Ransomware is no longer the domain of a single criminal syndicate operating from a darknet server. In 2026 it is a franchise economy: decentralised, resilient and deliberately built to survive law enforcement takedowns. Publicly reported ransomware attacks rose to 7,200 globally in 2025, a 47 per cent increase on the prior year, driven largely by the growth of Ransomware-as-a-Service (RaaS) affiliates. They move freely between gangs, rebrand overnight and take their tradecraft with them.
For Australian organisations, the rules have just changed again. On 30 May 2025, the mandatory ransomware payment reporting regime under Part 3 of the Cyber Security Act 2024 came into force. It creates a 72-hour reporting obligation that changes how your incident response team must operate. The threat and the new legal framework have to be understood together, and that is now a board-level matter.
The RaaS cartel model: fragmentation as a survival strategy
The coordinated law enforcement takedowns of 2022 to 2024, aimed at Hive, ALPHV/BlackCat and LockBit, were meant to decapitate the ransomware ecosystem. Instead they accelerated its evolution. RaaS operators responded by decentralising further.
DragonForce is the clearest example. It emerged in 2023, and by March 2025 it had rebranded as a ransomware cartel, a white-label infrastructure model that lets affiliates operate under their own brand names while using DragonForce's encryption tools, negotiation platforms and leak portals. Security researchers have identified a loose alignment between DragonForce, Qilin and a reconstituted LockBit 5.0 operation. The result is a cartel-style arrangement that is resilient, varied in reputation and highly adaptable.
For defenders, this creates an intelligence gap. When an affiliate moves from one RaaS platform to another, they take their access credentials, victim lists and preferred initial access methods with them. Attribution becomes harder. Indicators of compromise (IoCs) from a previous incident may no longer map to the next attack by the same human threat actor, even if they are using different malware.
Double and triple extortion: the new baseline
Encrypting files and demanding a ransom is now a minimum viable attack. In 2025 and 2026, the overwhelming majority of professional RaaS operations use a double extortion model as standard. Data is exfiltrated before encryption, and victims who restore from backups still face the threat of their data being published on a Tor-based leak site.
Triple extortion adds a third layer of pressure: contacting customers, regulators or business partners directly to amplify reputational damage and regulatory exposure. For Australian organisations this lever is particularly sharp because of the Privacy Act 1988 Notifiable Data Breaches (NDB) scheme and sector-specific obligations under the Security of Critical Infrastructure Act 2018 (SOCI Act). A threat actor who publishes data and simultaneously notifies the Office of the Australian Information Commissioner (OAIC) on your behalf has turned your compliance obligations against you.
Why healthcare and fintech are primary targets
Attackers choose sectors for commercial reasons. According to the ASD's ACSC Annual Cyber Threat Report 2024 to 25, ransomware incidents against the healthcare sector doubled in the 2024 to 25 financial year compared to the prior year. Threat actors succeeded in 95 per cent of all healthcare and social assistance sector incidents that ASD's ACSC responded to, nearly double the 52 per cent success rate across all sectors. Healthcare organisations hold high-value personal health information, run life-critical systems where downtime is catastrophic, and are statistically more likely to pay to restore services quickly.
Financial and insurance services accounted for 32 per cent of all critical infrastructure incidents, the highest of any sector, according to the same ACSC report. Fintechs are attractive for a different reason: they combine high-value transaction data, regulated personal information and, often, less mature security than traditional banks. The 2026 ransomware attack on Australian fintech YouX, which exposed an estimated 229,000 driver licence numbers and borrower personal data, fits this pattern.
Hospitality and accommodation organisations increasingly appear on RaaS affiliate target lists, mainly because they combine payment card data, relatively flat network architectures and high-volume seasonal staffing that creates persistent phishing exposure.
What the mandatory ransomware reporting obligation means for your IR plan
Australia's new mandatory ransomware payment reporting regime is more than a regulatory checkbox. It reshapes the incident response timeline, and organisations need to plan for that in advance, not during an active crisis.
Who must report
Under the Cyber Security (Ransomware Payment Reporting) Rules 2025, entities carrying on business in Australia with an annual turnover exceeding AUD $3 million must report any ransomware or cyber extortion payment (including payments made by an insurer or third party on their behalf) to the ASD's ACSC via an online portal. Responsible entities for critical infrastructure assets under the SOCI Act are also covered regardless of turnover.
The 72-hour clock
The reporting window is 72 hours from the moment of payment, or from the moment you become aware that a payment has been made on your behalf. The distinction matters: if your cyber insurer negotiates and settles a ransom demand without first notifying you, your 72-hour clock starts when you learn of the payment, not when the transaction cleared.
Your incident response plan therefore needs explicit contractual requirements for your cyber insurer and any external incident response retainer to notify you before any payment is made. Your legal counsel also needs to be part of the IR workflow from the start of a ransomware event, not brought in at the settlement stage.
The education-first phase is over
The Department of Home Affairs took an education-first approach from 30 May 2025 to 31 December 2025, reserving regulatory action for egregious non-compliance. From 1 January 2026, active enforcement applies. Civil penalties for failure to report reach up to 60 penalty units, currently AUD $19,800 per contravention. The financial penalty is not catastrophic for a large enterprise, but the reputational and regulatory consequences of a non-compliance finding are significant, particularly during an OAIC investigation into the same incident.
Does reporting prevent you from paying?
