# Nation-State Pre-Positioning Intrusion into Australian Critical Infrastructure (ASIO 2026 Threat Assessment Disclosure)

> ASIO Director-General Mike Burgess disclosed that a nation-state cyber unit intruded into an Australian critical infrastructure provider, stole the credentials of active users including IT staff, mapped the network and maintained covert access while pre-positioning to sabotage operations 'at a time of their choosing'. The intrusion was detected before any disruptive action; remediation is ongoing.

- **Published:** 2026-06-25T00:00:00Z
- **Last reviewed:** 2026-06-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0940
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-asio-pre-positioned-intrusion-tl-2026-0940.webp?v=f7d1934d (Threadlinqs threat intel: ASIO Nation-State Intrusion in Australian Infrastructure (TL-2026-0940) — High severity, 16 IOCs, 9 detection rules.)
- **ID:** TL-2026-0940
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 16

## Description

On 25 June 2026 The Register reported in detail on a critical-infrastructure intrusion disclosed in ASIO Director-General Mike Burgess's Annual Threat Assessment. According to ASIO, cyber units of at least one nation state 'routinely try to explore and exploit Australia's critical infrastructure networks, almost certainly mapping systems' so they can lay down malware or maintain access for the future. In one named incident, the actors 'successfully acquired credentials – login details and passwords – for active users', including IT staff, then engaged in 'mapping out the network and maintaining access so they could cripple it at a time of their choosing.' No disruptive action had been taken at the time of discovery; remediation is ongoing.

Burgess framed the activity as a shift from espionage to pre-positioning for high-impact sabotage: 'Spying is no longer just stealing secrets. It now encompasses preparing for sabotage.' He stated 'The scale of this activity – led by one nation-state in particular – is difficult to overstate' and that ASIO 'struggle[s] to find a single country in our region that has not been compromised by this state's cyber apparatus.' ASIO assesses the threat of high-impact sabotage of critical infrastructure will likely worsen over the next five years, naming the AUKUS submarine program among future concerns.

The targeting pattern spans water, transport and energy networks, with related reporting describing power grids and substations, telecommunications, satellite control centres, water and sanitation, and emergency-services networks, and adversaries 'embedding themselves years in advance' with 'covert persistence within operational technology (OT) systems.' ASIO also noted the same nation-state unit recently targeted critical networks in the United States; ASIO coordinated with American counterparts to evict the actors and 'shut down their global accesses, including nodes here in Australia.'

ASIO did not officially name the responsible state or a specific threat group, and no atomic indicators of compromise (IPs, domains, file hashes) were released. The tradecraft described — abuse of valid/IT-staff credentials, internal network reconnaissance, low-noise persistence, and pre-positioning against OT for future disruptive effect — mirrors the China-nexus 'living-off-the-land' critical-infrastructure pre-positioning pattern publicly documented by Five Eyes agencies (e.g. the CISA/NSA Volt Typhoon advisory AA24-038A). Media coverage associated the activity with Chinese state-sponsored actors, but this attribution is media-reported, not ASIO-confirmed; attribution confidence is therefore LOW. This record documents the disclosed tradecraft for defenders to hunt valid-account abuse and reconnaissance against critical-infrastructure and OT environments; it does not assert technical IOCs ASIO did not disclose.

## MITRE ATT&CK

- T1590 Gather Victim Network Information
- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1489 Service Stop
- T1485 Data Destruction

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Living-off-the-Land Internal Discovery Burst — Built-in Recon Binaries** (`TL-2026-0940-SPL-002`)

Detects the clustered execution of built-in discovery LOLBins (net, nltest, systeminfo, quser, ipconfig, arp, whoami) under a single user/session within minutes — the network-mapping reconnaissance ASIO described ('mapping out the network'). This is the Volt Typhoon-style living-off-the-land pattern with no malware, identified by behavioural clustering rather than atomic IOCs.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1018, T1046, T1016, T1087, T1082, T1033
- **Data sources:** sysmon, windows_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 
| eval img=lower(replace(Image,".*\\\\","")) 
| search img IN ("net.exe","net1.exe","nltest.exe","systeminfo.exe","quser.exe","ipconfig.exe","arp.exe","whoami.exe") 
| bin _time span=5m 
| stats dc(img) as distinct_tools values(img) as tools values(CommandLine) as cmdlines count by _time User Computer 
| where distinct_tools > 4 
| sort - distinct_tools
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("net.exe","net1.exe","nltest.exe","systeminfo.exe","quser.exe","ipconfig.exe","arp.exe","whoami.exe")
| summarize distinct_tools=dcount(FileName), tools=make_set(FileName), cmds=make_list(ProcessCommandLine), first=min(Timestamp), last=max(Timestamp) by DeviceName, AccountName, bin(Timestamp, 5m)
| where distinct_tools > 4
| project Timestamp, DeviceName, AccountName, distinct_tools, tools, first, last
```

### Sigma

