Russian Spies Are Testing Australia's Unlocked Doors

Key points

• The Australian Signals Directorate (ASD) issued a joint advisory with agencies from roughly two dozen countries, including the United States, the United Kingdom, Canada, Finland, France and Denmark, warning of ongoing Russian-linked intrusions into critical infrastructure.
• The hackers are linked to Russia's Federal Security Service (FSB) and have been active for more than a decade.
• Targets include financial services, healthcare, defence and communications, with state and local government agencies flagged as especially exposed.
• The attackers use basic methods, including guessing factory-set default passwords on routers, the devices that direct traffic between computers inside an organisation.

Hackers working for Russian intelligence are not doing anything exotic. They are rattling doors.

The Australian Signals Directorate (ASD), the country's electronic intelligence and cybersecurity agency, published a joint advisory alongside the United States National Security Agency and partner agencies from the United Kingdom, New Zealand, Canada, Finland, France, Denmark and roughly a dozen others. Groups operating on behalf of Russia's Federal Security Service (FSB) are actively targeting critical infrastructure, a broad term covering the systems that keep hospitals, banks and utilities running.

The method is simple. Hackers scan the internet for routers, the physical devices that steer data traffic inside an organisation's network, that still use their factory-set default passwords. Guessing those passwords requires no special skills. Once inside, they quietly copy login credentials and other sensitive information.

Alastair MacGibbon, former head of the Australian Cyber Security Centre, described the campaign to ABC News as bluntly effective. "It's not sophisticated, but it works really well," he said. "It's the equivalent of walking around the internet and rattling the doors of organisations to see if they've been essentially left in a factory setting."

We covered this advisory on 13 July 2026 when it first circulated among US and UK signatories, including the detail that FSB Centre 16 operators were scanning for old Cisco flaws. Australia's inclusion now broadens the coalition's reach.

The ASD names several hacking groups it considers frequently responsible: Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly and Ghost Blizzard. Security researchers generally treat these as overlapping names for clusters of FSB-linked operators.

Why should an ordinary Australian be concerned?

Because the sectors under attack directly affect daily life. A breach inside a hospital network can delay patient records and slow care. A foothold in a financial institution can expose customer data. State and local government agencies, flagged as particularly vulnerable, hold tax records and welfare information for millions of people.

The fix, for most organisations, is not expensive. Basic steps include changing default passwords on every network device, applying software updates promptly and placing routers behind a firewall, a security barrier that blocks outside internet traffic from reaching internal equipment directly.

MacGibbon noted that many organisations do not realise their routers are visible to the open internet at all. That invisibility is the real risk. ASD data shows a cybercrime report is filed in Australia approximately every six minutes.

The plain truth of this advisory is that it describes a decade-old playbook that keeps working because organisations still ship gear with default passwords intact and never change them. That is the detail worth watching: not the group names, not the geopolitics, but whether this round of warnings finally moves someone to check.