New offensives in Italy, the latest from the APT landscape, international cyber operations

Italy: phishing attacks and ransomware claims

This week, several phishing operations were identified in Italy. An email using the name and logo of the Ministry of Health, pretending to offer a €278.26 refund following an alleged duplicate payment of a healthcare fee, redirects users to a portal that exfiltrates personal information and payment card data. Klarna-themed emails redirect users to fraudulent pages that exfiltrate login credentials, including OTPs. Two malicious domains targeting Free Flow users on the A35 Autostrada Pedemontana Lombarda route exfiltrate vehicle registration plates and payment card details. An email posing as an INPS refund request redirects users to a malicious domain where a multi-stage fraudulent procedure exfiltrates personal and payment card data. The final step leads the unsuspecting victim to grant the attackers strong in-app authentication, required to authorize banking transactions. Finally, emails pretending to come from the Italian Business Register direct potential victims to a fraudulent portal where they are asked to complete a personal data verification process. The information entered – company name, related tax code or VAT number, and banking information, including the bank and IBAN – is stolen and presumably used for further fraud. Several ransomware claims also targeted Italian organizations. Qilin Team claimed on its leak site the compromise of Tecnici Associati S.T.P., Euroflora S.r.l., Studio Boldrin S.r.l., Aurore Development S.p.A. and S.E.M.P. S.r.l.; The Gentlemen claimed Ariel Energia; SAFEPAY claimed La Ge Gè Pesca S.r.l.; and, finally, Dire Wolf claimed Studio Legale ESE. These claims are joined by those made on August 21, 2026 by TITAN against Alto Calore Servizi S.p.A., CONDOR S.p.A., CTP S.r.l. – Company Trafil Production, Elbor S.p.A., POEMA S.r.l., Tedesco & Partners STP S.r.l. and Termotecnica Industriale S.r.l., as well as a claim by xpl0itrs against Gruppo Spaggiari Parma S.p.A.

APT: state-sponsored activity and cyber espionage operations

In July 2026, a cyberattack attributed to adversaries linked to the Iranian regime struck a small-scale power generator located in the United Kingdom. The facility remained offline for four days, but the incident had no impact on the national power grid and caused no supply disruptions to users. The attribution to Iran-linked adversaries was neither confirmed nor denied by UK authorities. The event reportedly occurred during the same period as a series of attacks affecting water infrastructure in twelve U.S. states, attributed to CyberAv3ngers, a group belonging to the Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC). However, there is currently no direct evidence linking CyberAv3ngers to the attack on the UK generator. Remaining in the Iranian context, on August 24, 2026, the U.S. Department of the Treasury launched, at the direction of President Donald Trump, Operation Economic Outcast, a coordinated economic campaign against the Islamic Republic of Iran and entities supporting its activities. The initiative aims to disrupt the financial resources used by the Iranian government and the Islamic Revolutionary Guard Corps (IRGC), targeting networks used for oil trade, sanctions evasion, and the financing of regime activities. One component of the operation concerns cyber activity attributed to Iran’s Ministry of Intelligence and Security (MOIS). The MOIS-related action was coordinated with the FBI and accompanied by a 14-count superseding indictment, unsealed on August 18, 2026, against 17 members of the Mabna Institute, a Tehran-based company that since 2013 allegedly entered into contracts with Iranian government and private entities to conduct cyber campaigns on their behalf. Also concerning Iran, threat hunting and indicator enrichment activities identified additional malicious samples and operational infrastructure associated with Tortoiseshell, a group affiliated with the Islamic Revolutionary Guard Corps (IRGC). The analysis identified two samples, one of which shows similarities to the TWOSTROKE backdoor, both named wtsapi32.dll and configured to export the legitimate functions of the Windows DLL of the same name, as well as infrastructure nodes associated with the group’s activity. Shifting to the pro-Ukrainian sphere, the espionage group GamaCopy (Core Werewolf) conducted a campaign against Russian organizations, particularly defense-industrial complex enterprises and state authorities, aimed at deploying malware named CoreRAT. In relation to cyber espionage activity, according to an internal presentation by the EU cyber defense unit, senior European Union officials were targeted through spear-phishing campaigns sponsored by foreign governments and aimed at account takeover via messaging services. The presentation, delivered to representatives of national governments in July 2026, therefore confirms the direct targeting of high-level personnel within European institutions through messaging applications. The document, which reportedly contains no explicit references to a specific country, forms part of a broader context of official government publications. Finally, an investigation by the University of Toronto’s Citizen Lab documented two distinct telecommunications surveillance campaigns, named STA1 and STA2, associated with commercial platforms supporting government intelligence activities, which exploited the global mobile interconnection ecosystem to conduct covert location tracking. The operations combined techniques based on the SS7 signaling protocol, used in 3G networks, and Diameter, used in 4G and most 5G implementations, with manipulation of operator identities and routing paths. In the case of STA2, an attempt to directly exploit the SIM via SMS was also observed.

