ASD Warns AI Cyberattacks Could Incapacitate Australia

Australia’s spy agency says state-backed hackers and digital criminals use artificial intelligence to find weaknesses and mount cyberattacks on a greater scale, putting businesses, governments and critical infrastructure in the firing line. The Australian Signal Directorate’s latest threat report warns that attacks by proxy hacker groups “could incapacitate Australia.”

Who Has the Power

The report names China, Russia and North Korea as countries whose state-backed hackers routinely target Australian critical infrastructure. It identifies Volt Typhoon, APT29 and Lazarus Group as proxy hacker groups involved in those threats. According to the report, the attacks serve espionage and efforts to position hackers for possible sabotage.

In the 2025-26 financial year, the ASD responded to more than 1,500 incidents, a 20 per cent increase on the previous year. The agency also issued 4,400 suspicious activity notices to organisations, an 80 per cent surge. Those figures put the agency at the centre of the response, even as organisations responsible for their own networks face instructions to fix the weaknesses that allow access.

State-sponsored actors scan Australian networks for weaknesses, the report says. They seek access and then wait, either to disrupt services or collect valuable intelligence. Their targets include sensitive information held by Australian organisations; the report says the actors try to position themselves in networks for future intelligence gathering or disruption “at a time of their choosing.”

The Cost of Waiting

Australia’s adversaries “are possibly preparing for eventualities, such as crisis or conflict,” the report warns. State-sponsored actors could disrupt services to limit the ability to respond to an event or cause social unrest. People and services that depend on the targeted infrastructure could bear the cost, while attackers choose when to act.

The agency urged organisations to improve basic cyber hygiene and fix security gaps in outdated technology. The report doesn’t describe a grassroots or community response, mutual aid effort, or horizontal organizing; instead, it calls for improved security by organisations and stronger cyber defences. It doesn’t mention electoral or legislative solutions, either, or nonprofit groups delivering assistance.

Conflicts in the Middle East and Ukraine, the report says, “are fuelling international instability.” It says the world “is under greater strain than at any time since the end of the Cold War.” The report describes the global rules-based order, which it says has underpinned Australia’s security and prosperity for decades, as “in transition.”

The Agency’s Prescription

ASD Director-General Abigail Bradshaw attributed the incident and notice figures to “AI-enabled threats.” She said frontier AI technologies had “fundamentally changed the cyber security landscape,” allowing malicious actors to identify vulnerabilities and conduct attacks faster, at greater scale and with greater precision. Bradshaw said the shift would accelerate.

Bradshaw also argued that AI could strengthen defences. Cyber defenders, she said, could use AI tools to improve threat detection, identify new attack vectors and strengthen network defences. Looking ahead, she said, “we need AI tools to help automate our defences to stay ahead of AI-enabled attackers.” That prescription leaves organisations facing the security gaps the agency identified, while the state’s own cyber apparatus prepares to meet the threat with more automation.