These incidents are quite varied— ranging from cyber attacks on computers and accounts, to cryptocurrency, investment and romance scams. 

We saw a number of incidents that started with a scam phone call, where the attacker went on to carry out unauthorised money transfers or trick people into sending money. In this report, we have explained how some of these phone scams work and how to identify them. We also take a detailed look at what botnets are and how criminals can use your device to take part in cyber attacks without your knowledge. 

You can also find more about Malware Free Networks - the NCSC's award-winning service that works to detect and disrupt malicious cyber activity and to keep your network free from it. 

There was a significant decrease (54%) in reports of phishing and credential harvesting. A drop in reports doesn't mean there’s less cybercrime. We know cybercrime is underreported and we need your reports to better understand and respond to the threats New Zealand faces. When you report to us, we can alert other New Zealanders and help protect them from cyber attacks and scams.

You can report any incident to us - big or small - using our online reporting tool. The information you provide is treated as confidential and will not be shared with other agencies without consent.

Report an incident - business and individuals | CERT NZ

Incidents in the C3 category doubled compared to a typical quarter. This included unusual distributed denial-of-service (DDoS) against organisations in the financial sector and a ransomware incident that impacted the customer services of an organisation in the information media and telecommunications sector. There was also an 30% increase in the number of incidents categorised as C5 compared to the previous quarter.

Incidents by suspected actors

Of the 100 incidents, 

• 21 were assessed to be likely linked to state-sponsored actors,
• 36 were assessed to be likely linked to cybercrime actors, and
• 43 did not have enough evidence to link the activity to a known malicious actor.

There was an 30% decrease in the number of incidents reported to the NCSC which indicated links to state-sponsored actors in a typical quarter. Of the 36 incidents assessed to be likely linked to cybercrime actors, most involved reconnaissance activity through the theft of credentials or resource development to acquire infrastructure. 

Techniques, tactics and procedures (TTPs) 

The NCSC maps the malicious cyber incidents it responds to using the MITRE ATT&CK framework. This helps us understand how malicious cyber actors are targeting New Zealand. For more information see attack.mitre.org External Link .

In Q4, consistent with the previous reporting period, reconnaissance activity was observed most frequently by the NCSC (50 times). Within this activity, most cyber actors were gathering victim credentials or IP addresses, or scanning victim networks for vulnerabilities.

The next three most commonly seen tactics were:

• 30 - initial access;
• 21 - resource development; and
• 18 - credential access.