It’s time to treat state-sponsored cyber intrusions as attacks

Democracies made a big cybersecurity mistake in the 1990s when they insisted that cyber intrusions were not acts of war. That insistence meant managing a constant barrage of attacks rather than preventing them, teaching Russia, China, North Korea and Iran that the likely cost of malicious cyber activity was a strongly worded statement, or nothing at all.

Hindsight shows a stronger stand was needed then and is needed even more today. The ASD’s Annual Cyber Threat Report 2025-2026, released this week, found that state-sponsored actors target Australian critical infrastructure, businesses and individuals, and are increasingly pre-positioning inside networks for disruption when they choose.

One of the most important changes should be to cease treating cyberattacks as different from physical attacks. This also means treating attacks by governments separately from cybercrime. When a country or its businesses come under cyberattack, they must as a first step name any known attacker, just as they would if struck physically. It may be difficult for governments to name and insist on behavioural change from US frontier AI labs for unintended intrusions, similarly for hacks coming out or supported by China, but ignoring it may mean condoning it.

Ukraine’s experience helps show that a tougher stand is long overdue. In 2017, five years before the full-scale invasion, Russian military intelligence unleashed the NotPetya malware against Ukraine’s energy and financial sectors. Disguised as ransomware, which locks files until a ransom is paid, it instead destroyed data permanently and spread uncontrollably worldwide. This caused billions of dollars in damage and prompted Australia and others to attribute the malware publicly to the Kremlin. Almost a decade later, the threat has only grown, and AI is now amplifying it.

An open-source assessment last month, authored by cyber security firm Internet 2.0 and titled the Ukraine Malware Prevalence and Attribution Index, shows that several hacking groups linked to the Russian government have conducted bespoke cyber espionage, now aided by AI. The assessment identifies the Gamaredon Group, linked to the main Russian domestic security agency, FSB, as having used malware against Ukraine and NATO to break into sensitive computer networks and siphon information before installing destructive software on government systems for later activation. As with Beijing’s Volt Typhoon campaign against critical infrastructure, once such software – ‘digital dynamite’, according to former Australian Signals Directorate (ASD) director-general Rachel Noble – has been laid, all that remains is a decision to detonate it.

The report also finds that Russian military intelligence is still directing Sandworm, the same hacking group behind NotPetya. Sandworm attacked Polish energy facilities in December 2025 and, according to a Google report, used the Gemini AI model to tailor attempts to manipulate Ukrainian human targets. Gamaredon has so far confined itself to Ukraine, but NotPetya showed how quickly such tools can spread, whether by design or accident.

Australia should not assume these threats belong to faraway places. The new Australia–Ukraine Bilateral Security Agreement rightly recognises the lessons that Australia can learn from Ukraine’s experience in countering cyberattacks during hybrid warfare.

One of the problems is the perception that all cyber activity is the same. Here are six shifts that governments can make quickly.

First, governments should recognise that a state-sponsored cyber intrusion is an attack. For example, a Russian missile strike on a Ukrainian power station and a cyberattack on the same infrastructure both aim to cause damage and should both be treated as acts of war. The same applies to a state-sponsored cyberattack on a bank, a hospital or a telecommunication network.

Second, Australia and its partners should draw a clearer line between criminal activity, such as ransomware, and state-sponsored attacks on critical infrastructure. The latter should be treated as breaches of territorial integrity or acts of war. Australia should work with AUKUS partners under Pillar Two, with other Five Eyes and Quad members and with NATO to set norms making clear that attacks on critical infrastructure will face repercussions beyond strongly worded statements, including through targeted sanctions, criminal indictments, expulsion of officials and, where warranted, offensive cyber operations against the attackers’ infrastructure.

Third, public attribution should follow every identified state-sponsored attack, with technical agency advisories complementing political statements and actions rather than replacing them. Unlike terrorism, this is a threat on which the public remains under-informed, and labels like Volt Typhoon do little to change that.

Companies have a public responsibility to attribute, too. US cyber security company Mandiant’s 2013 exposure of APT1, the Chinese unit behind a years-long campaign against nearly 150 organisations, set the standard. Closer to home, Mandiant reported on UNC4191, a China-linked hacking group targeting the Philippines, and British cyber security company Sophos uncovered a China-linked campaign against an unnamed Southeast Asian government agency. Both companies exposed China-linked espionage in Southeast Asia tied to Beijing’s South China Sea ambitions. Yet this cyber activity attracts far less attention than the harassment of Philippine vessels at sea.

Fourth, the Australian government should update its cyber security strategy every two years, just as it now does with its national defence strategy. The cyber security strategy should distinguish clearly between ransomware, espionage and infrastructure disruption and set out the consequences that each will attract.

Fifth, Canberra should establish a standing exchange between ASD and Ukraine’s Computer Emergency Response Team, whose daily tracking of groups such as Gamaredon and Sandworm could warn Australian critical infrastructure operators of their new attacks.

Finally, democracies should help less-resourced neighbours build cyber defences. For Australia, that means helping in the Indo-Pacific. Cyber maturity across the region remains uneven while AI is lowering the cost of attackers finding vulnerabilities. A precedent is the Tallinn Mechanism, which coordinates donor governments’ civilian cyber aid to Ukraine and has committed €302.6 million (or around A$480 million) since December 2023. Australia already hosts the secretariat of the Pacific Cyber Security Operational Network. The network could become a basis to build on Ukraine’s lessons, including its use of AI-enabled defensive tools, to strengthen detection and response across our region.

Many of the cyberattacks that occur every day are the work of nation-states probing our weaknesses in preparation for future conflict. Governments and major companies must now undo the complacency that comes from either underplaying these attacks or growing dangerously desensitised to them.