Cyber warfare: Uncomfortable truths about cyber munitions from the first quarter of the 21st century

The first quarter of the 21st century did not just reshape geopolitics, it quietly rewrote the rules of warfare. However, most organisations have not received the brief.

We tend to think of cyber warfare as something that happens only to governments and militaries, fought well above the waterline of a typical enterprise security team. That assumption is rapidly becoming a liability, and Australian critical infrastructure providers are increasingly in the firing line.

The history of state-sponsored cyber operations offers an uncomfortable but instructive arc. In 1982, a logic bomb was the most probable root cause of the largest non-nuclear explosion in history, with no attribution for decades. In 2008, Russian cyber operations against Georgian power stations ran in synchrony with kinetic ground forces; the first documented convergence of cyber and conventional warfare. Stuxnet in 2010 physically destroyed Iranian centrifuges using malicious code on a USB drive. Each event was studied, catalogued … and largely regarded as somebody else's problem.

In 2017, the world received a reality check when NotPetya reminded us there is no such thing as a precisely targeted cyber weapon. Designed as a wiper aimed at Ukrainian infrastructure, it escaped its intended theatre and caused an estimated USD $10 billion in damage to Maersk, DLA Piper, FedEx, and even a humble Tasmanian chocolate factory. Collateral damage is a by-product of the munition itself.

In March 2026, Handala (an Iranian state-sponsored group) wiped over 200,000 devices across Stryker Corporation's global Microsoft environment, disrupting a company whose products reach 150 million patients annually. It is a reminder that the edge cases of the early 2000s may be a daily reality for SOC teams across the country in the new future.

Now Anthropic's Mythos has autonomously discovered thousands of zero-day vulnerabilities across every major operating system and browsers, and the zero-day pipeline, once the exclusive domain of elite nation-state teams, is being democratised. 

This talk does not deal in hypotheticals. The munitions exist. The spillover has happened. The mass weaponisation capability is here. The question is whether we are prepared to respond at the speed these threats now demand.