Details have been revealed about a highly sophisticated cyber attack on the ANU.

A 5000-page report on the hack that occurred earlier this year has been released, revealing a long timeline as hackers (possibly a group of up to 15) slowly worked their way into greater and greater levels of access to the ANU’s computer systems.

On November 9, 2018, hackers emailed a senior staff member at the ANU.

Another staff member accessed their colleague's account and previewed the email, but did not even go so far as to click on it.

The email was deleted, but the intruders had already accessed the senior staff member's username, password and calendar.

This allowed them to map the ANU computer network and understanding of how everything was connected.

They then began a second stage, including a targeted mailout to 10 people at ANU, inviting them to attend an event at the university.

The hackers were able to access a directory of usernames, emails, phone numbers and job titles of people to target, sending out more emails to ANU accounts, ultimately gaining the username and password of a network administrator.

Having admin access allowed them to extend the reach of their attack.

The hackers maintained access until December 21.

The ANU says up to 15 people may have been involved in the hack, but has not blamed any one country or organised crime syndicate.

A senior analyst with the Australian Strategic Policy Institute believes it was China.

“It's likely to be China, frankly, they've got strong interests in Australia for a number of different reasons,” analyst Tom Uren said.

“We're part of the Five Eyes alliance so there's a relationship with American military and intelligence. Canberra is the heart of government and there's many students at the ANU that go on to work in government.

“Plus, there's also a lot of Chinese students who come to Australia to study and one theory that's been told to me is that perhaps the Chinese Government wants to keep tabs on what its students in Australia are doing as well.”

There is no evidence that the attack has led to any identity fraud to date.

The full report is accessible here.