Australia Warns State Hackers May Be Preparing to Shut Down Essential Services

State-backed hackers may be positioning themselves inside Australian critical-infrastructure networks to disrupt or destroy systems during a crisis, the Australian Signals Directorate warns in its new annual cyber-threat report.

The danger lies in access that can be kept quiet until it is useful. ASD says a foothold in an operational-technology network could give an attacker control over the infrastructure itself. Its report identifies health and energy among the sectors where a cyberattack could cause shutdowns affecting millions of Australians.

Published on October 26, the report describes a threat assessment rather than an imminent attack. The agency says state actors primarily seek sensitive or non-public information, while some seek network positions that enable later intelligence collection, disruption or access to more valuable targets.

The critical-infrastructure incident count fell. ASD’s Australian Cyber Security Centre responded to 154 such incidents in the 2025–26 financial year, almost 7% fewer than the previous year and about a tenth of its total. That figure covers incidents across the sector; it is not a tally of foreign sabotage operations.

The leading initial-access techniques for those incidents were phishing (36%), misuse of valid accounts (16%) and drive-by compromise (10%), where visiting a malicious or compromised website leads to unwanted code. The figures describe ways into critical-infrastructure systems, without assigning each incident to a state actor.

Across all sectors, ASD responded to more than 1,500 cybersecurity incidents, up 20%. Separately, it issued more than 4,400 notifications of potentially malicious activity, an increase of about 80%. Those alerts are not confirmed attacks: the agency says proactive notifications led it to identify 362 incidents.

ASD urges organisations to patch faster, reduce their dependence on outdated technology and improve monitoring. It also warns that artificial intelligence lets hostile actors find vulnerabilities and develop exploits faster, while giving defenders tools to detect weaknesses and respond.