Top 5 Cyber Threat Groups New Zealand and Australian Businesses Should Be Preparing For

n0n, Cl0p, INC Ransom, Qilin and The Gentlemen represent five significant ransomware and data-extortion threats facing organisations across Australia and New Zealand.

Cybercriminal activity continues to evolve, with established ransomware operations and newer data-extortion groups targeting organisations across multiple industries. For businesses in New Zealand and Australia, understanding the common tactics used by these groups is essential for prioritising cybersecurity investment, incident response planning and cyber insurance.

These are not the only threats organisations need to consider. Criminal groups, independent operators, ransomware affiliates, initial access brokers and individuals of all sizes can cause significant damage. However, these five groups warrant particular attention based on their observed activity, reported victim targeting and the techniques associated with their operations.

The key takeaway is that organisations should prepare for more than ransomware encryption. Modern extortion operations increasingly involve stealing sensitive information, analysing financial records, threatening public disclosure and contacting customers, partners and other stakeholders to increase pressure on victims.

What Type of Threat Groups Are They?

All five are financially motivated cybercriminal extortion actors, primarily operating as ransomware or ransomware-adjacent data-extortion groups. Their methods vary, but the overarching objective is to obtain money by disrupting operations, threatening the disclosure of stolen information or combining both approaches.

Their likely origins are generally assessed as follows:

Threat group	Reported origin and attribution confidence
Cl0p	Russian-speaking; likely Russia/CIS
INC Ransom	Likely Russia-linked or operating within a Russian-linked ecosystem
Qilin	Russian-speaking; likely Russia-linked
The Gentlemen	Russian-speaking; likely Russia/CIS
n0n	Unknown; occasional Russia-linked speculation remains unconfirmed

These assessments should not be interpreted as definitive proof of nationality. Criminal operations can involve affiliates, infrastructure providers and individuals in multiple countries.

Reporting on n0n is considerably thinner than reporting on the other four groups, so confidence in its attribution is materially lower. Organisations should avoid treating unverified claims about a group’s origin as established fact.

New Zealand organisations: the legal implications of ransom payments

New Zealand organisations need to consider the legal consequences of paying a ransom, particularly where the recipient may be associated with Russia or another sanctioned person or entity.

Depending on the circumstances, a payment may breach the Russia Sanctions Act 2022 or applicable sanctions restrictions, including measures implemented under the United Nations Act 1946. The specific recipient, applicable restrictions and circumstances of the transaction matter.

Organisations should not assume that paying through an intermediary, negotiator or insurer makes a transaction lawful.

Before negotiating or making a payment, obtain specialist legal advice and assess applicable sanctions requirements. These considerations should be built into incident response plans and cyber insurance arrangements before an incident occurs.

Common Attack Methods Across the Five Groups

Although the groups use different tooling and operational approaches, their reported techniques show considerable overlap. The common pattern is to identify exposed systems, obtain access, compromise credentials, move through the victim’s environment, locate valuable information and use that access for financial gain.

The supplied MITRE ATT&CK mapping identifies T1486 — Data Encrypted for Impact across all five groups, with active scanning, exploitation of public-facing applications, command execution, remote services, local data collection and proxy use also appearing frequently.

MITRE ATT&CK technique	Groups represented in supplied mapping	Defensive priority
T1486 — Data Encrypted for Impact	5/5	Recoverable backups, restoration testing and ransomware detection
T1595 — Active Scanning	4/5	External attack-surface monitoring
T1190 — Exploit Public-Facing Application	4/5	Vulnerability management and rapid patching
T1059 — Command and Scripting Interpreter	4/5	Endpoint monitoring and suspicious script detection
T1021 — Remote Services	4/5	Secure remote administration and lateral-movement detection
T1005 — Data from Local System	4/5	Sensitive-data access monitoring
T1090 — Proxy	4/5	Network traffic analysis and unusual connection detection

The wider set of reported techniques also includes phishing (T1566), brute force (T1110), valid accounts (T1078), external remote services (T1133), account manipulation (T1098), scheduled tasks (T1053), credential dumping (T1003), file and directory discovery (T1083), server software components (T1505), file permission modification (T1222), and financial theft (T1657).

