Nation-State Pre-Positioning Intrusion into Australian Critical Infrastructure (ASIO 2026 Threat Assessment Disclosure)

Key facts for ASIO pre-positioned intrusion

Detection coverage for ASIO pre-positioned intrusion

As of 2026-06-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0940 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Living-off-the-Land Internal Discovery Burst — Built-in Recon Binaries

Detects the clustered execution of built-in discovery LOLBins (net, nltest, systeminfo, quser, ipconfig, arp, whoami) under a single user/session within minutes — the network-mapping reconnaissance ASIO described ('mapping out the network'). This is the Volt Typhoon-style living-off-the-land pattern with no malware, identified by behavioural clustering rather than atomic IOCs.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1018, T1046, T1016, T1087, T1082, T1033
• Data sources: sysmon, windows_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 
| eval img=lower(replace(Image,".*\\\\","")) 
| search img IN ("net.exe","net1.exe","nltest.exe","systeminfo.exe","quser.exe","ipconfig.exe","arp.exe","whoami.exe") 
| bin _time span=5m 
| stats dc(img) as distinct_tools values(img) as tools values(CommandLine) as cmdlines count by _time User Computer 
| where distinct_tools > 4 
| sort - distinct_tools

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("net.exe","net1.exe","nltest.exe","systeminfo.exe","quser.exe","ipconfig.exe","arp.exe","whoami.exe")
| summarize distinct_tools=dcount(FileName), tools=make_set(FileName), cmds=make_list(ProcessCommandLine), first=min(Timestamp), last=max(Timestamp) by DeviceName, AccountName, bin(Timestamp, 5m)
| where distinct_tools > 4
| project Timestamp, DeviceName, AccountName, distinct_tools, tools, first, last

Sigma

title: LOTL Internal Discovery Burst via Built-in Binaries (TL-2026-0940)
id: 1b2c3d4e-5f6a-4b7c-9d8e-0f1a2b3c4d51
status: experimental
description: Detects a tight burst of built-in discovery binaries under one session indicating living-off-the-land internal reconnaissance and network mapping.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
    - https://attack.mitre.org/techniques/T1018/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/25
tags:
    - attack.discovery
    - attack.t1018
    - attack.t1046
    - attack.t1016
    - attack.t1087
    - attack.t1082
    - attack.t1033
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\net.exe'
            - '\net1.exe'
            - '\nltest.exe'
            - '\systeminfo.exe'
            - '\quser.exe'
            - '\ipconfig.exe'
            - '\arp.exe'
            - '\whoami.exe'
    timeframe: 5m
    condition: selection | count(Image) by User > 4
falsepositives:
    - Administrator scripting or asset-inventory tooling running multiple built-ins
    - Logon scripts and helpdesk diagnostics
level: high

Known false positives:

• Sanctioned asset-management or inventory tooling invoking multiple built-ins
• Administrator troubleshooting scripts and logon scripts

Tuning notes: Allowlist known inventory/EDR service accounts and scheduled diagnostic scripts. Raise the distinct_tools threshold or shorten the timeframe in noisy admin environments; correlate with the anomalous-logon detection for higher fidelity.

• 🔒 Impossible-Travel / Off-Hours Valid-Account Sign-In — Credential Abuse · unlock with TL Creds
• 🔒 Domain & Trust Reconnaissance via nltest/net — Network Mapping · unlock with TL Creds
• 🔒 Low-and-Slow Beacon From Quiet OT-Adjacent Host — Covert Persistence · unlock with TL Creds
• 🔒 External Remote Service Logon Anomaly on Linux Jump Host — Stolen-Credential Access · unlock with TL Creds
• 🔒 Linux LOTL Host & Network Enumeration Burst — Pre-Positioning Recon · unlock with TL Creds
• 🔒 Unsanctioned Network-Map / Asset-Inventory Artifact Creation — Pre-Positioning Map · unlock with TL Creds
• 🔒 Valid/IT-Staff Account Logon From Anomalous Source — Pre-Positioning Initial Access · unlock with TL Creds
• 🔒 Lateral Authentication From IT Into OT/ICS Management Segment · unlock with TL Creds

Indicators of compromise for ASIO pre-positioned intrusion

As of 2026-06-25, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-0940.

