Start Free Trial

Inside the Mind of an Attacker: Helping You Strengthen Your Essential Eight Defences

Part 1 in a series

Cyber Security - The Importance of Executive Support for the Essential Eight

Cybersecurity isn’t just about stopping hackers, it’s about understanding how they think. For Australian organisations operating in government or critical infrastructure, the threats aren’t abstract. Breaches happen quietly, often through the simplest gaps: a reused password, an unpatched system, or an employee caught off-guard by a fake invoice.

The Australian Cyber Security Centre’s Essential Eight remains one of the most effective baselines for defending against such attacks. But adopting the Eight as a list isn’t enough. Today’s compliance-driven environment demands more: proof of maturity, not just implementation.

This article explores how attackers break in and how aligning with the Essential Eight moves your security posture from theory to evidence-backed resilience.

1. Phishing & Social Engineering: Where Most Attacks Begin

It still starts with an email. Or a Teams message. Or an urgent voicemail with a spoofed number.

Phishing remains the most reported cybercrime in Australia, with just over 150,000 reports in FY2023-24, according to the ACSC, representing 55% of all losses and 74% of all reports. But these aren’t the clumsy scams of the past. Today’s attackers use AI-enhanced OSINT (open-source intelligence) to craft highly credible messages: referencing real projects, mimicking internal tone, and spoofing executive names.

And when staff click? Malware is delivered, credentials are harvested, and the attacker is in.

Essential Eight Response:

  • User application hardening limits the execution of malicious payloads.
  • Application control stops unknown executables before they launch.
  • But human error remains the gap. Regular simulation and user awareness training are essential and maturity models increasingly require this.

2. Credential Theft & Reuse: One Breach, Many Doors

Passwords are the digital master key and attackers know where to find them.

A 2023 SpyCloud report found over 25 billion unique credentials circulating on the dark web. Most users reuse credentials across accounts, meaning a single compromise can cascade across cloud services, VPNs, and administrative portals.

The Office of the Australian Information Commissioner (OAIC) reported that one-third of data breaches in 2022 stemmed from compromised credentials. It’s not just about password strength, it’s about layering access.

Essential Eight Response:

  • Multi-factor authentication (MFA) is critical across all externally exposed services.
  • Restricting administrative privileges contains the blast radius if credentials are reused.
  • At higher maturity levels, organisations also audit dormant accounts and enforce just-in-time privilege elevation.

3. Unpatched Systems: Known Exploits, Easy Targets

Attackers don’t always innovate, often, they just exploit what’s been ignored.

Critical vulnerabilities in widely used platforms (e.g., Microsoft Exchange, Fortinet, Citrix) are regularly weaponised within days of public disclosure. The ACSC notes that up to 90% of incidents could have been prevented through timely patching.

The 2021 ProxyShell and Log4j exploits are examples: high-severity vulnerabilities that were broadly known and broadly unpatched.

Essential Eight Response:

  • Patching applications and operating systems within ACSC’s recommended timeframes (2 weeks for internet-facing, 1 month for others) is a non-negotiable.
  • At higher maturity, patching is automated, auditable, and integrated with asset inventory.

Tip: Organisations using tools like Introspectus Assessor can track patch compliance in real time, not just during annual audits.

4. Privilege Escalation: The Quiet Takeover

Once inside, attackers aim to move laterally, escalating privileges and embedding persistence.

Well-known tools like Mimikatz or Cobalt Strike are used to harvest credentials, scan for domain admin accounts, and pivot across systems. According to Mandiant, 70% of APT campaigns in Asia-Pacific involve privilege escalation, usually enabled by excessive permissions or flat internal networks.

Essential Eight Response:

  • Restricting admin rights drastically reduces what an attacker can access post-compromise.
  • Segmenting internal networks and enforcing MFA on privilege escalation are vital to achieving Maturity Level Two or above.
  • Visibility is key: knowing who has what access, where, and why.

5. Ransomware: When Risk Becomes Reality

Ransomware is no longer just encryption, it’s extortion-as-a-service, often preceded by data theft.

The ACSC received 121 ransomware reports in FY2023–24, but the true number is much higher. Many incidents go unreported due to reputational concerns or insurance involvement. Most ransomware groups now operate as syndicates, with dedicated roles for access brokers, data exfiltration and negotiation.

Downtime, breach notification, privacy compliance. The cost is rarely just the ransom.

Essential Eight Response:

  • Daily, tested backups stored offline are your final line of defence.
  • Application control stops unauthorised executables, including ransomware payloads.
  • Patch hygiene and privilege management reduce the likelihood of initial access and lateral movement.

From Defence to Evidence: Why Compliance Demands More

For organisations subject to the Privacy Act, the Critical Infrastructure Act, or industry-specific standards, implementing the Essential Eight is no longer optional, it’s assumed. What matters now is proof:

  • Can you demonstrate that controls are active and effective?
  • Can you show your Essential Eight maturity level in real time?
  • Can you provide evidence before a regulator or incident response team asks?

Tools like Introspectus Assessor bring this into focus. By continuously auditing against your chosen Essential Eight maturity posture, they offer real-time clarity not just periodic snapshots.

Final Takeaway: Don’t Just Deploy Controls – Prove They Work

The ACSC’s Essential Eight was designed to make attacks harder. But in today’s environment, it’s also how organisations demonstrate that their cyber controls are robust and that a culture of cybersecurity is embedded throughout the organisation: to boards, to regulators and to the public.

It’s not just about having controls in place, it’s about knowing they’re effective and being able to show it.

Because in the next breach, the question won’t be whether you had controls in place, it’ll be how you proved they worked. And when visibility, maturity tracking and audit-readiness matter, that’s where software platforms like Introspectus Assessor step in.