Data exfiltration techniques include T1041 — Exfiltration Over C2 Channel, T1048 — Exfiltration Over Alternative Protocol and T1567 — Exfiltration Over Web Service.

These mappings provide a useful starting point for defensive planning, but they do not mean every group uses every technique in every incident. Nor does the presence of encryption in the mapping mean every intrusion will result in encrypted systems. Data theft alone can create serious operational, legal and reputational consequences.

What this means for defenders

Organisations should prioritise controls that interrupt several stages of the attack lifecycle rather than relying on a single product or indicator.

• Reduce exposure: Maintain an accurate inventory of internet-facing systems, remove unnecessary services and rapidly patch actively exploited vulnerabilities.
• Secure identities: Enforce multifactor authentication, protect privileged accounts and investigate suspicious authentication activity.
• Detect internal movement: Monitor remote services, credential dumping, suspicious scripts and unexpected privilege escalation.
• Protect sensitive information: Apply least privilege, classify important data and monitor bulk access, staging and outbound transfers.
• Prepare for recovery: Maintain isolated or immutable backups and regularly test restoration of critical services.

The Shift Towards Data-Centric Extortion

A major concern for organisations is the growing emphasis on using stolen information to maximise pressure on victims. Attackers do not necessarily need to encrypt every system if they can obtain commercially valuable information and threaten to expose it.

A recent investigation published by SOCRadar, INC and The Gentlemen Ransomware: Exposed AI Infrastructure, reported infrastructure associated with affiliates linked to INC Ransom and The Gentlemen that made extensive use of AI-related services, including commercial models accessed through OpenRouter. <Cite refs={[“turn274785search0″,”turn274785search2”]}/>

The investigation describes an AI-assisted, human-supervised operating model in which tools supported reconnaissance, command generation, data analysis and the preparation of extortion material. The findings also indicate that infrastructure and tooling may be shared across parts of the ransomware ecosystem; they do not establish a formal alliance between the two groups. <Cite refs={[“turn274785search2″,”turn274785search3”]}/>

A recurring intrusion and extortion lifecycle

According to the investigation, observed activity followed a recurring pattern:

1. Discover the environment: Enumerate the domain, systems and available accounts.
2. Escalate privileges: Seek domain administrator access where possible.
3. Harvest credentials: Use credential-stealing tools to expand access.
4. Identify valuable data: Prioritise finance, HR, legal and executive information.
5. Collect and transfer information: Use tunnelling and other tools to move data outside the victim’s environment.
6. Apply financial and reputational pressure: Use stolen information to develop demands and threaten disclosure.

The reported extortion playbook goes beyond a conventional ransom note. Operators reportedly assess victims’ financial circumstances, identify sensitive compliance and customer information, provide samples as evidence of access and initially contact owners or executives without specifying a price.

Pressure may then escalate through scripted voice phishing (vishing), emails or calls to customers and partners, threats involving regulators, and eventual publication of stolen information. Reported deadlines can be as short as 24–72 hours. <Cite refs={[“turn274785search2″,”turn274785search3”]}/>

One healthcare victim was reportedly assigned an estimated payment band of AUD 3 million to AUD 8 million. This is a reported demand assessment, not a verified payment or an average ransom for healthcare organisations.

The investigation also describes efforts to contact customers and business partners through emails and vishing, as well as the use of typosquatted domains targeting victims’ customers.

This is particularly concerning for organisations whose business depends on customer confidence, trusted supplier relationships or the protection of personal information. A compromise can quickly become a wider business crisis when attackers use stolen information to pressure parties beyond the original victim.

Organisations need to plan for the weaponisation of stolen data, not just the disruption caused by encrypted systems. Incident response should involve technical teams, legal advisers, privacy officers, communications specialists and business leaders from the outset.

Ransom Demands and Cyber Insurance Considerations

Ransom demands vary significantly depending on an organisation’s size, revenue, the sensitivity of its data, operational importance, perceived ability to pay and the attacker’s objectives.

The following figures are indicative estimates supplied for this analysis. They should not be treated as independently verified group-wide averages. Publicly reported cases are an incomplete sample, and a ransom demand does not necessarily represent the amount ultimately paid.

