Italy targeted by multiple adversaries, APT and cyberspionage campaigns, breaches and AI

Italy: attacks from multiple threat sources detected

The pro-Russian hacktivist collective NoName057(16) has once again targeted Italian portals. According to the group, the country was targeted because it had allegedly agreed on a new military aid package for Ukraine worth approximately €3 billion. Specifically, DDoS attacks were claimed against the following targets: Municipality of Potenza; Lazio Region; Piedmont Region; Municipality of Arzignano; Leonardo S.p.A.; OM Carrelli Elevatori S.p.A.; Municipality of Reggio Emilia; Municipality of Cavallino-Treporti; Metropolitan City of Venice; Alilaguna S.p.A.; SuiteCom S.n.c.; Port Informer Augusta S.r.l.s.; Municipality of Bari. It should be noted that the adversary named OM Carrelli Elevatori S.p.A., which was incorporated into STILL S.p.A. of the German KION Group, but associated it with a URL belonging to the Indian company OM Material Handling. In addition, Dark Storm Team claimed DDoS attacks against OM Carrelli Elevatori S.p.A. and the Municipality of Reggio Emilia. Like NoName057(16), the collective reported a URL referring to the Indian company OM Material Handling. Finally, BD Anonymous carried out DDoS attacks against the portals of the Metropolitan City of Venice, the Municipality of Schiavon, the Bank of Italy, the Department for Maritime Policies and Port Informer Augusta S.r.l.s., overall with the aim of protesting against the interruption of a Muslim prayer in Mestre and the Government’s position on the recognition of the State of Palestine. Turning to the ransomware landscape, EMPERADOR claimed on its leak site the breach of Studio Notarile Associato Salvatore Costantino e Anna Favarato; NightSpire of 360Consulenza S.r.l.; Booba Team of Consorzio di Sviluppo Economico del Friuli (COSEF); Qilin Team of Columbus Informatica S.r.l.; Akira Team of DI.C.S.EL. S.r.l.; LockBit Team of CO.R.I.S. S.r.l.; Rhysida Team of NEAD Pro – Professionisti Riuniti and North East Advisor S.r.l.; and AuditTeam of three unspecified targets. In addition, several phishing and malware distribution campaigns were observed: operations exploiting the identity of ACI, SEND – with an exploit chain linked to the iOS Coruna kit – and SSN, used to distribute StreamRat on Android and XWorm on Windows; banking campaigns aimed at distributing the Android trojan RemControl; and a new MintsLoader distribution activity via compromised certified email (PEC) accounts. ChatMinerva, the multimodal AI assistant developed by the Sapienza NLP group at Sapienza University of Rome in collaboration with Babelscape, also reported unauthorized access to user databases. Regarding the Revolut incident, Italian authorities confirmed the compromise of a certified email (PEC) account belonging to the Prefecture of Reggio Calabria and the involvement of 680 customers, including 8 Italians; the adversary IAmNotAVillain also allegedly opened a DLS, published new samples of the stolen data, launched direct extortion demands against the affected customers and told the press that there were at least 15 Italian victims.

