The Role of Initial Access Markets in Ransomware Campaigns Targeting Australia and New Zealand
The cyber threat landscape in Australia and New Zealand during 2025 has experienced significant developments, characterized by an increase in initial access sales, advanced ransomware operations, and data breaches across critical sectors.
The cyber threat landscape in Australia and New Zealand during 2025 has experienced significant developments, characterized by an increase in initial access sales, advanced ransomware operations, and data breaches across critical sectors.
The Threat Landscape Report for Australia and New Zealand 2025 indicates a commercialized underground ecosystem where compromised network access is actively traded, posing increased risks to organizations in the region.
Industries such as Retail, Banking, Financial Services, and Insurance (BFSI), Professional Services, and Healthcare are primary targets due to the abundance of sensitive data they handle. This targeting strategy is designed to maximize financial returns and operational leverage for threat actors.
Cyble Research and Intelligence Labs (CRIL) recorded 92 instances of compromised access sales in Australia and New Zealand in 2025. The Retail sector was most affected, with 31 incidents, followed by BFSI and Professional Services. These sectors collectively accounted for more than half of the observed initial access listings.
This targeting strategy is designed to maximize financial returns and operational leverage for threat actors.
The presence of a fragmented access brokerage landscape, with no dominant actor, underscores the accessibility of initial access sales as a revenue stream for numerous threat actors.
Several significant incidents illustrate the impact of these threats. In June 2025, the threat group Scattered Spider allegedly breached a major Australian airline's customer service portal, affecting nearly six million customer records. Other incidents involved unauthorized access to a large Australian retail chain and an Australian telecommunications provider, emphasizing the broad attack surface in the region.
These examples highlight the ongoing challenges faced by organizations in mitigating cyber threats and protecting sensitive data.
Based on reporting by GBHackers.