State of Cyber 2026 - DFIR

Prepared by: Triskele Labs Digital Forensics and Incident Response (DFIR) Team | Published: 13 October, 2026 

This report presents statistics and information gathered from DFIR investigations conducted during the 2025-26 financial year. The data and insights are based on work completed by the Triskele Labs DFIR team, which has now been operational for over five (5) years.

Triskele Labs collaborates with numerous insurance carriers and law firms, providing specialised DFIR services that support legal and insurance claims related to cyber incidents. Our team works closely with these partners and clients to ensure thorough, accurate investigations that meet the necessary legal and regulatory standards.

The DFIR team has assisted hundreds of Australian and New Zealand organisations, ranging from small sole trader practices to large enterprise clients with thousands of servers and endpoints within their environments. This broad experience enables the team to respond effectively to the full range of cyber incidents experienced by businesses.

DIGITAL FORENSICS AND INCIDENT RESPONSE · STATE OF CYBER 2026

At a Glance

Executive Summary

Cyber incidents continued to affect organisations of every size and sector across Australia and New Zealand throughout the 2025-26 financial year. For every high-profile attack that reached the media, many more were investigated quietly, reinforcing how pervasive and persistent the threat remains. This report draws on the incidents the Triskele Labs Digital Forensics and Incident Response (DFIR) team responded to over the year to set out what organisations are actually facing and how they can better protect themselves.

Over the course of the year the team responded to 177 incidents. Business Email Compromise (BEC) and ransomware again defined the landscape, together accounting for well over half of all engagements. BEC remained the most common single incident type, while ransomware, including matters interrupted before encryption, was the second. The balance of the caseload spanned unauthorised access, insider threat, website compromise, malware and a growing volume of triage and dark-web monitoring work.

Ransomware Threat Actors continued to rely on unsecured remote access. Brute force attacks against Virtual Private Network (VPN) and Remote Desktop Protocol (RDP) services without multi-factor authentication (MFA), together with credential-based access, accounted for roughly half of all ransomware initial access. Data exfiltration remained near-universal, confirmed in 28 of the 36 ransomware engagements where it could be assessed, with an average of 446GB removed per confirmed engagement. Double and triple extortion tactics, including direct phone and email harassment of staff, remained standard practice.

In the BEC space, MFA was present in the large majority of compromised environments where its status was recorded. Rather than being stopped by MFA, Threat Actors routinely defeated it through session token theft. Payment redirection fraud was the primary objective, attempted in close to one (1) in three (3) BEC cases and succeeding more often than not once attempted.

The finance and healthcare sectors were again the most affected, together making up close to one third of all incidents. As in previous years, the evidence points to the same message: resilience comes from treating people, process and technology as a single, integrated program, not from isolated tools or one-off projects.

“...resilience comes from treating people, process and technology as a single, integrated program, not from isolated tools or one-off projects.”

Contributors

The Triskele Labs DFIR team comprises experts who provide follow-the-sun forensic analysis. This round-the-clock coverage ensures organisations can quickly understand the nature and extent of cyber incidents and take the steps needed to safely restore operations. We extend our gratitude to the team members who contributed to this report:

• Richard Grainger  Head of Digital Forensics
• Craig Martin  Head of Incident Response
• Nick Thanos  Principal DFIR Analyst
• Cameron Paddy  Senior DFIR Analyst
• Sarah Jordan  DFIR Analyst
• Tim Clarke  Senior Incident Response Manager

Incident Statistics

Incidents Year on Year

The Triskele Labs DFIR team responded to 177 incidents over the 2025-26 financial year. Across the past five (5) financial years the team has now handled a combined total of 545 investigations, reflecting the sustained and broad-based demand for DFIR services across the region.

The figures above reflect every engagement recorded for the year, across all statuses. The composition of that caseload, examined in the sections that follow, is where the most useful insight lies.

Incidents by financial year, 2021-22 to 2025-26.

