Attacks targeting Italy, APT and cyberspionage campaigns, new vulnerabilities exploited ITW

Italy: DDoS attacks, ransomware and smishing operations

Over the past week, the pro-Russian collective NoName057(16) once again turned its attention to Italy, targeting several portals, including: Municipality of Bari; DGS S.p.A.; ALLNET.ITALIA S.p.A.; ISED S.p.A.; Intersistemi Italia S.p.A.; We-Com S.r.l.; Municipality of Emarèse; Netgroup S.p.A.; Terminal Container Ravenna S.p.A.; Municipality of Reggio Emilia; Metropolitan City of Cagliari; Sogedim S.p.A.; Arco Spedizioni S.p.A.; Lorenzini & C. S.r.l.; Gruppo Neri; Azimut|Benetti Group; Italian General Confederation of Transport and Logistics (CONFETRA); Association for Sustainable Intermodal Logistics (ALIS); Interporto Padova S.p.A. The pro-Palestinian group Dark Storm Team also joined in support of NoName057(16), claiming DDoS attacks against N&C S.p.A.; DGS S.p.A.; Allnet.Italia S.p.A.; Pisa International Airport; Florence Airport; Turin Airport; Municipality of Reggio Emilia; Municipality of Bari; Exprivia S.p.A.; Bank of Italy; SuiteCom S.n.c.; Port Informer Augusta S.r.l.s.; Municipality of Potenza; Lazio Region; Piedmont Region; Municipality of Arzignano; Ministry of Defence. The collective also listed Palermo Airport among its targets; however, the link provided to support the claim redirects to the Turin Airport portal. The hacktivist collective BD Anonymous, allegedly of South Asian/Bengali origin, also joined the DDoS operations, claiming attacks against the following portals: Municipality of Potenza; Municipality of Bari; National Authority UAMA (Ministry of Foreign Affairs and International Cooperation); National Press Portal (Ministry of Foreign Affairs and International Cooperation); and Lazio Region. The actions were allegedly carried out in retaliation for the position attributed to the Italian Government, accused of refusing to recognize Palestine as a state while maintaining diplomatic relations with Israel. The group also stated its intention to challenge reports by Italian and European media that had attributed previous attacks against Ministry of Foreign Affairs and International Cooperation (MAECI) portals to NoName057(16). In addition, the hacktivist group Tunisian Maskers Cyber Force (alias Hider_Nex, Hider Nex), of Tunisian origin and with a pro-Palestinian and anti-Israeli orientation, claimed DDoS attacks against Agenzia Internazionale Stampa Estero (AISE); Centro Linguistico Italiano Dante Alighieri (CLIDA); Castelli International School; and St. Philip School. Furthermore, on 15 October 2026, a hacktivist collective named Team1914_official (alias Team1914) claimed DDoS attacks against the Department of Public Administration (Italia Open Gov) and the Ministry of Foreign Affairs and International Cooperation, while a hacktivist group named CyberTroll Team claimed a DDoS attack against the Roma Capitale portal. Turning to the ransomware landscape, Space Bears claimed on its leak site the compromise of Alma Center Servizi Medicali S.r.l.; Qilin Team claimed Melchioni S.p.A.; DeadLock claimed IDI Integratori Dietetici Italiani S.r.l. (Idipharma); MAJINAHANASHI claimed Tema Energy S.r.l., Albertin Alcide e Figli S.n.c., Hysytech S.r.l., C.D.A. Diagnostica per Immagini S.r.l. and CFG Serramenti S.r.l.; and AuditTeam claimed an unspecified Italian target (Ze***ce), presumably operating in the transport sector. Finally, two fine-themed smishing campaigns were tracked: one exploited the name, logo and graphics of the Automobile Club d’Italia (ACI) to induce recipients to pay a €150 fine for a traffic violation, while the other used a fake Italian State Police domain.