APT: state-sponsored and cyberspionage operations

With regard to North Korea, a joint advisory issued by Japan, the US, Australia and Germany warns about the activities of the adversary WaterPlum, associated with the Contagious Interview campaign, and the schemes used by North Korean IT workers to obtain positions at foreign organizations and generate foreign currency. It should be noted that the advisory makes no reference to Lazarus Group, an adversary previously associated with Contagious Interview by analysts and researchers. In parallel, Lazarus Group itself targeted DevOps and FinTech developers — as well as at least one Indian non-crypto IT provider — using implants previously employed on 18 April 2026 in the LayerZero/KelpDAO compromise, from which 116,500 rsETH (approximately $290 million) were stolen. Between 12 and 16 September, a supply chain campaign based on a cluster of npm packages distributed the WeaselBiscuit infostealer, which shows similarities with BeaverTail and OtterCookie, used in the Contagious Interview campaign. However, attribution to North Korean adversaries currently remains only hypothetical. Turning to China, the UTA0565 cluster used the BlueMoon exploit kit on 3 and 4 September, based on Chrome and Microsoft 0-days, to distribute a backdoor called CLEANGULP. On 24 September, New Zealand’s National Cyber Security Centre (NCSC) identified the People’s Republic of China (PRC) as the most persistent and capable state adversary conducting cyber activities against New Zealand. The observed activities are primarily related to cyber espionage, reconnaissance, exploitation of vulnerabilities and exposed systems, and maintaining persistent access. Moving to the US, the allegedly North American-linked APT APT-Q-95 (NightEagle) conducted espionage activities against companies in Russia, particularly those operating in the manufacturing and construction sectors, through the distribution of GhostContainer. Finally, on 20 September 2026, the Ukrainian Militant group claimed Operation Poseidon. The operation would allegedly involve the theft of a large collection of Russian Navy files, including 70 projects concerning submarines (including nuclear-powered vessels), warships, navigation systems, sonar technology and autonomous underwater vehicles. Should the claim be confirmed, the material could be relevant to technical-military intelligence due to the possible presence of design and testing documentation capable of providing insights into the Russian Navy’s technological capabilities, development activities and modernization programs.

Cybercrime: security incidents and use of AI

A cyberattack targeted the technological infrastructure of the International Meteor Organization (IMO), a Belgium-based non-governmental organization that coordinates meteor observation activities internationally, causing most of its website to become unavailable; however, the attack methods were not disclosed, and it was not clarified whether the incident resulted in access to or theft of data. Chinese hacking-for-hire company Zhengzhou Zhirong Network Technology Co. (ZRON) reportedly developed capabilities to collect and analyze data from foreign IT systems, including through artificial intelligence tools. Internal material linked to the company reportedly includes diplomatic correspondence, government documents and institutional information relating to Russia, Pakistan, the Philippines and the Vatican. At the end of August 2026, foreign adversaries compromised and manipulated OT equipment belonging to two private water utilities in Colorado, each serving fewer than 200 users, without causing any impact on services or water quality. The incidents occurred amid increasing malicious activity against the US Water and Wastewater Systems (WWS) sector, which had previously been targeted by campaigns linked to Iran-aligned adversaries; however, no evidence has emerged that would allow the two incidents in Colorado to be attributed to those actors. On 18 September, ShinyHunters compromised the leak site of TA505 through an unauthenticated upload in Grav CMS, as part of a dispute related to the 2025 campaign against Oracle E-Business Suite and ownership of the exploit used. On 22 September, the same group claimed to have compromised systems linked to the FBI and stolen data relating to applicants as well as current and former employees, alleging that it had exploited a new 0-day in Oracle PeopleSoft in retaliation for an advisory issued by the agency. The FBI only confirmed that it was investigating reports of unauthorized activity involving FBIjobs[.]gov, without confirming the compromise of internal systems or data exfiltration. Also on 22 September, Microsoft, together with Health-ISAC and industry partners, dismantled EvilToken, a PhaaS platform used against Microsoft 365 and for BEC campaigns, associated with the compromise of more than 12,000 mailboxes belonging to 10,000 organizations. On the AI front, Google confirmed that a Gemini model autonomously gained unauthorized access to the systems of three organizations during a cybersecurity capability assessment conducted on Irregular’s infrastructure; in Australia, an OpenAI AI agent instead accessed the public Medicare Statistics Reporting Service portal of Services Australia without authorization while researching pharmaceutical expenditure, an incident that was subsequently reported to the authorities and followed by the portal being taken offline.

Weekly Threats Report is Telsy’s weekly update featuring the main developments on cyber attacks and threat actors worldwide, produced by our Threat Intelligence & Response team.

The team is composed of analysts and security researchers with technical and investigative skills and internationally recognized experience.

Through continuous monitoring of cyber threats and geopolitical events, it produces and provides organizations with useful information to anticipate attacks and understand their scope, with the support of a trusted partner in the event of a cyber incident.

Learn more about our Cyber Threat Intelligence solution.