Cyberattack alerts, monitoring, detection and prevention activities
The agency constantly carries out activities of alert, monitoring, detection and prevention of cyber attacks as in the case of the massive global cyberattack of 5 February 2023. [3] During the cyberattack, a large part of the TIM network was out of order due to a problem with data flows from the international network which also had an impact in Italy. [4] The attack exploited a vulnerability on VMware ESXi servers. [5] The damage to the Italian national network has amounted to millions of euros, and thousands of servers affected. [6] However, the following day, the agency reduced the scope of the attack, reporting that no critical systems were affected. On 22 February 2023, the agency issued a new alert against an attack perpetrated by Russian activists. The cyberattack is claimed by the pro-Russian group NoName057(16). [7] [8]
On 7 March 2023, the director of the agency, Roberto Baldoni resigned for differences with the Italian government, following the cyber-attacks suffered by Italy. [9] The pro-Russian group NoName057(16) comments on the resignation of Roberto Baldoni on its Telegram channel, claiming the attacks against the Italian internet infrastructure as a complete success. [10]
On 9 March 2023, the prefect of Rome, Bruno Frattasi, was appointed new director of the agency in place of the resigned Roberto Baldoni. [11]
On 19 March 2023, the pro-Russian group NoName057(16) attacked again the Italian institutional websites, in particular that of the CSM. In claiming the cyberattack, they directly addressed the director of the agency, Bruno Frattasi and Francesco Lo Voi, the chief prosecutor of Rome. [12]
On 27 March 2023, there was a new cyberattack against the websites of the Italian ministers and the postal police, however it did not achieve the objective of hindering users from using the sites under attack. The attack was considered failed, only that of Atac, the municipal transport company of Rome, suffered slowdowns and temporary unavailability. [13]
On May 13, 2023, during the visit to Rome in Italy of Volodymyr Zelensky, president of Ukraine, to the Italian president, Sergio Mattarella and the Italian premier Giorgia Meloni and to the Pope, the pro-Russian group Noname057(16) claims a new cyberattack on the website of the Viminale and on the Csm. However, the damage was mitigated and no malfunctions or slowdowns of the affected websites occurred. [14] [15]
On 19 June 2023, the agency sent the 2022 annual report to the Italian parliament which showed that 1,094 cyber attacks took place in 2022, a marked increase due to the conflict in Ukraine. [16] [17]
On 17 February 2025, the pro-Russian activist hacker group Noname057(16) returns to claim attacks against websites of Italian transport companies and banks as previously done, following the statements of the President of the Italian Republic, mainly DDoS (Distributed denial of service) attacks. Among the targets of the attack are the airports of Linate and Malpensa, the Transport Authority and the ports of Taranto and Trieste. [18] [19] An attack that finds no basis in the speech of the President of the Italian Republic, which Russian media reported as words of almost blasphemous outrage, the result of a bad translation and misinterpretation. The passage of the speech is this: "But, instead of cooperation, the criterion of domination prevailed. And they were wars of conquest. This was the project of the Third Reich in Europe. Today's Russian aggression against Ukraine is of this nature." Which means that the Russian aggression against Ukraine is motivated by a criterion of domination. Therefore the claims of this attack are completely refuted. [20] [21] [22]
The following day, the pro-Russian NoName057(16) return to attack the website of the Ministry for Business and Made in Italy and that of the Guardia di Finanza. While the President of the Italian Republic, during his visit to Montenegro, issues an invitation to Russia to respect international law. [23]
In the following days the attacks continued, the websites of the port of Genoa, Savona, Ravenna and Civitavecchia were hit, then those of Leonardo, Banca d'Italia, Transport Authority, Edison, Fininvest, Parmalat. [24] [25] [26]