How ASIO pre-positioned intrusion works

The intrusion was detected before any disruptive action; remediation is ongoing.

On 25 June 2026 The Register reported in detail on a critical-infrastructure intrusion disclosed in ASIO Director-General Mike Burgess's Annual Threat Assessment. According to ASIO, cyber units of at least one nation state 'routinely try to explore and exploit Australia's critical infrastructure networks, almost certainly mapping systems' so they can lay down malware or maintain access for the future. In one named incident, the actors 'successfully acquired credentials – login details and passwords – for active users', including IT staff, then engaged in 'mapping out the network and maintaining access so they could cripple it at a time of their choosing.' No disruptive action had been taken at the time of discovery; remediation is ongoing.

Burgess framed the activity as a shift from espionage to pre-positioning for high-impact sabotage: 'Spying is no longer just stealing secrets. It now encompasses preparing for sabotage.' He stated 'The scale of this activity – led by one nation-state in particular – is difficult to overstate' and that ASIO 'struggle[s] to find a single country in our region that has not been compromised by this state's cyber apparatus.' ASIO assesses the threat of high-impact sabotage of critical infrastructure will likely worsen over the next five years, naming the AUKUS submarine program among future concerns.

The targeting pattern spans water, transport and energy networks, with related reporting describing power grids and substations, telecommunications, satellite control centres, water and sanitation, and emergency-services networks, and adversaries 'embedding themselves years in advance' with 'covert persistence within operational technology (OT) systems.' ASIO also noted the same nation-state unit recently targeted critical networks in the United States; ASIO coordinated with American counterparts to evict the actors and 'shut down their global accesses, including nodes here in Australia.'

ASIO did not officially name the responsible state or a specific threat group, and no atomic indicators of compromise (IPs, domains, file hashes) were released. The tradecraft described — abuse of valid/IT-staff credentials, internal network reconnaissance, low-noise persistence, and pre-positioning against OT for future disruptive effect — mirrors the China-nexus 'living-off-the-land' critical-infrastructure pre-positioning pattern publicly documented by Five Eyes agencies (e.g. the CISA/NSA Volt Typhoon advisory AA24-038A). Media coverage associated the activity with Chinese state-sponsored actors, but this attribution is media-reported, not ASIO-confirmed; attribution confidence is therefore LOW. This record documents the disclosed tradecraft for defenders to hunt valid-account abuse and reconnaissance against critical-infrastructure and OT environments; it does not assert technical IOCs ASIO did not disclose.

MITRE ATT&CK techniques by tactic:

Discovery

T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1046 Network Service Discovery

Lateral Movement

T1021 Remote Services

Command and Control

T1071 Application Layer Protocol

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Persistence

T1078 Valid Accounts

Privilege Escalation

T1078 Valid Accounts

Defense Evasion

T1078 Valid Accounts

stealth

T1078 Valid Accounts

Impact

T1485 Data Destruction; T1489 Service Stop

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure

Reconnaissance

T1589 Gather Victim Identity Information; T1590 Gather Victim Network Information

Remediation for ASIO pre-positioned intrusion

Immediate actions

• Hunt for use of valid/privileged and IT-staff accounts from anomalous hosts, times or geolocations; force credential rotation for any account showing suspicious authentication.
• Audit and reset credentials for IT administrators and service accounts with access to OT/ICS and critical-infrastructure management networks.
• Review authentication logs for impossible-travel, atypical logon types, and lateral authentication into OT segments.

Workarounds

• Disable unused remote-access pathways into critical and OT networks.
• Apply allow-listing for administrative tooling and constrain lateral movement between IT and OT zones.

Longer-term hardening

• Enforce phishing-resistant MFA on all remote access, VPN, and privileged/IT accounts.
• Segment IT from OT networks and restrict OT management to dedicated, monitored jump hosts.
• Implement least-privilege and just-in-time admin; eliminate standing privileged credentials.
• Deploy behavioural detection for internal network discovery and living-off-the-land activity; centralise and retain authentication and OT telemetry.

