Cyber Incident Victim: Milan Malpensa Airport
Date:
Feb 2025
Location:
Italy
Summary
A pro-Russian hacker group known as Noname057(16) targeted approximately 20 Italian websites, including financial institutions and Milan's Malpensa Airport, in a cyberattack motivated by political tensions between Italy and Russia. The attack followed controversial remarks by Italy's president comparing Russia's actions in Ukraine to Nazi Germany's pre-WWII expansionism, which drew condemnation from Moscow. Italy's cybersecurity agency confirmed the incidents caused no major operational disruptions, though some targeted organizations declined to comment while others reported no service interruptions. This marked the second such attack by the same group within months, following a previous incident targeting Italian institutional websites.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 17, 2025, Italy’s cybersecurity agency reported approximately 20 Italian websites were targeted in a cyberattack attributed to the pro-Russian hacker group Noname057(16). The attacks impacted multiple sectors, including financial institutions such as Intesa Sanpaolo, Banca Monte dei Paschi, and Iccrea Banca, alongside critical transportation infrastructure—specifically the websites of Milan’s Linate and Malpensa airports, managed by SEA. The agency linked the incident to escalating diplomatic tensions following Italian President Sergio Mattarella’s February 2025 comparison of Russia’s war in Ukraine to Nazi Germany’s pre-World War II expansionism, which had drawn condemnation from Moscow. Noname057(16) explicitly cited Mattarella’s remarks as motivation for the attack, mirroring their December cyber campaign against roughly 10 Italian institutional websites. Technical disruptions were limited, with no reports of sustained downtime or operational compromise at the airports or banks.
The Italian cybersecurity agency confirmed the attacks were executed on Monday, February 17, but emphasized no critical services were severely disrupted. SEA, operator of Milan’s airports, and Intesa Sanpaolo declined to comment on the incident, while Iccrea Banca stated its systems experienced no service interruptions. Banca Monte dei Paschi did not provide an immediate response to inquiries. Noname057(16)’s reuse of geopolitical grievances as justification aligned with their prior activities, reinforcing patterns of opportunistic targeting following diplomatic friction. The agency’s public attribution did not detail specific attack vectors or defensive measures taken by victims but characterized the incident as part of a broader strategy by pro-Russian actors to retaliate against perceived criticisms of Moscow’s foreign policy.