New threat intelligence research reveals Australia is now the most targeted country when it comes to internet of things (IoT) and operational technology (OT) cyberattacks, with more alerts per organisation than any other nation.
The attacks and detections reviewed in the report by Nozomi Networks Labs show several parallel forces shaping the landscape: persistent abuse of weak or default credentials, continued interest in exposed industrial and IoT assets, faster vulnerability discovery and exploitation cycles, and the ongoing evolution of botnets capable of generating large volumes of opportunistic traffic.
Australia was the most targeted country, producing the highest number of alerts per organisation. When the last report was released, Australia was the third most targeted country, highlighting sustained interest in local infrastructure.
The United Kingdom remains among the top three countries, but this year it moved one position down to second place. Rounding out the three most targeted nations, France replaced Germany, taking third place.
Geopolitical tensions and high-profile global events continued to influence attacker priorities, reinforcing the need for defenders to treat cyber risk as both a technical and operational challenge.
Related article: Cyber risk is now operational risk for Australia’s energy sector
Energy sector among most targeted industries
Manufacturing, Transportation and Energy, Utilities and Waste were the top three industries targeted. Manufacturing was the most targeted industry, outpacing the Transportation sector, which was the most targeted industry during the second half of 2025.
The Energy, Utilities & Waste industry experienced an increase in attacks, now taking third place and replacing the Government sector. All three of the most targeted sectors share a common profile: they depend heavily on interconnected OT and IoT systems, often run legacy equipment that is difficult to patch, and cannot afford prolonged downtime, which makes them especially attractive to attackers seeking either disruption or leverage for extortion.
The rise of Energy, Utilities & Waste reflects the growing appeal of targets where a compromise has immediate, visible consequences for the public. For organisations in these industries, the priority should be aligning security investments with operational risk, focusing on visibility into critical processes, segmentation between IT and OT networks and response plans that minimise the impact of any successful intrusion.
Russian threat actors account for a third of attacks
The Scattered Spider group continued to be the most prolific threat actor, with close to half of all actor-attributed alerts related to their activity. This group is known to execute highly effective social engineering attacks.
| Actor | Associated country | Percentage |
| Scattered Spider | US and UK | 48.0% |
| UNC4536 | Unknown (Russian speaking) | 20.8% |
| RomCom | Russia | 12.53% |
| UNC5636 | Unknown | 11.4% |
| APT29 | Russia | 2.98% |
The exact location of the UNC4536 actor is still not officially confirmed, but multiple sources state this actor appears to be Russian speaking. Russian-linked RomCom (also tracked as UNC4895) took third place with over 12 per cent of attributed attacks.
The notorious APT29, aka Cozy Bear, attributed to Russia’s Foreign Intelligence Service (SVR), closes the top five. This actor became infamous for its long-term cyber espionage, particularly against governments, diplomatic organisations, and technology companies.
The mix of threat actors highlights two distinct pressures. On one side, financially motivated groups like Scattered Spider rely on social engineering to bypass technical controls, a reminder that people and identity processes are as much a part of the attack surface as networks and devices.
On the other, Russia-linked or Russian-speaking actors (UNC4536, RomCom, and APT29) together account for over a third of attributed alerts, reflecting the ongoing influence of geopolitics on the threat landscape. In both cases, organisations should focus on the behaviours and indicators the actors leave behind and keep detection logic continuously updated as new intelligence emerges.
Despite this diversity of threat actors, the methods behind most attacks were strikingly familiar: default and weak credentials, discovery scanning, and denial-of-service techniques dominated regardless of the attack group.
Related article: Cyber risk is now operational risk for Australia’s energy sector
Origin data breach
Australia’s most recent major energy sector cyber attack was the Origin Energy data breach that took place in July 2026.
The unauthorised access compromised the data of approximately 900,000 current and former customers, revealing names, addresses, dates of birth, contact numbers, and billing/account histories.
Approximately 60 customers had full bank account numbers exposed, while roughly 100 customers had identification document numbers exposed.
The attack was traced by authorities to a third-party call center operated by Accenture in Manila, Philippines.
