Joint Advisory on INC Ransom Cyber Threat Targeting Australia, New Zealand and Pacific
Summary
The Australian Cyber Security Centre (ACSC) has released a joint advisory with CERT Tonga and New Zealand's National Cyber Security Centre (NCSC) detailing the operations of INC Ransom, a Russian-based ransomware group that has targeted organisations in Australia and the Pacific since 2023. The advisory describes the group's tactics including spear-phishing, exploitation of unpatched internet-facing devices, and double-extortion techniques where stolen data is published to a leak site if ransom is not paid. The ACSC strongly recommends organisations and government ministries implement the outlined mitigations to reduce compromise risk.
“We strongly recommend that organisations and government ministries implement the mitigations outlined in the advisory, to reduce the risk of compromise by INC Ransom and to enhance detection of this threat.”
Organisations that have not recently audited their email security controls and vulnerability patching programs should treat this advisory as a trigger for immediate review. INC Ransom's reliance on spear-phishing and unpatched devices means that multi-factor authentication enforcement, email filtering rule updates, and prioritised patching of internet-facing systems are the highest-leverage mitigations referenced in the advisory.
About this source
GovPing monitors Australia ACSC Home for new data privacy & cybersecurity regulatory changes. Every update since tracking began is archived, classified, and available as free RSS or email alerts — 3 changes logged to date.
What changed
The ACSC has published a joint advisory with CERT Tonga and NZ NCSC identifying INC Ransom as an active ransomware threat to networks in Australia, New Zealand, and Pacific Island states. The advisory details that INC Ransom uses spear-phishing campaigns, exploits unpatched internet-facing devices, and purchases valid credentials from initial access brokers to gain access to victim networks. After encryption, the group uses double-extortion tactics, publishing victim names and exfiltrated data to their leak site if ransom is not paid. Organisations should review the linked advisory and implement the recommended mitigations to reduce their risk of compromise and enhance threat detection.
Archived snapshot
Apr 23, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Today we have released a joint advisory with Kingdom of Tonga’s National Computer Emergency Response Team (CERT Tonga) and the New Zealand National Cyber Security Centre (NCSC) about the operations of ransomware group INC Ransom and their affiliate network, and the threat that their operations are posing to networks hosted in Australia and the Pacific.
INC Ransom is a Russian based financially motivated cybercriminal group, with members targeting organisations through spear-phishing campaigns, and exploiting unpatched internet-facing devices or using purchased valid account credentials from initial access brokers.
They use legitimate software to facilitate exfiltration of sensitive data. Following successful data encryption, INC Ransom leaves a ransom note stating demands and contact instructions. If targeted entities do not pay the requested ransom amount, INC Ransom engages double-extortion tactics, by publishing entity names and exfiltrated data to its dedicated leak site.
INC Ransom and their affiliate network have compromised organisations worldwide, including in Australia and the Pacific, since 2023.
We strongly recommend that organisations and government ministries implement the mitigations outlined in the advisory, to reduce the risk of compromise by INC Ransom and to enhance detection of this threat.
Parties
Related changes
Get daily alerts for Australia ACSC Home
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from ACSC.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when Australia ACSC Home publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.