Cybercrime: data breaches, DDoS and law enforcement operations

Italian software company TeamSystem S.p.A., which specializes in developing digital and management solutions for businesses and professionals, informed customers of its Contabilità in Cloud software of a personal data breach involving personal details, contact information, IBANs, and accounting transaction data, including descriptions, amounts, and counterparties. According to the company, a “sophisticated cybersecurity incident” was detected starting on the afternoon of August 24, 2026. Service login credentials are reportedly excluded from the breach. On August 22, 2026, cybersecurity company ReliaQuest was targeted in a social engineering attack later claimed by ShinyHunters. The adversary registered a domain nearly identical to that of the company and prepared a fake Single Sign-On (SSO) page hidden behind a content delivery network. The attacker then called several employees, each time impersonating a named member of the security team, in order to direct them to the page. French telco SFR confirmed that it had suffered a security incident that resulted in unauthorized access to customers’ personal data, but not passwords or banking details. The incident was detected on July 2 and affected a tool used to manage and analyze fiber connections. The claim was posted on an underground forum in mid-July by ZeroBytes, which says it extracted more than 2 million records before being detected. Boston Scientific, a U.S. company specializing in the development and manufacture of medical devices, reported that it identified a cybersecurity incident on August 25, 2026 affecting certain IT systems, causing a network outage with repercussions on business operations worldwide and particularly affecting its ability to process and ship customer orders. The origin, scope, and overall operational and financial consequences of the incident are still being assessed. On July 31, 2026, Micro-Comm, a U.S. company based in Kansas that manufactures control systems for water and wastewater treatment facilities, detected a compromise of its systems. The attack was claimed by a ransomware group called Barracuda, which says it stole 850,000 files. The incident occurred during the same period as a series of attacks against systems used in the U.S. water sector; however, Micro-Comm stated that its compromise was unrelated to those activities. On August 24, 2026, the Digitaliseringsdirektoratet (Digdir), the Norwegian agency responsible for several public digital services, was hit by a DDoS attack targeting the infrastructure supporting services managed by the agency and its operational partner Vivicta. The attack was reportedly claimed by the pro-Russian group Server Killers, which said in a Telegram post that it had declared cyber war on Norway after the country renewed its security cooperation with Ukraine. Between November 2025 and June 2026, Interpol coordinated Operation Jackal IV, an operation conducted by law enforcement agencies from 22 countries across six continents, including Italy, against West African organized crime groups. The criminal networks targeted also included Black Axe.

Weekly Threats Report is Telsy’s weekly update featuring the main developments on cyber attacks and threat actors worldwide, produced by our Threat Intelligence & Response team.

The team is composed of analysts and security researchers with technical and investigative skills and internationally recognized experience.

Through continuous monitoring of cyber threats and geopolitical events, it produces and provides organizations with useful information to anticipate attacks and understand their scope, with the support of a trusted partner in the event of a cyber incident.

Learn more about our Cyber Threat Intelligence solution.