In its annual threat report, the agency also said that the risk of terrorist organisations using a cyber attack to affect Australian interests was low.
With regard to cyber espionage, the report said Australia was a target of interest to foreign intelligence services.
However, the main drivers for this activity appeared to be in cases where Australia had a prominent role in contested international issues or where the interests of another country could be affected.
In February, Prime Minister Malcolm Turnbull had asked the ACSC and its agencies to brief other smaller political parties about threats to the electoral process in the wake of news in the US that the 2016 presidential poll may have been influenced by external actors.
The report said one small defence contractor had been compromised in November last year. The attackers had been able to stay within the victim's system for a long time and had stolen a fair amount of data.
"Analysis showed that the adversary gained access to the victim network by exploiting an Internet-facing server, then using administrative credentials to move laterally within the network, where they were able to install multiple webshells – a script that can be uploaded to a webserver to enable remote administration of the machine – throughout the network to gain and maintain further access," the report said.
The ACSC said it had observed fewer major compromises of government networks, though this did not mean that the number of attempts had decreased.
"No federal or state government network is exempt from malicious cyber activity. Foreign states continue to possess the greatest intent and capability to compromise Australian government networks," the report said.
"Cyber criminals continued to pose an ongoing threat to government-held information, although much of it is opportunistic, rather than specific effort to compromise a given network. Nevertheless, relatively inexpensive and accessible cyber tools can achieve significant disruptive effects and embarrassment."
Graphic: courtesy Australian Cyber Security Centre