Incident Heatmap

Incidents were spread across every Australian state and territory as well as New Zealand, with a small number involving organisations headquartered overseas. Victoria recorded the highest number of incidents at 69, followed by New South Wales on 44 and Queensland on 25. The table below sets the FY26 distribution against the two (2) prior years.

Incidents by headquarters location across the last three (3) financial years.

This distribution reinforces that cyber threats affect organisations regardless of location, from major capitals through to regional centres and across the Tasman. New Zealand incidents remained steady, and for the first time the caseload included a small number of organisations headquartered in the United Kingdom and Canada.

Incident Types

Business Email Compromise and ransomware were again the two (2) most common incident types. BEC accounted for 55 engagements and ransomware, inclusive of interrupted pre-encryption attacks, for 44. Together they made up 56% of the caseload. The remaining 78 matters covered a broad mix of unauthorised access, insider threat, website compromise, malware, data breach, extortion, and triage and dark-web monitoring engagements.

Incident types by year.

Pre-ransomware (interrupted) matters are counted within ransomware, consistent with the approach taken in FY25. The Other category is larger than in previous years, reflecting both the broader range of work now undertaken and the inclusion of newer categories such as website compromise, triage and dark-web monitoring that did not feature in earlier reports.

Industry Verticals

Every industry sector can be affected by a cyber incident. This year finance (33 incidents) and healthcare (25) were again the most heavily represented, together accounting for close to one (1) third of all engagements. The table below compares the FY26 distribution against the two (2) prior years. Finance and healthcare have topped the list in each of the last three (3) years. Retail rose sharply this year to third, while several sectors that spiked in FY25, notably legal, recreation and hospitality, eased back.

Incidents by industry vertical, 2025-26

Ransomware

Overview

Ransomware accounted for 44 engagements in 2025-26, or 25% of all incidents, inclusive of matters where the Threat Actor was interrupted prior to encryption. Ransomware remains a professionalised, financially motivated criminal enterprise rather than opportunistic malware. Encryption is typically the final act, deployed only once the Threat Actor has achieved their objectives and, in most cases, after data has already been stolen.

This attack model has become increasingly sophisticated, with double and triple extortion now standard. In a double extortion scenario the Threat Actor exfiltrates data before encrypting it and threatens to publish the stolen data if the ransom is not paid. Triple extortion escalates this further, with the Threat Actor directly contacting staff, customers or other stakeholders to increase pressure and raise the reputational stakes for the victim.

The average dwell time across ransomware engagements, measured between initial access and impact, was 39 days. A small number of long-running intrusions pull this average upward; the median dwell time was closer to nine (9) days, indicating that many Threat Actors move from access to encryption within a fortnight. Prolonged dwell time reinforces why restoring from backups alone is rarely sufficient, as persistent access mechanisms are frequently left behind and allow the Threat Actor to return after apparent remediation.

Double and Triple Extortion

Data exfiltration remained a near-constant feature of ransomware engagements, and Threat Actors continued to layer direct-pressure tactics on top of encryption. Eleven (11) of this year's ransomware victims were listed on dark-web leak sites. Consistent with prior years, victims were also subjected to direct contact, including phone calls to leadership and reception lines and emails distributed to the wider staff population, sometimes sent from compromised internal accounts to bypass email filtering.

Ransomware Groups

Where the group could be attributed, Qilin was the most frequently encountered Threat Actor this year, linked to eight (8) engagements. Inc. Ransom followed with four (4), Akira with three (3) and Safepay with two (2). A range of other groups, including Lynx, Brotherhood, Kairos, DragonForce, Braincipher, FulcrumSec and Kazu, were each seen once. The group could not be attributed in 17 cases, typically where encryption or log clearing limited the available evidence.

Ransomware engagements by attributed group, 2025-26.

Group Spotlight: Qilin

Qilin was the most active ransomware group in the Triskele Labs caseload this financial year, accounting for eight (8) engagements. The group operates a ransomware-as-a-service (RaaS) model, and the engagements attributed to it show the operational variety typical of an affiliate-driven operation, while sharing several consistent characteristics.

