub-One-Hour Ransomware Attacks.
  • Mon 27 Apr, 14:59 UTC. DataBreaches. Ransomware gang behind half of cyber claims via SonicWall.
  • Wed 27 May, 22:01 UTC. SANS ISC, its first report on the story. Akira ransomware breach exposed by missing SSLVPN log integration.
  • Wed 3 Jun, 12:06 UTC. SOCRadar, its first report on the story. Brazil faces surge in ransomware as top threat actors target 2026.
  • Tue 23 Jun, 04:11 UTC. SANS ISC. CVE-2024-40766 exposes SonicWall firewalls to ransomware. Cites a CVE in CISA KEV.
  • Thu 13 Aug, 10:31 UTC. Infosecurity. Akira Ransomware Fails After Safe Mode Trick on SonicWall VPN.
  • Mon 17 Aug, 07:47 UTC. Security Affairs. SonicWall VPN Gap Lets Akira Ransomware Try Safe Mode Evasion.
  • Wed 21 Oct, 12:22 UTC. Infosecurity. Ransomware Attacks Jump 50% as Data Theft Replaces Encryption.
  • Tue 27 Oct, 13:40 UTC. SOCRadar. Australia reports 20% rise in cyber incidents in 2025-26. This article, 33rd of 33.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 33 articles as a list
  1. Thu 28 AugDay 01
    1. Akira, Clop Top List of 5 Most Active Ransomware-as-a-Service Groups21:10 · Dark Reading · First report

  2. Quiet for 13 days

    Thu 11 SepDay 144
    1. ACSC Warns of Active Exploitation of SonicWall SSL VPN Vulnerability (CVE-2024-40766)02:55 · SecurityOnline · Picked up again
    2. SonicWall SSL VPN Flaw and Misconfigurations Actively Exploited by Akira Ransomware Hackers11:50 · The Hacker News
    3. Akira Ransomware Attacks Fuel Uptick in Exploitation of SonicWall Flaw12:55 · SecurityWeek
    4. Akira Ransomware exploits year-old SonicWall flaw with multiple vectors21:16 · Security Affairs

  3. Quiet for 5 days

    Wed 17 SepDay 201
    1. A Security Engineer’s Mistake Led to a Ransomware Breach04:05 · SecurityOnline · Picked up again

  4. Quiet for 12 days

    Sun 28 SepDay 311
    1. Akira ransomware breaching MFA-protected SonicWall VPN accounts22:15 · BleepingComputer · Picked up again
  5. Mon 29 SepDay 325
    1. Akira Ransomware Exploits SonicWall VPN Accounts With Lightning-Fast Intrusions01:45 · SecurityOnline
    2. Akira Ransomware’s Exploitation of SonicWall Vulnerability Continues09:51 · SecurityWeek
    3. Akira Ransomware bypasses MFA on SonicWall VPNs11:21 · Security Affairs
    Show 2 more from 29 Sep
    1. Cybercriminals Target SonicWall Firewalls to Deploy Akira Ransomware via Malicious Login Attempts11:56 · GBHackers
    2. Akira Hits SonicWall VPNs in Broad Ransomware Campaign21:31 · Dark Reading

  6. Quiet for 10 days

    Thu 9 OctDay 421
    1. Akira SonicWall Campaign Uncovered11:05 · Darktrace · Picked up again
  7. Fri 10 OctDay 431
    1. SonicWall SSL VPN Devices Targeted by Threat Actors to Distribute Akira Ransomware12:21 · GBHackers

  8. Quiet for 3 days

    Mon 13 OctDay 461
    1. Akira Ransomware Revives SonicWall Flaw CVE-2024-40766, Uses ‘UnPAC the Hash’ to Breach Networks01:15 · SecurityOnline · Picked up again

  9. Quiet for 3 weeks

    Sat 1 NovDay 651
    1. Akira Ransomware Strikes Apache OpenOffice, Allegedly Exfiltrates 23GB of Data10:26 · GBHackers · Picked up again

  10. Quiet for 2 days

    Mon 3 NovDay 671
    1. Open-Source AdaptixC2 Hacking Framework Adopted by Russian Cybercriminals and Akira Ransomware01:01 · SecurityOnline

  11. Quiet for 11 days

    Fri 14 NovDay 783
    1. CISA Warns: Akira Ransomware Has Extracted $42M After Targeting Hundreds06:01 · GBHackers · Picked up again
    2. Akira Ransomware Group Made $244 Million in Ransom Proceeds12:40 · SecurityWeek
    3. Akira RaaS Targets Nutanix VMs, Threatens Critical Orgs22:20 · Dark Reading

  12. Quiet for 3 days

    Tue 18 NovDay 821
    1. CISA/Europol Warn: Akira Ransomware Profits Hit $244M, Group Expands to Encrypt Nutanix AHV VMs01:00 · SecurityOnline · Picked up again
  13. Wed 19 NovDay 831
    1. Anatomy of an Akira Ransomware Attack: When a Fake CAPTCHA Led to 42 Days of Compromise00:45 · Unit 42
  14. Thu 20 NovDay 841
    1. One Click, 42 Days: Akira Ransomware Used CAPTCHA Decoy to Destroy Cloud Backups and Cripple Storage Firm02:01 · SecurityOnline

  15. Quiet for 3 weeks

    Wed 10 DecDay 1041
    1. Akira ransomware: FBI tallies 250 million in payouts14:01 · DataBreaches · Picked up again

  16. Quiet for 16 weeks

    Thu 2 AprDay 2171
    1. Researchers Observe Sub-One-Hour Ransomware Attacks13:56 · Infosecurity · Picked up again

  17. Quiet for 4 weeks

    Mon 27 AprDay 2421
    1. Ransomware gang behind half of cyber claims via SonicWall14:59 · DataBreaches · Picked up again

  18. Quiet for 4 weeks

    Wed 27 MayDay 2721
    1. Akira ransomware breach exposed by missing SSLVPN log integration22:01 · SANS ISC · Picked up again

  19. Quiet for 7 days

    Wed 3 JunDay 2791
    1. Brazil faces surge in ransomware as top threat actors target 202612:06 · SOCRadar · Picked up again

  20. Quiet for 3 weeks

    Tue 23 JunDay 2991
    1. CVE-2024-40766 exposes SonicWall firewalls to ransomware04:11 · SANS ISC · Exploited CVE · Picked up again · Known exploited CVE

  21. Quiet for 7 weeks

    Thu 13 AugDay 3501
    1. Akira Ransomware Fails After Safe Mode Trick on SonicWall VPN10:31 · Infosecurity · Picked up again

  22. Quiet for 4 days

    Mon 17 AugDay 3541
    1. SonicWall VPN Gap Lets Akira Ransomware Try Safe Mode Evasion07:47 · Security Affairs · Picked up again

  23. Quiet for 9 weeks

    Wed 21 OctDay 4191
    1. Ransomware Attacks Jump 50% as Data Theft Replaces Encryption12:22 · Infosecurity · Picked up again

  24. Quiet for 6 days

    Tue 27 OctDay 4251
    1. Australia reports 20% rise in cyber incidents in 2025-2613:40 · SOCRadar · Picked up again · This article, 33rd of 33

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in