"Digital dynamite," according to former Australian Signals Directorate director-general Rachel Noble.
Pre‑positioning, NotPetya, Sandworm and Gamaredon
Australia’s domestic signals agency, the Australian Signals Directorate (ASD), in its Annual Cyber Threat Report 2025‑2026 — released this week — warns that state‑sponsored actors are targeting Australian critical infrastructure, businesses and individuals and are increasingly “pre‑positioning” inside networks to enable later disruption. The article uses historical precedent to underline the risk: in 2017 Russian military intelligence unleashed the NotPetya malware against Ukraine’s energy and financial sectors. Disguised as ransomware, NotPetya instead destroyed data permanently, spread worldwide and caused billions of dollars in damage; Australia and others publicly attributed the malware to the Kremlin.
The piece also names ongoing actors and activity: Gamaredon Group, linked to the Russian domestic security agency FSB, has used malware against Ukraine and NATO to break into sensitive computer networks, siphon information and install destructive software for later activation. The report says Russian military intelligence is still directing Sandworm — the group behind NotPetya — which attacked Polish energy facilities in December 2025.
Six policy shifts the article urges
- First, governments should recognise that a state‑sponsored cyber intrusion is an attack — equivalent in intent and effect to a physical strike on the same infrastructure.
- Second, the article calls for a clearer line between criminal activity such as ransomware and state‑sponsored attacks on critical infrastructure, recommending that the latter be treated as breaches of territorial integrity or acts of war and met with repercussions beyond strong statements, including targeted sanctions, criminal indictments, expulsion of officials and, where warranted, offensive cyber operations.
- Third, public attribution should follow every identified state‑sponsored attack, with technical agency advisories complementing political statements rather than replacing them. The piece points to Mandiant’s 2013 exposure of APT1 as a standard for corporate attribution and cites Mandiant reporting on UNC4191 and Sophos uncovering a China‑linked campaign against a Southeast Asian government agency as examples where corporate disclosure clarified state‑linked campaigns.
- Fourth, Australia should update its cyber security strategy every two years, mirroring its national defence strategy, and clearly distinguish ransomware, espionage and infrastructure disruption and the consequences each will attract.
- Fifth, Canberra should establish a standing exchange between ASD and Ukraine’s Computer Emergency Response Team to leverage Ukraine’s daily tracking of groups such as Gamaredon and Sandworm to warn Australian critical infrastructure operators.
- Finally, democracies should help less‑resourced neighbours build cyber defences, with Australia focusing on the Indo‑Pacific.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAI’s multiplying effect and reported use of Gemini
The article stresses that AI is amplifying the cyber threat. An open‑source assessment by Cyber Activities Group found that several hacking groups linked to the Russian government have conducted bespoke cyber espionage now aided by AI. It also cites a Google report that Sandworm used the Gemini AI model to tailor attempts to manipulate Ukrainian human targets. The piece warns that AI lowers the cost of attackers finding vulnerabilities and that once destructive software is “laid”, little remains but a decision to detonate it.
Australia–Ukraine cooperation, the Pacific and the Tallinn precedent
The new Australia–Ukraine Bilateral Security Agreement, the article says, recognises the lessons Australia can learn from Ukraine’s experience in countering cyberattacks during hybrid warfare. For international assistance models it points to the Tallinn Mechanism, which has coordinated donor governments’ civilian cyber aid to Ukraine and committed €302.6 million (around A$480 million) since December 2023.
Domestically, Australia already hosts the secretariat of the Pacific Cyber Security Operational Network; the article suggests this network could become a platform to export lessons from Ukraine — including AI‑enabled defensive tools — to strengthen detection and response across the Indo‑Pacific.
What this means for ASD, Ukraine’s CERT, and Indo‑Pacific operators
- ASD and Australian policymakers: prepare to treat identified state‑sponsored intrusions as attacks, pursue public attribution, and consider policy tools — sanctions, indictments, expulsions and offensive cyber options — as part of a calibrated response.
- Ukraine’s Computer Emergency Response Team: maintain and share daily tracking of groups such as Gamaredon and Sandworm through a standing exchange to give Australian operators earlier warning of new tactics and pre‑positioning activity.
- Indo‑Pacific critical infrastructure operators and governments: expect offers of defensive assistance framed by the article as necessary, and anticipate that Australia could use its Pacific Cyber Security Operational Network and lessons from the Tallinn Mechanism to coordinate capability building.
The article’s core demand is straightforward: remove the category that treats state‑sponsored cyber intrusions as a special, lesser realm. It urges public naming of attackers, clearer legal and operational lines between crime and state action, routine updating of strategy, practical bilateral exchanges, and expanded regional aid. The question left squarely on the table is whether Australia and its partners will convert those prescriptions into the public attribution, legal steps and cooperative mechanisms the article says are now overdue.
