MediumII Cyber Warfare & Critical Infrastructure8 October 2026, Thursday
Pro-Russian group hits Italy's foreign ministry website with DDoS attack
Italy's foreign ministry said on the morning of 8 October that its website was under attack and that its protection systems had repelled it without disruption. Italian news agencies attributed the attack to NoName057(16), a pro-Russian group active since 2022.
Euronews reported on 8 October that initial findings point to a DDoS attack, which aims to make a site unreachable by flooding it with bogus requests. Since 8 October the ministry has been monitoring the situation with the National Strategic Centre and the relevant agencies, and checking whether embassy and consulate sites abroad faced similar attempts. L'Espresso reported on 9 October that the site stayed reachable throughout the day, and no evidence of data access has been published.
According to Security Affairs, the target list shared on the group's crowdsourced DDosia attack network contains 26 domains. It covers services of the foreign, interior and defence ministries, Prime Minister Meloni's website, and five embassies and one consulate general: Brussels, Bucharest, Copenhagen, Dublin, Helsinki and Toronto. L'Espresso says Europol and Eurojust's Operation Eastwood in July 2025 took down more than 100 of the group's computer systems. Open sources do not document the group taking instructions from the Russian government.
The technical impact of the 8 October attack was limited; the political response was broader. Foreign Minister Tajani said Italy, together with Romania and other members of the 27-member EU, will propose naming those responsible for cyberattacks at upcoming European meetings. No new sanctions were announced over this incident. Security Affairs notes that the same group targeted the websites of Milan's Linate and Malpensa airports in December 2024.
Talay assessment
Bottom line
This was an attempt to deny access, not to steal data, and the ministry says it caused no disruption. What matters is the timing and the 26 domains on the target list: 15 months after Operation Eastwood, the group is again going after government sites. The Italian and Romanian push to name those responsible could lower the EU's threshold for political attribution of cyberattacks.
Likely effects
- EU cyber diplomacyUncertain1–6 months
If the Italian and Romanian proposal to name perpetrators gains traction at EU meetings, debate on joint attribution and possible sanctions against pro-Russian groups will accelerate.
- Public digital servicesNegativeWeeks
Ministry and embassy sites on the target list face the risk of outages in new waves; the ministry says its protection systems absorbed the 8 October attack.
- Turkish public websitesUncertainWeeks
The same crowdsourced DDoS model could target public sites in Türkiye; the bigger risk is secondary attacks designed to distract rather than outages.
Possibilities, ranked
- 1Wave continues, impact limited60%
The group keeps targeting other Italian and embassy sites on the list, with outages confined to hours.
Watch: Reported outages across the 26 listed domains and statements from the Postal Police
- 2EU moves on joint attribution25%
The Italian and Romanian proposal becomes a joint attribution statement at an EU meeting.
Watch: A joint EU Council statement on cyberattacks
- 3Attack turns into a data breach15%
An intrusion attempt is found to lie behind the denial-of-service attack.
Watch: A data breach notice from ACN or the ministry
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Target list▼ 26 domains