No. The legislation does not prohibit ransom payments. It creates a reporting obligation, not a payment ban. The government's stated rationale is to build an intelligence picture of the Australian ransomware ecosystem: which threat actors are active, which sectors are targeted and how big the problem is. Organisations that pay and report in good faith are not penalised for the payment itself.
Practical mitigation priorities for 2026
Understanding the threat only helps if it drives concrete defensive action. The following priorities reflect both the current threat actor playbook and the Essential Eight Maturity Model, which remains the ACSC's recommended baseline for Australian organisations.
Immutable, tested backups
Double extortion has not made backups irrelevant, but it has changed their purpose. Restoring from a clean backup avoids paying for decryption, even when the threat of data publication remains. Backups must be immutable (write-once, append-only), stored offline or in an air-gapped environment, and tested for restoration under realistic incident conditions at least quarterly. A backup that has never been restored is a liability, not an asset. Essential Eight Maturity Level 2 requires regular backup testing; Maturity Level 3 requires unprivileged accounts to be unable to access or delete backup stores.
Phishing-resistant MFA across all remote access
Initial access through compromised credentials, whether acquired by phishing, credential stuffing or prior breach data, remains the dominant entry vector for RaaS affiliates. Legacy MFA methods (SMS OTP, push notifications without number matching) are routinely bypassed through MFA fatigue attacks and adversary-in-the-middle proxies. Organisations should deploy phishing-resistant MFA, meaning FIDO2/passkeys or certificate-based authentication, for all remote access, privileged accounts and cloud administration portals. This aligns with Essential Eight Maturity Level 3 for Multi-Factor Authentication.
Network segmentation and least privilege
RaaS affiliates rely on lateral movement after initial access to maximise the scope of encryption. Flat networks, common in healthcare, hospitality and mid-market organisations, let a single compromised endpoint become a full domain compromise within hours. Use micro-segmentation to isolate clinical systems, financial applications and backup infrastructure from general corporate networks. Pair it with strict least-privilege access controls: accounts should have access only to the resources their role requires, not inherited domain-wide rights.
Incident response planning with ransomware-specific playbooks
Generic incident response plans are not enough for ransomware events, which bring technical, legal, commercial and communications pressures at the same time and on compressed timelines. Your ransomware playbook must document:
- The chain of authority for the ransom payment decision, and the explicit requirement to notify legal counsel before any payment is authorised
- Your cyber insurer's notification requirements and the contractual clause requiring pre-payment notification to you
- The 72-hour ACSC reporting trigger and the designated person responsible for filing the report
- Your NDB assessment process: a ransomware exfiltration is almost certainly an eligible data breach requiring OAIC notification and potentially individual notification
- Executive and board communication templates for the first 24 hours
- A pre-engaged forensics retainer with a firm experienced in Australian regulatory requirements
Essential Eight maturity as a foundation
The Essential Eight Maturity Model gives a structured, ACSC-endorsed path to ransomware resilience. Three controls matter most against the current RaaS playbook: Application Control (prevents execution of attacker tooling on endpoints), Patch Applications (closes the known vulnerabilities RaaS affiliates routinely exploit) and Restrict Administrative Privileges (limits the blast radius when credentials are compromised). Achieving Maturity Level 2 across all eight controls significantly reduces the probability of a successful ransomware event; Maturity Level 3 makes recovery without payment a viable outcome in most scenarios.
Threat intelligence and the new reporting regime
One side effect of the mandatory reporting regime is more intelligence for defenders. As more Australian organisations report ransomware payments to the ACSC, the ASD builds a fuller, more current picture of active threat actors, preferred initial access vectors and targeted sectors. This intelligence, distributed through the ACSC's partner and advisory programs, benefits the wider ecosystem. Organisations that take part in the ACSC's cyber threat intelligence sharing programmes and hold ASD Partnership status get earlier warning of campaigns targeting their sector.
Threat intelligence is not only a government function. Commercial threat intelligence feeds, sector-specific ISACs (Information Sharing and Analysis Centres) and dark web monitoring services that flag leaked credentials or discussion of your organisation on RaaS affiliate forums are all components of a mature threat intelligence capability.
Key takeaways
- RaaS has fractured into a cartel model. Affiliates migrate freely between gangs, carrying access and tradecraft with them. Defences that rely on attribution are not enough.
- Double extortion is the baseline. Even organisations with functional backups face the threat of data publication. Prevention costs less than negotiation.
- Healthcare and fintech face elevated risk. According to the ACSC's Annual Cyber Threat Report 2024 to 25, healthcare ransomware incidents doubled and financial services led critical infrastructure incidents at 32 per cent.
- Mandatory reporting is active from 1 January 2026. Entities with turnover over AUD $3 million must report ransomware payments to the ACSC within 72 hours, including payments made by insurers on their behalf.
- Your IR plan needs updating now. Document the 72-hour clock, insurer notification requirements and NDB obligations in advance, not during an active incident.
- Essential Eight Maturity Level 2 is the minimum defensible baseline. Immutable backups, phishing-resistant MFA, application control and least privilege together address the dominant attack vectors in the current RaaS playbook.
Ransomware resilience does not come from a single product or a single audit. It takes a continuous programme of technical controls, tested processes and regulatory readiness. CyberCorp's GRC and incident response specialists work with Australian organisations across healthcare, financial services and critical infrastructure to build that resilience before a threat actor forces the issue. Schedule a GRC Assessment to evaluate your current Essential Eight maturity and ransomware readiness, or learn more about our Essential Eight compliance programme and managed security operations capabilities.
