The latest from Italy, international cybercrime operations, updates from Tehran and Beijing

Italy: Revolut data breach, ransomware claims and phishing

In September 2026, Revolut confirmed that it had disclosed sensitive information belonging to a limited number of customers in response to fraudulent requests that appeared to originate from an Italian government authority. The communications were reportedly not simply forged, but were sent using an institutional e-mail account linked to the Prefecture of Reggio Calabria, a circumstance that may have contributed to making them appear authentic. According to information that subsequently emerged, the fraudulent requests reportedly continued for several months and resulted in the disclosure of data belonging to approximately 680 customers, mainly residing in Switzerland and France, including personal and contact information, identity documents, selfies used for identity verification, IBANs, bank statements and transaction histories, including Bitcoin transactions. Revolut maintains that its internal systems and customer funds were not compromised. The Italian Postal Police and the Reggio Calabria Public Prosecutor’s Office have launched investigations into the case, with the involvement of the National Anti-Mafia and Counter-Terrorism Directorate, although it remains unclear whether the institutional certified email (PEC) account was actually compromised, cloned or used through other means, and whether systems belonging to the Prefecture or the Ministry of the Interior were breached. In parallel, a group identifying itself as IAmNotAVillain (iamnotavillain) claimed responsibility for the operation, alleging that it had also obtained more than 87,000 files, amounting to approximately 147 GB of data linked to Italian law enforcement agencies, and publicly demanded a USD 3 million ransom in Monero from Revolut, threatening to sell the information. Revolut, however, stated that it had not directly received any ransom demand, while the actual involvement of the actors claiming responsibility for the attack, the true extent of the stolen data and the technical methods used to access the institutional account remain under investigation. Staying in Italy, several victims of ransomware attacks were reported. LockBit Team claimed on its leak site the compromise of the Municipality of Robecco sul Naviglio (MI); The Gentlemen claimed ACA S.p.A. and Agenzia Vittoria Assicurazioni LODI STAZIONE; Qilin Team claimed Bravo Tankers S.p.A.; EMPERADOR claimed RDA Motors S.p.A.; and, finally, VEXY claimed STP Fashion Lab. Regarding phishing activity targeting Italy, campaigns with the following characteristics were observed: emails and SMS messages themed around IRPEF tax refunds abuse the branding and logos of the Italian Revenue Agency and the Revenue Agency-Collection service to steal tax identification numbers and banking data; emails abusing the identity of the Italian Revenue Agency and the Revenue Agency-Collection service impersonate the delivery of an alleged “Holiday Bonus” to redirect victims to a portal that exfiltrates photographs of identity cards and health insurance cards, payslips from the previous three months, a selfie, phone number and email address; an email with the subject “Keep your Electronic Health Record active” warns users that they need to update their personal information to avoid an alleged imminent suspension of the FSE app and redirects them to a malicious page designed to steal the victim’s personal details.

Cybercrime: data breaches, DDoS, judicial and law enforcement operations

TELUS, one of Canada’s leading telecommunications operators, notified some customers of a security incident involving unauthorized access to their consumer accounts and the information contained within them. According to the notification sent by the company to affected individuals, unauthorized actors used compromised credentials to access accounts over a period spanning from February 2025 to June 2026. The incident is believed to be separate from the data breach that affected subsidiary TELUS Digital in March 2026, claimed by ShinyHunters, as the publicly available information does not document any links between the two events. Japan’s Digital Agency confirmed unauthorized access to the Government Solution Service (GSS), which is used by government administrations and related organizations. A third party exploited, before it was patched, a previously known vulnerability affecting a VPN device and gained access to files containing personal data belonging to approximately 246,000 individuals, which may have been exfiltrated. No sufficient public evidence is currently available to attribute the operation. Digital Minister Hisashi Matsumoto stated that the agency was aware of the vulnerability, but that exploitation occurred before the patch was applied. On 15 September 2026, MEO, a Portuguese telecommunications operator, confirmed that the incidents recorded between 14 and 15 September on its international network infrastructure were caused by a Distributed Denial of Service (DDoS) attack. According to the operator, the activity specifically targeted MEO infrastructure and involved high volumes of traffic, resulting in a temporary degradation of its international network. The impact caused some customers to experience difficulties accessing websites and services dependent on international traffic. On 15 September 2026, the Norwegian Police Security Service (PST) and the National Criminal Investigation Service (Kripos) launched two separate investigations into Telenor ASA, a Norwegian telecommunications and technology group, both concerning the company’s previous activities in Myanmar. The two authorities are investigating different alleged conduct by Telenor within their respective proceedings: the Kripos investigation concerns alleged complicity in crimes against humanity during the period between the military coup of 1 February 2021 and the sale of subsidiary Telenor Myanmar Ltd. (TML), completed on 25 March 2022; the PST investigation, meanwhile, concerns an alleged violation of sanctions regulations. On 15 September 2026, the US Department of Justice (DOJ) announced the seizure of internet domains associated with NightmareStresser, one of the world’s longest-running Distributed Denial of Service (DDoS)-for-hire services. The service, belonging to the category of so-called “booters” or “stressers”, allowed paying customers to launch DDoS attacks against targets in the United States and around the world. The action, carried out by the FBI Anchorage Field Office in coordination with the Federal Policing Northwest Region of the Royal Canadian Mounted Police (RCMP), was conducted as part of Operation PowerOFF.

APT: the latest from Tehran and Beijing

On 15 September 2026, the UK National Cyber Security Centre (NCSC), the US FBI and the Netherlands’ Algemene Inlichtingen- en Veiligheidsdienst (AIVD) published a joint advisory concerning CHOSEN BRICK, a malware family used since at least 2025 in operations targeting dissidents, activists and journalists considered a threat by the Iranian regime. The activity has been observed in several countries, including the United Kingdom, the United States and the Netherlands, and has been attributed by the authorities to Iranian state-sponsored actors. The attack chain begins with highly personalized social engineering activity conducted through applications such as WhatsApp and Telegram. In a separate analysis, an update to a March 2026 FLASH advisory, the FBI also identifies the malware as HEAVYGRAM. Some researchers attribute the threat with moderate confidence to the Handala (Handala Hack) adversary, a link that had already been assessed as likely in relation to at least one compromise documented in the aforementioned FBI FLASH alert. Turning to China, the state-sponsored GhostEmperor (FamousSparrow) group has primarily targeted government organizations in Latin America as part of a cyberespionage campaign involving the use of a new backdoor named SparroWocky. An increase in activity in the region has been observed since at least July 2025, while SparroWocky first appeared in August 2025. From mid-2025 through 2026, approximately 90% of the targets recorded in the analyzed telemetry were located in the region. The backdoor was observed targeting government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela, and appears to have progressively replaced SparrowDoor as the group’s main backdoor. The attribution is based on the use of SparrowDoor in some of the earliest attacks to deploy SparroWocky, consistency in victimology, and attempts to target organizations that had previously been attacked. Initial access to compromised networks was obtained by exploiting publicly accessible Microsoft Exchange servers.

Weekly Threats Report is Telsy’s weekly update featuring the main developments on cyber attacks and threat actors worldwide, produced by our Threat Intelligence & Response team.

The team is composed of analysts and security researchers with technical and investigative skills and internationally recognized experience.

Through continuous monitoring of cyber threats and geopolitical events, it produces and provides organizations with useful information to anticipate attacks and understand their scope, with the support of a trusted partner in the event of a cyber incident.

Learn more about our Cyber Threat Intelligence solution.