Initial access. Qilin affiliates overwhelmingly favoured unsecured remote access. Five (5) of the eight (8) engagements began with exposed VPN or RDP services (two (2) brute force VPN, two (2) brute force RDP and one (1) exposed RDP), with the remainder split across credential compromise, exploitation of a vulnerability and third-party compromise. This is consistent with the group's broader reliance on internet-facing services that lack MFA.

Dwell time. Qilin typically moved quickly. Excluding a single outlier of 285 days, dwell times clustered between two (2) and nine (9) days, with a median of three (3) days across the eight (8) engagements. The average of 41 days is almost entirely a product of that one prolonged intrusion. The pattern suggests that, once inside, Qilin affiliates generally progressed to exfiltration and encryption within days.

Persistence and tooling. Qilin affiliates made heavy use of legitimate remote management and remote access tooling to maintain access, including AnyDesk, TeamViewer, ScreenConnect, Atera and Splashtop, alongside a reverse proxy in one (1) case and the SocGholish loader in another. The use of legitimate administration tools helps the group blend in with normal IT activity and evade detection.

Data exfiltration. Data was exfiltrated in seven (7) of the eight (8) engagements. Volumes varied widely, from around 52GB up to 3,300GB in the largest case, reflecting differences in target size and dwell time. For exfiltration the group relied on a mix of Rclone and WinSCP, together with direct transfers to cloud storage including AWS S3, Backblaze and Mega. None of the Qilin victims in the caseload paid a ransom, and two (2) were named on the group's leak site.

Initial Access

Unsecured remote access remained the dominant route into ransomware victims, consistent with previous years. When VPN and RDP families are combined, exposed or brute-forced remote access accounted for 20 of the 44 ransomware engagements, roughly half. Exploitation of unpatched vulnerabilities was the next most common vector at nine (9) cases, followed by misconfiguration, third-party compromise and credential compromise. The table below sets the FY26 vectors against the two (2) prior years on a harmonised basis.

Ransomware initial access vector by year (harmonised categories).

Vector labels have been harmonised across years for comparability: the VPN row combines exposed, brute-force and stolen-credential VPN access, and the RDP row combines exposed and brute-force RDP. The prior reports used slightly different naming (for example Exposed SSL VPN and Credential Stealer). The persistent theme is unchanged: Threat Actors continue to take the path of least resistance. When VPN and RDP services are exposed to the internet without MFA, they become prime targets for low-sophistication brute force and credential-stuffing attacks. Enforcing MFA across all external-facing services, patching internet-facing assets promptly and controlling third-party and unmanaged-device access remain the highest-value preventative controls.

Data Exfiltration

Data exfiltration was confirmed in 28 of the 36 ransomware engagements where it could be assessed, once again showing that data theft is now the norm rather than the exception. The average volume of data exfiltrated per confirmed engagement was approximately 446GB, with the median closer to 108GB, indicating that a smaller number of very large exfiltrations lifts the average. Early identification of exfiltration, and of the specific data involved, remains critical to enabling legal counsel and impacted-party notification decisions to be made in good time.

Compared with prior years, the exfiltration rate remains high and the average volume has ticked up. In FY24 data exfiltration was confirmed in 65% of ransomware cases (19 of 29) at an average of 406GB; in FY25 it was 83% (52 of 63) at 381GB; and this year it was 78% (28 of 36) at 446GB, though the FY26 median of 108GB shows the average is lifted by a few very large exfiltrations.

Ransomware data exfiltration rate and average volume by year.

Where tooling could be identified, Rclone was again the most common exfiltration utility, followed by FileZilla, WinSCP, direct transfers to AWS S3 buckets and API-based methods. In a large share of cases the tooling could not be determined, typically due to log clearing, full-disk encryption or short log-retention windows, underscoring the value of comprehensive logging and endpoint monitoring for investigations.

