23-year-old man

Profile narrative

The threat actor is identified publicly as a 23‑year‑old man residing in Australia, with no additional aliases provided in the source material. He was employed as an IT support worker for a third‑party contractor that serviced the Australian National Maritime Museum, which gave him legitimate internal access to the museum’s networks. Using this position, he entered the institution’s account payable system, altered financial details to substitute his own information, and subsequently made several purchases with the compromised data. The Australian Federal Police linked him to the incident after the museum detected anomalies in its financial records, leading to a search warrant at his home in Macquarie Park and the seizure of electronic devices for forensic analysis. The attack targeted the financial sector of a cultural institution, with the apparent strategic objective of monetary gain, as evidenced by the alleged redirection of approximately $90,000 in funds. No specific malware families, exploit tools, or initial‑access vectors beyond the abuse of trusted insider access are described in the reporting.

Attribution information does not indicate any state sponsorship, affiliation with a criminal consortium, or broader campaign beyond this single incident. The actor faced charges in Burwood Local Court that included five counts of dishonestly obtaining property by deception under the Crimes Act 1900 (NSW), four counts of dishonestly obtaining or dealing in personal financial information under the Criminal Code Act 1995 (Cth), and two counts of unauthorised access and modification with intent to commit a serious computer offence under the same Commonwealth legislation. The AFP characterized the motivation as greed, a claim made explicitly by investigators during the case. This episode represents the only publicly reported operation associated with the individual, and no further activities or larger operational patterns are documented in the available sources.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.