Cyber Threat Actor: Alf

The threat actor tracked under the alias Alf was identified by the Australian Signals Directorate following a intrusion discovered in November 2016. The breach itself occurred in July 2016 at an unnamed Department of Defence contractor that employed roughly fifty people. ASD spokesperson Mitchell Clarke disclosed the incident at an industry conference in Sydney, noting that the stolen archive amounted to about thirty gigabytes of data. The material included technical specifications for the F‑35 Joint Strike Fighter, the P‑8 Poseidon submarine‑hunting airplane, the Lockheed‑Martin C‑130 transport aircraft, JDAM guided bombs and information on several naval ships. The data was described as sensitive and not publicly available but was not classified as top secret.

The contractor’s security posture was hampered by the use of default credentials such as admin and guest passwords on multiple systems. Only a single IT staff member was responsible for securing the network of the approximately fifty‑person organization. During the forensic examination ASD analysts found a China Chopper web shell residing on the compromised servers, though they could not confirm whether it served as the initial entry point. No other malware families or custom tooling were referenced in the public reporting. The reliance on weak passwords and limited IT support represents the only confirmed initial‑access vector associated with Alf.

Australian officials have stated that they are still determining whether the activity reflects a low‑skill opportunistic hacker, a case of economic espionage, or the work of a nation‑state cyber‑intelligence actor, and no definitive attribution has been made public. Consequently, any link to a state sponsor or criminal consortium remains undocumented in open sources. The 2016 defence‑contractor breach is the sole publicly reported operation attributed to Alf, and it provides the only concrete example of the actor’s known targeting of the defence sector in Australia. The ASD originally chose the codename Alf as a reference to a character from the Australian television soap opera Home and Away.