Ransomware exfiltration tooling, 2025-26. Rclone has remained the most common identified tool across all three (3) years.

Ransom Payments

A ransom was paid in three (3) of the 44 ransomware engagements, or approximately 7%. Payment continued to be the exception rather than the rule, reflecting improving backup and recovery capability, sanctions considerations that can make payment unlawful, and a growing number of organisations declining to pay on principle. Among the payments where the amount was recorded, the average was approximately USD 94,000. Paying a ransom is never the recommended course: it funds and encourages further offending and offers no guarantee of data recovery or of stolen data being deleted.

Ransom payment frequency and average amount by year.

Business Impact

The impact of a ransomware incident is significant and far-reaching, touching financial, reputational and technological dimensions, with recovery often prolonged and difficult.

Financial. Operational downtime disrupts normal business, driving losses through halted production, missed sales and delayed service delivery. Recovery frequently requires new, clean infrastructure and professional services, while staff and third-party suppliers must still be paid throughout the disruption. Organisations may also face fines and legal costs where sensitive data is compromised.

Reputational. Breaches erode customer trust and can cost existing clients while making new ones harder to win. For service providers, customers may refuse to reconnect until the environment has been independently validated as clean. Even where recovery from backups is possible, the threat of stolen data being published continues to weigh on the organisation.

Technological. Encryption of critical systems can render an organisation unable to operate. Recovery may involve rebuilding operating systems, reconfiguring networks and restoring from backups where those exist and are uncompromised. Even where a ransom is paid for a decryptor, there is no guarantee it will work reliably, and faulty decryption tools can cause further data loss.

Operational and employee wellbeing. Return to normal operations can take weeks depending on severity and preparedness. Responders often work long hours under pressure, and the stress and uncertainty of an incident can affect morale and productivity as staff worry about the stability of their roles and the organisation's future.

Ransomware Themes

Across this year's ransomware investigations, several recurring themes echoed those seen previously: compromise through poorly governed third-party and IT-provider access; security alerts that were generated but not acted upon; and weak password hygiene, including shared credentials and reused passwords that made lateral movement trivial once a foothold was gained.

Business Email Compromise

Overview

Business Email Compromise represented 55 engagements in 2025-26, or 31% of all incidents, and remained the most common single incident type. While the operational impact of BEC is generally less severe than ransomware, the financial consequences can be substantial, particularly where payment redirection fraud is involved. As in prior years, incidents overwhelmingly involved Microsoft 365 environments, which accounted for all but one (1) of the cases where the mail platform was recorded, reflecting the platform's dominance across the region.

A typical BEC incident begins with a Threat Actor gaining access to a cloud mailbox, most often through phishing. Once inside, the Threat Actor conducts reconnaissance to understand the account holder's role and to identify correspondence that can be leveraged, before attempting payment redirection fraud or using the account to launch further phishing against known contacts.

Initial Access Vectors

Phishing remained the primary route into mailboxes, recorded as the initial access vector in 18 BEC cases. A further eight (8) cases involved the organisation being targeted as the downstream victim of a compromise elsewhere, and eight (8) were ultimately assessed as no compromise having occurred. Phishing delivery continues to lean on legitimate services and file-sharing platforms, and on credential-harvesting techniques of increasing sophistication.

Session Token Theft and MFA

Multi-factor authentication continued to be circumvented rather than to act as a barrier. Among the BEC engagements where MFA status was recorded, MFA was present in 27 of 36 environments. That Threat Actors continued to gain access despite MFA being enabled underlines the ongoing effectiveness of session token theft, an adversary-in-the-middle technique in which a credential-harvesting site relays a victim's login in real time, capturing an authenticated session token that can be imported into the attacker's browser to bypass MFA entirely.

“...Threat Actors continued to gain access despite MFA being enabled underlines the ongoing effectiveness of session token theft.”

MFA status in BEC cases where it was recorded (27 of 36 had MFA present).

