Italy targeted by multiple adversaries, new cyberspionage and cybercrime campaigns, law enforcement operations and security incidents

Italy: attacks from multiple threat actors detected

Over the past week, the pro-Russian hacktivist collective NoName057(16) renewed its focus on Italy, targeting the country over its military support for Ukraine and, in particular, recent joint statements by the Italian and Polish Defence Ministers expressing their intention to further strengthen support for Kyiv. The collective also referred to a hearing in ongoing legal proceedings dating back to 2021 involving members of Forza Nuova, criticizing the slowness of the Italian judicial system and claiming that the proceedings, allegedly deliberately ignored by the media, were characterized by bias. The attacks were marked with the hashtags #FuckEastwood, #TimeOfRetribution and #OpItaly. The targeted victims included: Municipality of Reggio Emilia; Municipality of Bari; Exprivia; Ellysse S.r.l.; NUSO Italia S.r.l. (formerly Mida Solutions S.r.l.); N&C S.p.A.; DGS S.p.A.; Allnet.Italia S.p.A.; ISED S.p.A.; GPI S.p.A.; Council of Presidency of Tax Justice; Public Contracts Service; Ministry of Defence – Recruitment Portal; Italian Navy; Italian Air Force; Galileo System (ISED S.p.A.); Intersistemi Italia S.p.A.; We-COM S.r.l.; Municipality of Emarèse; Tarros S.p.A.; Municipality of Charvensod; Municipality of Cogne; Municipality of Courmayeur; Netgroup S.p.A.; Terminal Container Ravenna S.p.A. Between 7 and 9 October, the BD Anonymous collective also claimed DDoS attacks against Italian portals. Specifically, the group targeted Exprivia S.p.A. in retaliation for the position attributed to the Italian Government, accused of refusing to recognize Palestine as a state. It also targeted an alleged portal of the Ministry of Foreign Affairs and International Cooperation (MAECI) and the website of the Parliamentary Budget Office (UPB), in retaliation against Italian authorities accused of failing to provide satisfactory responses regarding restrictions on wearing the niqab and burqa in schools and related fines of up to €1,000, which the adversary considered violations of freedom of worship and the rights of Muslim communities. Another hacktivist collective, Tunisian Maskers Cyber Force, also carried out DDoS attacks against the following 17 Italian portals: Ministry of Culture; Ministry of University and Research; Italian Institute for Environmental Protection and Research (ISPRA); Biological Magnetic Resonance Bank (BMRB) – CERM, University of Florence; FreeDenberg; I.VAR. Industry S.r.l.; Intermonte SIM S.p.A.; Terna S.p.A.; ESG Services S.r.l.; Banca di Credito Cooperativo Bergamasca e Orobica S.C.; Italian Society for Transport Policy (SIPoTra); Zoosafari Fasano; Bibanca S.p.A.; Slope S.r.l.; Turboden S.p.A.; Premiata S.r.l.; Marche Polytechnic University. Regarding phishing operations, two campaigns were tracked: the first, conducted via WhatsApp and already known as the “ballerina scam”, exploits fake online competitions to compromise user accounts; the second exploits the names and logos of the Italian Revenue Collection Agency (AdeR) and the Agency for Digital Italy (AgID) to steal credentials. Also in the cybercrime landscape, an operation named Canto Incognito, active since at least April 2026, was observed targeting exposed open-source services using malware called PoeLLM. The campaign is attributed with moderate confidence to an Italian-speaking adversary, based on Italian-language comments in the malware and on GitHub, network flow data geolocated in Italy, and testing and administration servers hosted in the country. Italy therefore appears to be both a likely operational base and one of the targeted countries, alongside the United States and Western Europe. More than 3,400 servers were compromised, with a peak of nearly 2,200 in mid-June. Finally, turning to the ransomware landscape, AuditTeam claimed on its leak site the compromise of STEELCO S.p.A. and PROMIND; SAFEPAY claimed HAL Service S.p.A.; DeadLock claimed Rino Greggio Argenterie S.p.A.; and NightSpire claimed Valvorobica Industriale S.p.A.