APT: North Korean, Iranian and Chinese operations

Several APT campaigns and related countermeasures highlighted the activities of North Korean, Iranian and Chinese state-sponsored adversaries. On the North Korean front, three distinct lines of activity emerged: in July, Lazarus Group used a trojanized Terraform provider to distribute the FLATROOF (Rust) and ROOFDECK backdoors on Windows, Linux and macOS systems; ScarCruft conducted Operation GitPower against Ukrainian experts in diplomacy, security and post-invasion reconstruction, using PowerShell- and VBE-based malware to collect and exfiltrate system information, with most observed attempts proving unsuccessful; on 13 October, the DOJ and FBI announced Operation Lonestar Roundup against a network of North Korean IT workers who obtained remote jobs using false identities and transferred their earnings to Pyongyang, resulting in two arrests, 14 indictments, the seizure of approximately 187 devices and searches of more than 40 homes in Texas. In the Iranian context, between August and October 2026, an adversary named DarkBlinders, previously associated with the cyberspionage campaign Blinder Tunnel, continued its activities against an Israeli security-sector figure and a government cloud environment in Iraqi Kurdistan, using a second-stage backdoor for the selective execution of PowerShell commands. The activities showed continuity with previous operations (the Peaky Blinders theme and separate GitHub repositories) and overlaps with UNC5795 and Dust Specter, as well as possible links to the OilRig ecosystem. On the Chinese front, between July and August, attackers allegedly linked to Beijing compromised the network of a regional organization based in Suva, Fiji, for several days, as part of broader targeting activity against governments, multilateral organizations and telecommunications networks in the Pacific. On 8 October, the DOJ and FBI seized seven domains used by Flax Typhoon (operating on behalf of Integrity Technology Group) to distribute the Microscan and FishHub tools. This marked the second public disruption of the group’s infrastructure in two years, following the 2024 operation against a Mirai botnet comprising more than 200,000 devices. The action was accompanied by a joint advisory issued by the FBI, CISA, NSA and partners from the United Kingdom, Australia, Canada, Japan, New Zealand and Spain. Finally, the picture is completed by a mid-2026 spear-phishing campaign attributed to UAT-11985, targeting research organizations, international relations institutes and geopolitical analysis entities based in Taiwan, aimed at stealing Google credentials and session tokens through Adversary-in-the-Middle techniques to enable potential account takeovers.

ITW: vulnerabilities affecting Ivanti, Cisco, Palo Alto Networks, Ahsay and Atlassian

Over the past week, several actively exploited vulnerabilities were observed, with particular emphasis on an exploit chain targeting Ivanti Connect Secure and a critical 0-day affecting Cisco Secure Email Gateway, as well as other flaws subsequently added to CISA’s KEV catalog. Since at least 3 October 2026, the adversary UTA0576 has exploited three chained 0-days against Ivanti Connect Secure appliances updated to the latest available version, combining an Authentication Bypass and an RCE in the welcome[.]cgi and wu[.]cgi components (both associated with CVE-2026-104935) with an as-yet-unpatched Privilege Escalation vulnerability in the dsinvoked service. Following the compromise, the attacker conducted internal network reconnaissance, credential theft and data exfiltration from Active Directory, focusing on LAPS passwords, BitLocker recovery keys and other sensitive attributes. In parallel, Cisco patched CVE-2026-76519 (CVSS 9.8), a Relative Path Traversal vulnerability in the Advanced Malware Protection functionality of Secure Email Gateway that allows an unauthenticated remote attacker to send an email containing a malicious attachment, write arbitrary files to the system and execute commands with root privileges on appliances with File Reputation and Content Scanner Tools enabled. The vendor confirmed active exploitation in October 2026 and initiated remediation activities for affected customers. Additional vulnerabilities with evidence of ITW exploitation include: CVE-2026-0322 in PAN-OS (Code Injection in the management interface that allows an authenticated attacker to achieve RCE with root privileges, with limited activity observed); CVE-2026-105133 and CVE-2026-105134 in AhsayCBS, respectively an Improper Authentication vulnerability and an OS Command Injection vulnerability that can be chained to achieve unauthenticated RCE, with exploitation attempts observed since 7 October involving reconnaissance, installation of JSP web shells and deployment of the XMRig miner; and CVE-2026-21589 in Atlassian, an Arbitrary File Access vulnerability affecting several Data Center products that allows unauthenticated access to specific files when their names and paths are known, with exploitation attempts observed within approximately two hours of the publication of a PoC. CISA added these vulnerabilities to its KEV catalog and instructed US Federal Civilian Executive Branch agencies to remediate CVE-2026-104935 by 16 October 2026; CVE-2026-0322, CVE-2026-76519, CVE-2026-105133 and CVE-2026-105134 by 17 October 2026; and CVE-2026-21589 by 18 October 2026.

Weekly Threats Report is Telsy’s weekly update featuring the main developments on cyber attacks and threat actors worldwide, produced by our Threat Intelligence & Response team.

The team is composed of analysts and security researchers with technical and investigative skills and internationally recognized experience.

Through continuous monitoring of cyber threats and geopolitical events, it produces and provides organizations with useful information to anticipate attacks and understand their scope, with the support of a trusted partner in the event of a cyber incident.

Learn more about our Cyber Threat Intelligence solution.