The MFA methods most susceptible to this technique are SMS, voice call and mobile push notifications. To mitigate the risk, organisations should adopt phishing-resistant MFA such as FIDO2-compliant devices, and layer on session-token protection, conditional access and geoblocking.

Threat Actor Activity and Persistence

Once inside a mailbox, Threat Actors routinely created inbox rules to conceal their activity, moving security notifications and finance-related correspondence to rarely used folders and marking them as read to avoid alerting the legitimate user. These rules typically target terms such as invoice, payment and bank, allowing the Threat Actor to quietly collect the information needed for fraud.

More advanced persistence, in particular the use of Azure App Registrations and other OAuth application grants to retain access via Graph API even after a password reset or MFA enforcement, was a significant theme in the prior year and remains a key investigative focus. Where containment is performed without a thorough investigation, these mechanisms can allow a Threat Actor to silently retain access.

Payment Redirection Fraud

Payment redirection fraud was the primary objective in most BEC engagements. It was attempted in 16 of the 55 BEC cases, or approximately 29%, broadly in line with the prior year. Where attempted, it succeeded in 10 cases, a success rate of around 62% once an attempt was made, notably higher than the 40% observed in 2024-25. Recorded fraud amounts ranged from a few thousand dollars up to USD 500,000 in a single matter.

Threat Actors typically monitor communications to identify upcoming transactions, then manipulate payment instructions or register lookalike domains to impersonate trusted suppliers and target accounts-payable teams. The most effective defences remain human: validating changes to bank details through a known, independent channel, using multi-party approval for financial transactions, and training staff to recognise the warning signs.

Detection

BEC incidents continued to be detected reactively. They were most often identified when phishing emails were sent from the compromised account and queried by recipients, or when a payment discrepancy or unpaid invoice came to light. This reactive pattern means Threat Actors are typically able to operate undetected for an extended period, until an action causes visible impact.

What are the emerging cyber risks for FY27?

Several developing risks warrant particular attention going into FY27. Some ransomware Threat Actors have moved away from encryption altogether, exfiltrating data and relying purely on the threat of publication to extort payment, which lowers the barrier to a damaging incident for organisations with weak data controls. Endpoint and unmanaged-device compromise, including through information-stealing malware on personal or contractor devices, continues to provide a route into corporate environments. And there remains a persistent risk around third-party IT providers, including cases where providers have failed to disclose incidents promptly.

Conclusion

The 2025-26 financial year reinforced that Business Email Compromise and ransomware remain the defining threats to Australian and New Zealand organisations, and that the finance and healthcare sectors remain the most exposed. The underlying causes were familiar. Ransomware Threat Actors continued to exploit remote access without MFA and unpatched internet-facing systems, and data exfiltration remained near-universal. In the BEC space, Threat Actors routinely operated in environments that had MFA enabled, defeating it through session token theft, with payment redirection fraud the primary objective and an increasing success rate once attempted.

The most resilient organisations continue to treat cyber security as a combined program across people, process and technology, rather than as a set of isolated tools.

Actionable Takeaways

People

• Invest in security awareness training that reflects the real techniques in use, including session token theft and social engineering, not just generic phishing simulations.
• Cultivate a security culture in which staff know how to report incidents, and ensure leadership treats cyber risk as a core business risk.

Process

• Validate all changes to payment details through a known, independent channel, and require multi-party approval for financial transactions.
• Maintain and rehearse an incident response plan, and govern how third-party and unmanaged-device access is granted and monitored.
• Patch internet-facing systems promptly, invoking emergency change procedures for critical vulnerabilities.

Technology

• Enforce phishing-resistant MFA on all external-facing services, and layer on conditional access and geoblocking.
• Deploy and actively monitor tamper-resistant endpoint detection, and ensure alerts are triaged around the clock rather than left in an unmonitored queue.
• Maintain secure, tested and independent backups, and apply data-loss-prevention controls to sensitive data stores.

Glossary