Threat group	Indicative ransom figures	Important qualification
Cl0p	Approximately NZD 4–5 million	Estimate, not a verified average across victims
Qilin	Approximately NZD 700,000–2 million	Indicative range; demands vary
n0n	Approximately NZD 1 million to NZD 23 million or more in reported 2026 cases	Highly variable reported demands; not an average
INC Ransom	Unknown	No reliable average established
The Gentlemen	Unknown; at least one public case reportedly around NZD 300,000–400,000	Insufficient evidence to establish an average

No reliable average could be established for INC Ransom or The Gentlemen from the figures available for this analysis. Reporting on n0n is heavily influenced by a recent maritime campaign with unusually wide demand ranges, making a calculated average potentially misleading.

These estimates should be used as context rather than as a basis for predicting a future demand. They also do not capture the wider financial impact of an incident.

What organisations should consider when purchasing cyber insurance

Businesses should not base their cyber insurance limits solely on the potential cost of a ransom. Incident response, restoration, legal advice, business interruption and the consequences of data disclosure can collectively exceed the ransom demand.

When reviewing a policy, organisations should consider:

• Incident response and forensics: Funding for specialist investigators, containment and recovery.
• Business interruption: Coverage triggers, waiting periods and the duration of any indemnity period.
• System restoration: Costs associated with rebuilding systems, restoring data and recovering critical services.
• Privacy and regulatory exposure: Eligible legal expenses, notification costs and third-party claims, subject to policy terms.
• Extortion coverage: Whether ransom-related costs are covered, restricted or excluded, and what insurer approval is required.
• Sanctions compliance: Whether a proposed payment is lawful and permitted under the policy.
• Social engineering and fraud: Whether losses associated with vishing, impersonation and fraudulent transfers are covered.
• Customer and supplier impacts: The extent of cover for third-party claims or incidents involving service providers.

Policy wording, security requirements and exclusions vary between insurers. Organisations should discuss their specific exposure with their broker, insurer and legal advisers before an incident occurs. Insurance should complement preventive controls and tested recovery capabilities, not replace them.

Recommended Defensive Priorities for NZ and Australian Businesses

The shared techniques and extortion methods described above point to several priorities that organisations should address regardless of which group ultimately targets them.

Priority	Recommended actions
Internet-facing systems	Maintain an external asset inventory, prioritise exploited vulnerabilities and remove unnecessary exposure.
Identity security	Enforce phishing-resistant MFA where practical, restrict privileged accounts and monitor suspicious sign-ins.
Endpoint and server security	Detect suspicious scripting, credential dumping, persistence and ransomware behaviour.
Network security	Segment critical systems, restrict remote administration and investigate unusual internal connections.
Sensitive information	Apply least privilege, monitor bulk data access and detect unusual outbound transfers.
Backups and recovery	Maintain isolated or immutable backups and test restoration of business-critical systems.
Email and impersonation	Prepare for phishing, vishing, executive impersonation and attacks against customers and suppliers.
Incident response	Exercise scenarios involving data theft, extortion, customer contact and public disclosure.
Threat intelligence	Monitor credible regional reporting and validate relevant indicators against the organisation’s own environment.
Legal and insurance readiness	Establish legal escalation, insurer notification and sanctions-compliance processes in advance.

Organisations should validate that their security controls can actually detect these behaviours. The presence of an endpoint detection product, SIEM or vulnerability scanner does not guarantee effective coverage.

Threat-informed detection engineering, purple-team exercises and realistic incident simulations can help identify gaps before attackers exploit them.

Conclusion

n0n, Cl0p, INC Ransom, Qilin and The Gentlemen represent five significant threats that New Zealand and Australian organisations should consider when prioritising their cybersecurity defences. They are not the only groups of concern: smaller criminal operations and individual attackers can also cause substantial harm.

Across these groups, the common pattern is clear. Attackers may exploit exposed systems, compromise identities, move through internal networks, steal valuable information and use the threat of encryption or disclosure to demand payment.

For business leaders, the objective should not be to predict exactly which group will strike next. It should be to reduce the likelihood of compromise, detect intrusions early, protect sensitive information, recover critical operations and prepare for the legal, financial and reputational consequences of extortion.

The most effective defence is one that remains resilient regardless of which threat actor is on the other side of the attack.