Cyber Vulnerabilities Besiege Italy, Absent Clear Cause
Researchers can’t quite explain why cyber threats look so different in Italy compared to everywhere else.
Researchers can’t quite explain why cyber threats look so different in Italy compared to everywhere else.
Italy is suffering from a disproportionately large number of cyberattacks, new data suggests. Not only that: the kinds of attacks hitting organizations in the country are vastly different from those hitting other places. Researchers have a triad of theories as to why.
It goes without saying that certain regions and countries face greater cyber-risk thanks to economic, military, and political factors. Israel is a magnet for hacktivists and regional, state-aligned advanced persistent threats (APTs). Brazil’s unique history makes it a hive of banking Trojans. The United States economy will always draw the most attention from scammers. It isn’t so obvious, though, why Italy is such a popular mark for cybercriminals.
“One of the main reasons why we decided to look into the Italian threat landscape is because Italy kept appearing at the top of our stats in our monthly internal reports,” says Gianluca Tiepolo, cybercrime analyst at Intel471. In a report shared exclusively with Dark Reading ahead of its release, Intel471 found that Italy is a total outlier in the global cyber threat landscape. Organizations there are being compromised at a rate beyond what one would reasonably expect, based on the country’s size, economy, and politics. And exploits against vulnerabilities and Web infrastructure are far more common in Italy than elsewhere.
“We wanted to understand what was driving those stats,” Tiepolo says. In the end, though, the data paints a nearly inexplicable picture of what’s going on in the land of pasta and Chianti.
Inexplicable Data From Italy’s Threat Landscape
Italy is the 25th largest country in the world but, according to this new data, its organizations make up about 7% of all initial access data sold on cybercriminal forums. That’s second only to the United States (30%) globally. Italy also ranks fourth among countries most targeted by ransomware.
Far stranger still are the types of cyber intrusions affecting organizations in Italy. According to the new data, initial access brokers (IABs) obtained their initial foothold through vulnerabilities in 57% of cases. Credentials only explained 23% of cases. Meanwhile, IABs have been selling access to victim-owned Web infrastructure in 49% of cases, with remote access and remote desktop tools making up 26% of cases.
So what? Maybe those figures don’t pop off the page. Now, though, let’s compare them with Intel471’s own data from its 2026 Cyber Threat Trends & Outlook report:
Globally in 2025, IABs targeted remote access and remote desktop tools 67% of the time — 41% more often, relatively, than in Italy. Meanwhile, Web infrastructure — by far the most at-risk asset in Italy — represented such a small fraction of Intel471’s global data that it didn’t even bother to cite it in their report.
In the same vein, according to the company’s global data, credential-based attacks are eight times more common in general than any other type of attack today. It found that 49% of IAB listings advertised credentials as the attack type, compared to 23% in the Italian-specific data. And guffaw-ingly, whereas in Italy they represent around 57% of all attacks, exploited vulnerabilities showed up in only 6.5% of cases globally.
Theory #1: Poor Cybersecurity Hygiene
Though cybersecurity data reporting can be interpreted in different ways depending on the circumstance, Italy does seem like a kind of cyber-risk unicorn, Tiepolo says, adding that Italy has been falling behind on cyber readiness for a long time now.
“I’m Italian,” he says. “I’ve been working with a lot of different Italian clients. What I can say is that Italy is probably slightly behind other European countries, simply based on security technology [adoption]. For example, endpoint detection and response (EDR) technologies became popular in Italy around 2020, 2021. Before 2020, most Italian companies didn’t use EDR technology. So maybe historically, Italy is a bit behind in actually investing in cybersecurity products and technologies.”
Also, opportunistic cybercriminals are exploiting known, widespread, and often quite old vulnerabilities en masse to scoop up more victims in Italy than in other countries. “The data we saw last week from PHP2Shell, I think, validates this assessment. Italy is the country in Europe with the largest number of PHP 4, 5, and 7 versions, which are end-of-life,” Tiepolo notes.
“A full 90% of initial access offers for Italy are what we call ‘wholesale’ offers,” he posits. “They’re not offers that are targeting Italy specifically, but simply exploiting vulnerabilities. Our assessment is that Italy is probably slower than other countries in patching their systems.”
Theory #2: A Cyber Risk Network Effect
Another, related possibility is that Italy finds itself victim to a kind of cyber vulnerability network effect. The logic goes something like this: If certain technologies are especially common in a country like Italy, and organizations are slow to address vulnerabilities in those technologies, then that country becomes an attractive economy of scale.
As Intel471 wrote in its report, “Once an actor develops an effective exploitation method, the actor can apply that method to additional exposed systems without conducting a separate, extensive reconnaissance effort against each organization. This reduces the effort required to compromise businesses whose size or profile might otherwise offer limited incentive for a dedicated intrusion.”
Researchers couldn’t say exactly which technologies, vulnerabilities, or exploitations this theory might refer to, but noted that it does fold into the finding that 90% of initial access offerings to Italian organizations online are sold in bulk.
Without co-signing Intel471’s data or conclusions specifically, representatives from the Milan-based cybersecurity firm Cleafy tell Dark Reading that they’ve observed broadly similar patterns.
“Our threat research does point to a related pattern: attackers reusing tools, infrastructure and techniques to scale campaigns across Italian banking targets,” the company wrote via email. It pointed to cases such as the drIBAN Web injection kit, which attackers used to exploit the Certified Electronic Mail (PEC) system used widely across Italy. Cases like drIBAN “don’t establish that Italy has a disproportionately large initial-access market, but they do illustrate how reusable attack techniques and infrastructure can help cybercriminals scale operations across multiple targets.”
Theory #3: Small & Medium-Sized Businesses Shift the Data
There is one other, potentially significant contributing factor to why Italy looks so different from other countries in cyberattack datasets: its prevalence of small businesses.
Most businesses everywhere are small, but, at least in comparison to other advanced economies, it’s especially the case in Italy. A May 2024 “data snapshot for Italy” by McKinsey found that “MSMEs” — micro-, small-, and medium-sized enterprises — contributed roughly 10% more to Italy’s economy and employment compared to their relative share in other advanced economies. And last March, the Organisation for Economic Co-operation and Development’s (OECD) published a report which cited that 99.9% of Italian firms in 2023 were SMEs, and 94.8% were micro-enterprises.
“Italy has a lot of small- and medium-sized companies,” Tiepolo says. “One of the things that came out from the data — especially the extortion data — is that these groups are [disproportionately] targeting small- and medium-sized businesses. So this could be one of the reasons [Italy stands out] in comparison to other countries that have more large companies.”
Read more about:
