AUKUS deal a ‘target’ for state-sponsored hackers, ASD warns

The nation’s cyber spy agency has warned the AUKUS nuclear submarine partnership has made Australia’s defence sector a prime target for state-sponsored hackers.

Australian Signals Directorate director-general Rachel Noble. Picture: Sean Davey.

The nation’s cyber spy agency says the AUKUS nuclear submarine partnership has made Australia’s defence sector a prime target for state-sponsored hackers, amid a jump in cyber attacks threatening national security and compromising key government services.

The Australian Signals Directorate 2022-23 cyber threat report reveals a 23 per cent surge in cyber crimes reported to the agency to 94,000 – about one every six minutes – and a 14 per cent increase in the average cost of attacks.

ASD responded to 1100 of the most serious incidents, including three that caused “extensive compromise” to government or critical infrastructure systems, and two that caused “isolated compromise” of national security systems or those of national significance.

As China wages an unrelenting campaign to steal cutting-edge military technology, the report says state-sponsored hackers will attempt to force their way into systems linked to Australia’s nuclear submarine and technology partnership with the US and Britain.

“The AUKUS partnership, with its focus on nuclear sub­marines and other advanced military capabilities, is a likely target for state actors looking to steal intellectual property for their own military programs,” it says.

“Cyber operations are increasingly the preferred vector for state actors to conduct espionage and foreign interference.”

The warning follows that of ASIO director-general Mike Burgess, who in December said China was “engaged in the most sustained, sophisticated and scaled theft of intellectual property and expertise in human history”.

While not mentioned in the report, ASD regards China as its most formidable state-sponsored cyber opponent, with the country waging more intensive and sophisticated hacking operations than the next biggest threats – Russia and Iran.

The report’s release follows a devastating cyber attack last Friday on port operator DP World – a critical infrastructure business – that is set to disrupt freight movement for weeks.

The hack is set to be included in next year’s report as a “sustained disruption of essential systems”, while the 2022 Optus and 2023 Medibank data breaches were among the most disruptive in the current report.

Inside the Australian Signals Directorate’s cyber and foreign intelligence facility in Canberra. Picture: ASD

Referring to the Optus and Medibank incidents, the report says: “Significant data breaches resulted in millions of Australians having their information stolen and leaked on the dark web.”

The report reveals ASD responded to 143 cyber security incidents related to critical infra­structure in 2022-23, and says state-sponsored hackers are increasingly focusing their attacks on such businesses.

ASD director-general Rachel Noble said: “Some state actors are willing to use cyber capabilities to destabilise and disrupt systems and infrastructure.

“They may preposition on networks of strategic value for future malicious activities.”

During the reporting period, ASD called out Chinese state-sponsored hacking group Volt Typhoon, which used so-called “living-off-the-land” techniques to disguise its activities, and the use of “Snake” malware by Russia’s intelligence services.

Extortion-­related attacks on Australian businesses continue to rise, with ASD responding to 127 such incidents – an 8 per cent jump on the previous year.

These included 118 ransomware attacks, while ASD notified 158 entities of ransomware activity on their networks before their ­systems were disabled by perpetrators.

The average cost for firms affected by cyber crimes rose to $46,000 for small businesses, $97,200 for medium-sized enterprises, and $71,600 for large firms.

The report reveals ASD received 26,000 job applications from would-be cyber spies under its $10bn Project REDSPICE initiative to expand its “cyber hunt” capabilities.

Defence Minister Richard Marles said the report revealed the unrelenting nature of the attacks by state and non-state governments to “destabilise and disrupt” Australian IT systems.

“Recent global and national events have demonstrated the growing threat to Australia by ­malicious cyber actors,” he said.