Cyber Incident Victim: Banca Monte dei Paschi di Siena
Date:
Feb 2025
Location:
Italy
Summary
Pro-Russian hackers from the group Noname057(16) launched a cyberattack targeting the websites of several Italian financial institutions and airports, including Banca Monte dei Paschi. The assault, which did not cause major disruption, was motivated by recent remarks from the Italian president comparing Russia's war on Ukraine to Nazi expansionism. The bank's website was among roughly twenty sites hit in the operation, which also affected other banks such as Intesa Sanpaolo and Iccrea Banca, as well as Milan's Linate and Malpensa airports. This follows a prior attack by the same group that targeted about ten institutional websites. Italian cybersecurity authorities confirmed the attack and linked it to the political tensions between Rome and Moscow.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In mid-February 2025, following remarks by Italian President Sergio Mattarella comparing Russia's war on Ukraine to Nazi Germany's expansionism, the pro-Russian hacker group Noname057(16) launched cyberattacks against approximately twenty Italian websites. The targets included major financial institutions such as Banca Monte dei Paschi di Siena, Intesa Sanpaolo, and Iccrea Banca, as well as critical infrastructure like Milan's Linate and Malpensa airports. Italy's cybersecurity agency attributed the attacks directly to the group, citing their stated motivation as retaliation for Mattarella's comments, which had outraged Moscow but were defended by Prime Minister Giorgia Meloni. The agency identified Noname057(16) as the perpetrator, linking the incident to heightened tensions between Rome and Moscow. This action represented a continuation of the group's campaign against Italian digital assets, as they had previously targeted institutional sites in December 2024.
The attacks occurred on Monday, February 17, 2025, and while they disrupted the targeted websites temporarily, the cybersecurity agency reported no major operational consequences or sustained damage. Banca Monte dei Paschi di Siena did not immediately respond to a request for comment regarding the incident. Intesa Sanpaolo and SEA, the company managing Milan's airports, both declined to comment on the attacks. A spokesperson for Iccrea Banca stated the bank experienced no disruptions from the incident. The Italian cybersecurity agency confirmed the attacks were carried out by Noname057(16) and emphasized that the primary impact was a temporary denial of service to the public-facing websites of the listed entities. The agency's assessment indicated the attacks were symbolic, aligning with the group's pattern of using disruptive but non-destructive methods for political messaging.