Affected and fixed versions

• Australian critical infrastructure operators — Critical infrastructure & operational technology (OT) networks (water, transport, energy, telecommunications, emergency services)
  Vulnerable versions: Unspecified provider network (sector/provider redacted by ASIO)

Timeline of ASIO pre-positioned intrusion

• 2024-02-07 CISA/NSA/FBI publish advisory AA24-038A documenting PRC state-sponsored living-off-the-land pre-positioning in US critical infrastructure (Volt Typhoon) — the public pattern ASIO's disclosed tradecraft mirrors.
• 2025-11-12 ASIO/Mike Burgess publicly frame the shift from espionage to sabotage: adversaries 'embedding themselves years in advance' and establishing covert persistence in operational technology (OT) systems across energy, telecom, satellite control, water and emergency-services networks.
• 2026-02-19 ASIO assesses high-impact sabotage of critical infrastructure will likely worsen over the next five years, naming the AUKUS submarine program among future targets.
• 2026-02-19 ASIO notes the same nation-state unit recently targeted US critical networks; ASIO coordinated with American counterparts to evict the actors and shut down their global access nodes, including nodes in Australia.
• 2026-02-19 ASIO discloses an intrusion at an Australian critical-infrastructure provider where actors acquired credentials of active users, including IT staff, mapped the network and maintained access to 'cripple it at a time of their choosing.'
• 2026-02-19 ASIO Director-General Mike Burgess delivers the 2026 Annual Threat Assessment: one nation state in particular routinely scans and maps Australian critical infrastructure (water, transport, energy) to maintain future access.
• 2026-06-25 Intrusion was discovered before any disruptive action; remediation of the affected critical-infrastructure provider is ongoing.
• 2026-06-25 The Register and iTnews report in detail on the disclosed intrusion and ASIO's warning that critical-infrastructure systems are 'routinely' mapped by nation-state cyber units.

Sources cited for ASIO pre-positioned intrusion

• ASIO Director-General's Annual Threat Assessment (official) asio.gov.au · Advisory · 2026-02-19
• CISA/NSA/FBI Advisory AA24-038A — PRC State-Sponsored Actors (Volt Typhoon) Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (related living-off-the-land pre-positioning pattern) CISA · Government advisory · 2024-02-07
• Nation-state actors cracked critical Australian infrastructure to cripple it at a time of their choosing The Register · News · 2026-06-25
• ASIO boss warns Australian critical infrastructure systems 'routinely' mapped itnews.com.au · News · 2026-06-25
• ASIO warns of more complex security environment in 2026 threat assessment australiansecuritymagazine.com.au · News · 2026-02-19
• ASIO Chief Warns of State-Backed Cyber Sabotage Targeting Critical Infrastructure dailysecurityreview.com · News · 2025-11-12
• ASIO director-general warns of nation-state actors targeting critical infrastructure cyberdaily.au · News · 2026-02-19
• ASIO Chief Warns of 'High-Impact Sabotage' Threat as Chinese Hackers Probe Australian Critical Infrastructure (media attribution to China-nexus actors) sydneytimes.net.au · News · 2026-06-25

More in apt

• TraderTraitor (DPRK-aligned) FLATROOF and ROOFDECK macOS Backdoors Resurface on IT Services Victim With No Crypto Ties
• CRAFTY FALCON targets Indian fintechs via exposed APIs during weekends and low-monitoring periods
• APT29 Watering-Hole Campaign Against Mongolian Government Sites Using iOS WebKit and Chrome Android Exploits (CVE-2023-41993, CVE-2024-5274, CVE-2024-4671)
• Chinese Nation-State Threat Activity Falls 41.4% in Q2-Q3 2026 While Remaining Above Russian and Iranian Activity (Trellix)
• APT29 (Midnight Blizzard) watering holes target iOS and Android devices with n-day exploit chains (DarkSword, AndroSnitch)

Previous and next in apt

• UNC6508 (PRC-Nexus) Trojanizes Unpatched REDCap Research Servers with INFINITERED Malware to Spy on North American Medical, Academic & Military Research Previous report
• CL-STA-1062 (UAT-7237) Deploys TinyRCT .NET Backdoor via AppDomainManager Injection Against Southeast Asian Government and Critical Energy Infrastructure Next report

Further reading

• ChromaDB, LiteLLM, PraisonAI, Langflow RCEs
• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors