News • Technology and Security

Russian hackers and domestic unrest: Italy’s hybrid threat exposure

26 October 2026
Decode39
2 Min Read
Italian intelligence is investigating a suspected link between pro-Russian hacker groups and radical networks organizing anti-establishment protests. Investigators found evidence of coordinated efforts between domestic extremist elements and pro-Kremlin actors to maximize disruption during demonstrations. The investigation highlights the need for robust inter-agency coordination to protect public safety and institutional stability
Italian intelligence and cyber-security authorities are investigating a suspected operational link between pro-Russian hacker syndicates and the radical networks orchestrating violent anti-establishment protests across major Italian cities.

The big picture: Italian cyber-intelligence units are investigating evidence suggesting a coordinated convergence between domestic extremist elements and pro-Kremlin threat actors aimed at maximizing disruption during nationwide demonstrations.

  • The cyber-physical convergence: Investigators reveal that pro-Russian hacker groups — including “NoName057(16)” and the “Dark Storm Team” — pledged online support to the “October 17 Movement” (M1710), attempting to synchronize digital DDoS attacks against institutional websites with physical unrest in city streets.
  • High-level threat: Italian law enforcement intervened just as the network prepared to unleash coordinated flashpoints across eight major cities (including Milan, Rome, Turin, and Bologna), utilizing encrypted channels with tens of thousands of followers to bypass police tracking.

The case: Digital operators and subversive networks. At the center of the domestic investigation are sweeping arrests targeting key administrators of the movement’s digital channels — including figures who had previously spread anti-system and anti-Western ideas online.

  • Sophisticated infrastructure: Investigators flagged that the leaderless-style movement possessed advanced operational security, including dedicated legal support, secure chat protocols, and structured digital hierarchies.
  • Radicalization and subversion: Documents and chat logs seized by authorities indicate that these operators and their associates were fostering an eversive project leveraging social media discontent, prompting intense public debate over how online radicalization translates into street violence.
Between the lines: Moscow’s digital proxies. The alignment between domestic agitators and foreign actors underscores a recurring hybrid warfare tactic: leveraging existing social tensions to amplify systemic friction within Western democracies.
  • DDoS tactics: While pro-Russian hacking collectives rely primarily on traffic-flooding DDoS (Distributed Denial of Service) attacks to temporarily paralyze institutional and defense portals rather than deploying destructive ransomware, their synchronized timing with physical protests points to a deliberate strategy of multi-domain disruption.
  • Widening networks: Analysts note that alongside pro-Russian actors, other ideologically aligned or regional hacking crews have expressed solidarity with the protests, signaling a persistent vulnerability in critical national infrastructure, municipal surveillance systems, and law enforcement networks.

Why it matters: Italy is increasingly finding itself on the front line of hybrid threats, where domestic radicalization, digital subversion, and foreign state-sponsored cyber interference blur into a single security challenge.

  • For Rome, neutralizing these convergent vectors requires robust inter-agency coordination between internal policing and military cyber intelligence to protect both public safety and institutional stability.
FacebookXLinkedInWhatsApp

Subscribe to our newsletter