Euro-economies under attack: Italy third for cyber blackmail

Then there is the political leverage: 'Some collectives have expressed positions and threatened politically motivated activities. Wizard Spider, for example, supported the Russian invasion of Ukraine in 2022'. On the even more hostile perimeter, state actors also move. CrowdStrike intelligence has identified actions by Unit 29155, a clandestine cell of the Russian services trained in hybrid warfare.

This is where another piece of the puzzle comes in: the recruitment on Telegram channels of 'disposable' agents. We are talking about operational manpower employed for low-profile hostile actions, designed to wear out quickly and leave few traces. In this scheme, the utility of the 'disposable' is not a detail but the lintel of plausible deniability. Operations conducted by expendable figures allow the Russian services to shield paternity.

Around this nucleus also moves a constellation of other groups that can be traced back to North Korea, Iran, China, Kazakhstan, India and now Turkey. Different vectors, same trajectory: multiply the attacks, fragment the attributions.

And where is the weak point in Italy? Apart from the strategic companies, which have to comply with Nis 2 rules, there are the SMEs. "They are far behind," warns Livrieri. The crux of 'modern' attacks, in fact, is that the signals are 'difficult to intercept, we need solutions capable of reading multi-domain or cross-domain patterns: minimal anomalies that, put together, reveal an attack in progress'.

Emerging vectors, Livrieri continues, 'include false Captcha: interfaces designed to distinguish humans and bots that, in practice, can trigger the downloading of malicious files'.

Not only that. There is also vishing, which will most likely become a significant threat in the near future in Italy as well. It is, adds Livrieri, 'a social engineering technique in which an adversary calls the victim pretending to be someone else in order to convince them to provide credentials or perform a specific action'.

The answer, for those with lean workforces, is pragmatically industrial: 'For small and medium-sized companies,' Livrieri concludes, 'it is more convenient to outsource the services of cybersecurity. It is a difficult vertical competence to have'. Not least because criminals choose surgical timeframes that are ill-suited to small and medium-sized businesses: 'Usually the attacks come at night, at the end of the week or before a bridge', to maximise the damage. The consequence is a non-negotiable requirement: protection systems that work 24x7, 365 days a year.

At the end of the day, a real choice remains, especially for those who run the country with ten, fifty, a hundred employees: either one continues to hope for luck - virtual doors half-closed, shifts uncovered, outdated antivirus - or one accepts that risk is an industrial cost like energy or logistics.