Canberra-based research institution launched an enterprise-wide forensic investigation into an advanced persistent threat (APT) network intrusion. IT security teams detected anomalous data staging across core academic servers. ACSC engaged for response.