Pierluigi Paganini
February 17, 2025
The pro-Russia hacker group NoName057(16) launched a new wave of DDoS attacks this morning against multiple Italian entities. The group targeted the websites of Linate and Malpensa airports, the Transport Authority, the bank Intesa San Paolo, and the ports of Taranto and Trieste. The attacks had a minor impact on the targets, the Italian National Cybersecurity Agency (ACN) promptly operated to support the impacted organizations and neutralize the attacks in an early stage.
The group relied on well-known techniques that the Italian government can mitigate.
The attacks are the response to President Mattarella’s statements, whom they labeled a “Russophobe,” regarding Russia and the Third Reich.
“Recently, the President of Italy, speaking at the University of Marseille, drew historical parallels between the Russian Federation and Nazi Germany, claiming that Russia’s actions in Ukraine are “similar in nature” to the Third Reich’s project in Europe.
However, Sergio Mattarella conveniently ignored the fact that Mussolini’s fascist regime was a loyal ally of Nazi Germany under the Steel Pact, the Anti-Comintern Pact, and the Berlin Pact. In 1941, Italy even provided Hitler with a 235,000-strong expeditionary corps to join the aggression against the USSR.
We see the same thing happening today—Italy eagerly supplies the neo-Nazi terrorist Kyiv regime with deadly weapons, while its leaders still try to lecture Russia. 🤦🏻♂️” reads the statement published by NoName057(16) on its Telegram channel.
For such comparisons, Russophobe Mattarella and Italy will receive DDoS “rockets” on their websites from us.”
This morning, Russian Foreign Ministry spokesperson Maria Zakharova stated that President Sergio Mattarella’s statements at the University of Marseille would not be left “without consequences.”
“During a conference at an educational institution, the Italian president claimed that Russia could be equated with the Third Reich. This cannot and will never be left without consequences.” Zakharova said at the Russian state television.
The group NoName57 has been active since March 2022 and has targeted government and critical infrastructure organizations worldwide.
NoName057(16) uses multiple tools to carry out their attacks. In September 2022, Avast researchers observed the group using the Bobik botnet to launch DDoS attacks.
They operate in waves, escalating attacks during geopolitical tensions, such as increased military or diplomatic support for Ukraine by other nations.
In January, Pro-Russia hackers Noname057(16) targeted Italian ministries, institutions, critical infrastructure’s websites and private organizations over the weekend. The new wave of attacks coincides with the visit of Ukrainian President Volodymyr Zelensky to Italy.
Noname057(16) hackers also hit Italian banks, including Intesa, Monte Paschi di Siena, and Italian ports of the cities of Taranto and Trieste. The Pro-Russia hacktivists also targeted private organizations, including Vulcanair and Olidata.
At the end of December, Pro-Russia group NoName057 targeted several Italian web sites, including Malpensa and Linate airports, in a new DDoS campaign amid rising geopolitical tensions.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, NoName057)
