Hybrid warfare is becoming an increasingly tangible challenge for Italy. A series of bomb hoaxes has forced airport authorities and security agencies to mobilise resources, while supermarkets in several Italian regions have been caught up in cyber sabotage targeting refrigeration systems.
Meanwhile, Foreign Minister Antonio Tajani has been targeted by pro-Russian hackers who published personal information about him and his family on the dark web. The incidents differ in their methods, but together illustrate the range of vulnerabilities that can be exploited to exert pressure on a country.
Why it matters: The threat extends beyond the possibility of cyberattacks disrupting essential services. It can compromise the security of public officials, impose recurring costs on state institutions and potentially influence the environment in which political decisions are made.
- This form of coercion operates below the threshold of conventional military conflict, where identifying those responsible and calibrating an appropriate response is particularly difficult.
What happened: On November 7, Defence Minister Guido Crosetto described in an interview with Marco Galluzzo of Corriere della Sera a security environment in which hybrid attacks have become part of everyday life for European democracies. Calling hybrid warfare “the virus of our times”, Crosetto argued that Western countries have largely focused on protection and reaction rather than developing the capacity to disrupt the sustained operations of hostile actors.
- Around the same time, the Tajani case emerged. NoName057(16), a hacking collective known for its pro-Russian cyber campaigns, published personal information concerning Italy’s foreign minister and offered financial rewards for additional details about him and his family.
- Other targets included Rome prosecutor Francesco Lo Voi, Postal Police director Ivano Gabrielli and Paolo Tassan-Zanin, the mayor of Aviano.
- Tajani attributed his targeting to Italy’s support for Ukraine. He also announced that he had requested the inclusion of hybrid threats on the agenda of the G7 foreign ministers’ meeting in Paris on November 9–10.
The big picture: The common feature is the asymmetry between the cost of an attack and the cost of defending against it. A bomb hoax, such as those recently reported on flights in several European cities, including in Italy, can trigger security procedures, require specialised personnel, prompt investigations and disrupt air traffic, even when no explosive device exists. Repeated incidents place cumulative pressure on available resources.
- This is the saturation mechanism Crosetto highlighted in his interview: a high volume of threats, even individually limited in scope, can overwhelm defensive capabilities. The analogy is with drone swarms designed to exhaust air defence systems, except that the same logic is applied to civilian infrastructure and public security.
- In Tajani’s case, the pressure follows a different pattern. Publishing personal information not only violates privacy but also creates potential risks to individual and family security. It forces authorities to assess protective measures and conduct investigations, shifting part of the operational burden onto the targeted institutions and individuals.
- Crucially, the convergence of different threats can itself become a source of saturation. Even when the incidents are technically unrelated, their cumulative impact can stretch security resources across multiple domains simultaneously.
Between the lines: The selection of targets also sends a political message. A foreign minister represents the government’s international policy. A prosecutor and a senior cybercrime police official embody the state’s ability to investigate and prosecute unlawful activities. The mayor of Aviano administers a municipality hosting one of the most important US military installations in Italy.
- The combination suggests a mix of political, investigative and symbolic objectives. It does not establish that all hybrid operations observed across Europe are centrally coordinated, but it helps explain how personal intimidation can become part of a broader repertoire of pressure tactics, potentially amplifying their effects.
- The exposure of personal data does not need to lead to physical violence to produce consequences. It can increase the perceived vulnerability of those targeted, extend the pressure to their families and force institutions to adjust security procedures. The intended effect may simply be to make the exercise of public responsibilities more costly and complicated.
The Russia connection: NoName057(16)’s pro-Russian orientation and its reported links to elements of Moscow’s military intelligence place the case within a recognizable geopolitical context. European support for Ukraine has long been a source of confrontation with Russia, including in cyberspace.
- But political attribution and operational attribution are not the same. Activities claimed or conducted by pro-Russian groups cannot automatically be treated as individual operations ordered by the Kremlin. Nor is there sufficient public evidence to conclude that all recent disruptions affecting civilian infrastructure belong to a single coordinated campaign.
- This uncertainty is itself part of the strategic challenge. Below-threshold operations exploit the difficulty of rapidly identifying perpetrators, distinguishing cybercrime and ideologically motivated hacktivism from state-backed activity, and determining proportionate responses.
Italy’s response: Crosetto argues that defensive measures alone are no longer sufficient. In his interview with Corriere della Sera, the defence minister called for stronger capabilities to counter attacks and prevent hostile actors from repeating them without consequences. His position raises broader questions about cyber deterrence and the circumstances under which governments might act against the infrastructure and networks used to conduct hostile operations.
- Italy already has an institutional cybersecurity architecture that includes the National Cybersecurity Agency (ACN), the investigative capabilities of the Postal Police and the intelligence services. In January 2026, the Foreign Ministry also established a dedicated Cyber Directorate to strengthen its cybersecurity capabilities.
- The challenge lies in coordinating these capabilities with diplomatic, judicial and national security instruments, particularly when attacks affect several European countries at once.
- The debate also has a domestic political dimension. Opposition figures have called on the government to clarify what concrete measures have been taken to prevent further incidents and ensure the continuity of essential services. Their demands highlight the potential gap between publicly acknowledging the threat and demonstrating the effectiveness of countermeasures.
What to watch:The next step is moving from resilience towards deterrence. Protecting networks, infrastructure and individuals can limit damage, but it does not necessarily reduce the frequency of hostile operations. Discouraging further attacks requires investigative capabilities, credible attribution, international cooperation and measures that raise the costs for those responsible.
- The discussion requested by Tajani at the G7 will provide an initial diplomatic test. At the European level, the priorities include intelligence and information sharing, critical infrastructure protection and coordinated responses to cross-border campaigns.
- For Italy, the challenge is more immediate: keeping institutions functioning and protecting the people who work within them, without allowing a succession of relatively inexpensive threats to impose increasingly heavy costs on the public sector.
The bottom line: Hybrid warfare does not need to cause prolonged service disruptions or force a change in foreign policy to have an impact. It can gradually erode a state’s ability to function by compelling it to mobilise resources and continually introduce new protective measures.
- Recent incidents have exposed Italy to precisely this vulnerability: preserving its freedom of political decision-making while the cost of exercising that freedom continues to rise.
