Milan Malpensa Airport

Summary

A pro-Russian hacker group known as Noname057(16) launched cyberattacks against roughly 20 Italian websites, including those belonging to banks and Milan's Linate and Malpensa airports. Italy's cybersecurity agency confirmed the attacks were motivated by recent inflammatory remarks made by Italian President Sergio Mattarella regarding the conflict in Ukraine, which had drawn strong condemnation from Moscow. The affected financial institutions included Intesa Sanpaolo, Banca Monte dei Paschi, and Iccrea Banca. Despite targeting high-profile organizations, the cyberattacks resulted in no major disruption to services. The airport operator SEA declined to comment, and Iccrea Banca confirmed its operations remained unaffected, while the other institutions did not immediately respond to requests for comment.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On February 17, 2025, Italy's national cybersecurity agency disclosed that approximately twenty Italian websites, including those belonging to banks and airports, had been targeted by a pro-Russian hacker group identified as Noname057(16). The attacks were carried out earlier that day and were characterized as retaliatory in nature, motivated by recent geopolitical tensions between Rome and Moscow. The cybersecurity agency linked the campaign directly to controversial public remarks made by Italian President Sergio Mattarella earlier in the month, during which he compared Russia's ongoing war on Ukraine to the territorial expansionism of Nazi Germany in the years preceding World War II. Those comments provoked strong condemnation from Moscow and triggered a diplomatic dispute with Italy, even as Italian Prime Minister Giorgia Meloni publicly defended the president's statements. The hacker group itself cited Mattarella's remarks as the explicit justification for launching the distributed denial-of-service-style operations against Italian digital infrastructure. This incident represented the second wave of cyber activity attributed to Noname057(16) against the country in roughly two months, following a similar campaign in December 2024 that had targeted approximately ten Italian institutional websites.

The scope of the February 17 attacks encompassed multiple high-profile targets across the Italian financial and transportation sectors. Among the banking institutions affected were Intesa Sanpaolo, Banca Monte dei Paschi di Siena, and Iccrea Banca. In the transportation domain, Milan's two principal airports, Linate and Malpensa, both operated by the airport management company SEA, were included in the list of targeted entities. Despite the breadth of the operation, the Italian cybersecurity agency reported that the attacks did not cause major disruption to the affected organizations. Intesa Sanpaolo and SEA declined to provide comments on the incident when approached by journalists, while a spokesman for Iccrea Banca stated that the bank experienced no operational disruptions. Banca Monte dei Paschi did not immediately respond to requests for comment at the time of the report. The pattern of the intrusions, affecting both private sector financial institutions and critical infrastructure operators within a single coordinated window, reflected the broad symbolic targeting strategy favored by hacktivist groups rather than a focused effort to extract data or cause sustained operational harm.

Sources

Sources available to members: 1 source.