```yaml
title: LOTL Internal Discovery Burst via Built-in Binaries (TL-2026-0940)
id: 1b2c3d4e-5f6a-4b7c-9d8e-0f1a2b3c4d51
status: experimental
description: Detects a tight burst of built-in discovery binaries under one session indicating living-off-the-land internal reconnaissance and network mapping.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
    - https://attack.mitre.org/techniques/T1018/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/25
tags:
    - attack.discovery
    - attack.t1018
    - attack.t1046
    - attack.t1016
    - attack.t1087
    - attack.t1082
    - attack.t1033
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\net.exe'
            - '\net1.exe'
            - '\nltest.exe'
            - '\systeminfo.exe'
            - '\quser.exe'
            - '\ipconfig.exe'
            - '\arp.exe'
            - '\whoami.exe'
    timeframe: 5m
    condition: selection | count(Image) by User > 4
falsepositives:
    - Administrator scripting or asset-inventory tooling running multiple built-ins
    - Logon scripts and helpdesk diagnostics
level: high
```

**Known false positives:**

- Sanctioned asset-management or inventory tooling invoking multiple built-ins
- Administrator troubleshooting scripts and logon scripts

**Tuning notes:** Allowlist known inventory/EDR service accounts and scheduled diagnostic scripts. Raise the distinct_tools threshold or shorten the timeframe in noisy admin environments; correlate with the anomalous-logon detection for higher fidelity.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Impossible-Travel / Off-Hours Valid-Account Sign-In — Credential Abuse (locked: unlock with TL Creds)
- Domain & Trust Reconnaissance via nltest/net — Network Mapping (locked: unlock with TL Creds)
- Low-and-Slow Beacon From Quiet OT-Adjacent Host — Covert Persistence (locked: unlock with TL Creds)
- External Remote Service Logon Anomaly on Linux Jump Host — Stolen-Credential Access (locked: unlock with TL Creds)
- Linux LOTL Host & Network Enumeration Burst — Pre-Positioning Recon (locked: unlock with TL Creds)
- Unsanctioned Network-Map / Asset-Inventory Artifact Creation — Pre-Positioning Map (locked: unlock with TL Creds)
- Valid/IT-Staff Account Logon From Anomalous Source — Pre-Positioning Initial Access (locked: unlock with TL Creds)
- Lateral Authentication From IT Into OT/ICS Management Segment (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Nation-state actors cracked critical Australian infrastructure to cripple it at a time of their choosing](https://www.theregister.com/security/2026/06/25/nation-state-actors-cracked-critical-australian-infrastructure-to-cripple-it-at-a-time-of-their-choosing/5261877)
- [ASIO boss warns Australian critical infrastructure systems 'routinely' mapped](https://www.itnews.com.au/news/asio-boss-warns-australian-critical-infrastructure-systems-routinely-mapped-615140)
- [ASIO warns of more complex security environment in 2026 threat assessment](https://australiansecuritymagazine.com.au/asio-warns-of-more-complex-security-environment-in-2026-threat-assessment/)
- [ASIO Chief Warns of State-Backed Cyber Sabotage Targeting Critical Infrastructure](https://dailysecurityreview.com/cyber-security/asio-chief-warns-of-state-backed-cyber-sabotage-targeting-critical-infrastructure/)
- [ASIO director-general warns of nation-state actors targeting critical infrastructure](https://www.cyberdaily.au/government/10248-asio-director-general-warns-of-nation-state-actors-targeting-critical-infrastructure)
- [ASIO Director-General's Annual Threat Assessment (official)](https://www.asio.gov.au/director-generals-annual-threat-assessment)
- [CISA/NSA/FBI Advisory AA24-038A — PRC State-Sponsored Actors (Volt Typhoon) Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (related living-off-the-land pre-positioning pattern)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a)
- [ASIO Chief Warns of 'High-Impact Sabotage' Threat as Chinese Hackers Probe Australian Critical Infrastructure (media attribution to China-nexus actors)](https://www.sydneytimes.net.au/business/asio-chief-warns-of-high-impact-sabotage-threat-as-chinese-hackers-probe-australian-critical-infrastructure/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0940