Threats and APTs: previously undocumented operations and possible use of AI

Security researchers tracked a cyberspionage campaign orchestrated by the Belarusian Cyber-partisans hacktivist group, aimed at deploying a backdoor named Vasilek and targeting an unidentified Russian healthcare organization with an extensive infrastructure and bidirectional trust relationships with numerous affiliated medical facilities. In parallel, an adversary named Mimbrob targeted the Russian aerospace industry, research institutes and IT companies using FBULoader and RAT-Go, presumably for espionage purposes, including through an application presented as a drone monitoring tool. On the Chinese front, the UAT-11587 cluster, assessed with high confidence to be linked to Beijing, primarily targeted government, national security and public policy organizations in Asia. The attacker, presumably interested in intelligence collection, deployed the Antino Windows backdoor using spear-phishing emails and highly customized decoy documents as the initial infection vector. Although overlaps and connections exist with the Chinese APT Earth Alux (Jewelbug) and a distribution infrastructure associated with UNC6384, UAT-11587 is considered a distinct entity. The CL-STA-1178 cluster, associated with an adversary believed to be aligned with Iranian state interests, conducted a cyberspionage campaign named Blinder Tunnel, targeting an individual with software development expertise working in the critical infrastructure sector in Iraq. The operation forms part of a broader pattern of cluster activity targeting the telecommunications and aviation sectors in the Middle East and used a fake recruitment process to distribute malicious remote access tools. On the npm registry, a campaign named MALFEX distributed several malicious payloads, including Overlord RAT and the movinlike infostealer, through packages that had collectively recorded more than 40,000 downloads as of 1 October. In September, CERT-UA identified more than 100 compromised websites used in a campaign attributed to the UAC-0277 cluster, aimed at distributing LUNEXSTEALER through fake Cloudflare security checks based on the ClickFix technique. In South Korea, several financial organizations, including Shinhan Bank, KB Kookmin Bank and Hana Bank, experienced compromises that resulted in data exposure. Investigations revealed the use of ARTEX, an agentic penetration testing tool developed in China, by an adversary whose identity has not yet been established with certainty. In parallel, the religious organizations Yoido Full Gospel Church and Sarang Church were also affected by alleged cyberattacks, with evidence suggesting the possible use of artificial intelligence tools, although no connection to the financial sector incidents has been established.

Cybercrime and hybrid threats: KillSec, ShinyHunters, compromises and allegations of Russian sabotage

On 30 September 2026, the international Operation KillSwitch, conducted by German authorities with the support of Europol and Eurojust, led to the seizure of KillSec‘s infrastructure. The group had been active since 2024 and was associated with approximately 1,000 suspected attacks, around 500 of which were considered successful. The operation resulted in three provisional arrests, eight searches, the takeover of the stolen-data publication website and the seizure of at least 110 TB of exfiltrated data. The alleged main operator is reportedly a 16-year-old individual, and authorities also identified the use of artificial intelligence to maintain the infrastructure and identify victims. In the preceding days, an individual identified by informed sources as Saif al-Din Khader, alias Rey, believed to be a prominent member of ShinyHunters and previously linked to Scattered LAPSUS$ Hunters, was detained in Jordan. He is reportedly cooperating with the FBI, although the agency has confirmed neither his identity nor the alleged cooperation. The case is intertwined with the removal, disclosed on 6 October, of an Accenture contractor from an assignment at the FBI following an Oracle PeopleSoft breach associated with the same group, which exposed the personal data of thousands of employees, including professional and medical information. Regarding security incidents, on 4 October Nikkei disclosed two separate unauthorized accesses: approximately 9,000 fraudulent emails were sent on 30 September from a compromised Microsoft 365 account, while a Google Workspace account had reportedly been compromised since late July, potentially exposing data belonging to 1,646 individuals. In Denmark, unauthorized access to the CPR registry through a private company exposed names, addresses and CPR numbers belonging to approximately 8.8 million registered individuals, with the anomaly detected on 2 October. On 6 October, ASOS confirmed unauthorized activity on third-party platforms used to communicate with customers, with possible access to basic customer data. Xuanye Group claimed to have compromised a Snowflake environment associated with ASOS and exfiltrated data, without confirmation from the company or independently verifiable evidence. On 5 October, Wikimedia also attributed unauthorized edits, almost entirely in testing areas, and a high volume of automated requests to AI agents it believes were operated by OpenAI, with no evidence of compromised systems or data. Finally, on 7 October, an analyst from the Danish intelligence service PET stated that Russia had launched sabotage operations against Danish companies supplying equipment to Ukraine, with an increase in activity since the beginning of the summer. The Russian embassy rejected the allegations.

Weekly Threats Report is Telsy’s weekly update featuring the main developments on cyber attacks and threat actors worldwide, produced by our Threat Intelligence & Response team.

The team is composed of analysts and security researchers with technical and investigative skills and internationally recognized experience.

Through continuous monitoring of cyber threats and geopolitical events, it produces and provides organizations with useful information to anticipate attacks and understand their scope, with the support of a trusted partner in the event of a cyber incident.

Learn more about our Cyber Threat Intelligence solution.