Nation-state #hackers continue to target Australian orgs as greyzone operations intensify year-on-year
While financial crime is the most common driver of #cyber attacks against Australian entities, #espionage is still a key concern of cyber professionals, according to a new report from a local cyber security firm.
There is a phrase among cyber #security professionals that speaks to the amount of time it takes to detect a threat on a network – unsurprisingly, it’s called time-to-detect, or TTD.
This is measured from the very first intrusion on a network up to the point that malicious activity is detected.
Not ejected, mind, merely detected. The time to identify, eject, and remediate the effects of a malicious intrusion is often far longer than the TTD.
What makes this figure interesting – the average minutes it takes to detect a malicious actor – is the incredible difference between criminal actors and those with espionage on their minds. In the former case – such as financially motivated ransomware groups – the time-to-detect such activity was 23.7 days, on average, according to a recent report from Australian cyber security firm CyberCX.
That may sound like a long time, and for anyone realising a hacker has been sifting through their network for almost four weeks, it probably is. However, when it comes to cyber espionage, such as nation-state-backed actors from countries like China and North Korea, that figure balloons out to a terrifying 403.8 days.
Put another way, on average, by the time a government agency or telco operator, for instance, even notices they’ve been compromised, the hackers have already had access to their network – and any data on it – for more than a year.
Possibly even more alarming is that the time to detection figure has grown by roughly two weeks compared to 2023
The #Chinese threat
Hamish Krebs, Executive Director of Digital Forensics and Incident Response at CyberCX – which published its CyberCX 2025 Threat Report last week – said that while CyberCX itself does not explicitly attribute espionage activity to specific actors, “it’s well documented that Australia and New Zealand continue to be a target for cyber intrusions by nation states or state-linked groups.”
https://lnkd.in/dFj2ugU8
