Mr Morrison said the attack was ongoing but “frequency has been increasing”.
He did not name a suspect but added that there are “not a large number” of countries which can carry out such sophisticated attacks.
Mr Morrison said: “Australian organisations are currently being targeted by a sophisticated state-based cyber actor.
“This activity is targeting Australian organisations across a range of sectors, including all levels of Government, industry, political organisations, education, health, essential service providers and operators of other critical infrastructure.
“We know it is a sophisticated state-based cyber actor because of the scale and nature of the targeting and the trade craft used.
“Regrettably, this activity is not new. Frequency has been increasing.”
MORE TO FOLLOW