01 ·
Integrated Cyber Threat Intelligence
Real expertise on threats, not a help desk.
A cyber attack is not an event. It's someone.
And someone can be known, anticipated, stopped.
Fortgale is a European cybersecurity company specialised in defence against advanced threats. Our SOC in Milan, operating 24·7·365 with senior analysts, detects and contains attacks within measurable timeframes; the Cyber Threat Intelligence produced by our analysts tracks the offensive groups targeting European organisations and gives weight to every alert.
Median containment in <30 minutes from confirmed alert. The service integrates with the technologies the organisation already uses and strengthens them, with no vendor lock-in.
NIS2 and DORA compliant.
Certifications · view PDFs
Threats · what we stop
We protect the assets and operations of organisations.
Cyber fraud
Phishing and scams targeting people and business processes.
Phishing protection Identity compromise
Corporate accounts and email under the attacker's control.
Identity protection Third-party compromise
External and internal threats that enter through the supply chain.
Digital Risk Protection Cyber attacks
Malware, ransomware, infostealers.
Ransomware protection 
About · Milan · since 2017
From the complexity of the cyber landscape, a measurable defence.
Fortgale was founded in Milan in 2017 with a focus on Cyber Defence and Governance. Our Competence Center specialises in malware analysis, Cyber Threat Intelligence, Incident Response and Threat Hunting, and every day turns this expertise into operational knowledge and continuity for our clients.
From the SOC in Milan, operating 24·7·365, our senior analysts work across multiple security technologies. Fortgale protects organisations in 11 strategic sectors, including manufacturing and automotive, banking, finance and insurance, aerospace and defence, aviation and maritime transport, and serves clients in 22 countries across EMEA, America and APAC. Cyber Defence, Cyber Threat Intelligence and Advisory converge in the Fortgale Defence Platform.
- 287 hostile tools and actors profiled, active across European markets
- <15 min median detection · <30 min median containment from confirmed alert
- ISO/IEC 27001 · 9001 · 14001 · 45001, safeguarding our clients' data
Our services
Four services, one chain of responsibility.
Four integrated services: SOC and MDR defend the corporate infrastructure, Cyber Threat Intelligence strengthens the defence and supports the decisions of the board, Advisory consolidates the defensive posture and regulatory compliance. A single point of contact protects the organisation before, during and after the attack.
Service · 01
Security Operations Center
Defence of the corporate infrastructure from our SOC in Milan, operating 24·7·365 with senior analysts. Triage, escalation and incident management within the European regulatory context.
- Senior team of European analysts
- Dedicated cyber specialisations
- Board-ready reporting
Service · 02
Managed Detection & Response
Managed detection and response across endpoint, identity, cloud and network, driven by threat intelligence. Median detection <15 min, containment <30 min.
- EDR · NDR · IDR · CDR
- Incident Response and attacker eradication
- Proactive threat hunting
Service · 03
Cyber Threat Intelligence
Defensive enhancement to counter, prevent and understand digital threats: up-to-date profiles of 287 hostile tools and actors active across European markets and strategic support for the board.
- Dark web monitoring 24·7
- Monthly threat actor briefing
- Reports produced by analysts
Service · 04
Cybersecurity Advisory
Specialist consulting to consolidate the defensive posture and support regulatory compliance: risk assessment, NIS2 and DORA, tabletop exercises on real scenarios, vCISO.
- NIS2 · DORA compliance
- Tabletop on real adversaries
- vCISO service
The Fortgale Defence Platform provides centralised access to all security information: threat management, incident register and Cyber Threat Intelligence sharing.
Why Fortgale
Six reasons to entrust your defence to Fortgale.
02 ·
Advanced threat management
Experience in handling complex incidents conducted by advanced threat actors.
03 ·
Incident Response
Full autonomy in eradicating the attacker from corporate systems and networks.
04 ·
Technology integration
Fortgale adapts to the technologies the client already uses and strengthens them.
05 ·
Vendor agnostic
Independent of the technologies in place.
06 ·
Three tiers in a single team
Maximum effectiveness in threat management.
Research · Cyber Threat Intelligence
Every defence starts with knowing the adversary.
Our analysts study the threats active against European organisations: they profile the actors, analyse the malware, reconstruct the campaigns. This research feeds the detection and response of our services and is regularly cited by institutions, leading companies and specialist cybersecurity media. We don't aggregate third-party feeds, we publish only what we have verified first-hand.
MacSync: when the victim types the attack chain
No exploit. No attachment. No phishing email. In this campaign the threat actor needs the victim to do exactly one thing: copy a command from an installation guide and paste it i…
Read article →
Kali365: when the session becomes the new credential
ABSTRACT The FBI recently issued an advisory on Kali365, a Phishing-as-a-Service platform that abuses legitimate Microsoft OAuth flows to bypass multi-factor authentication. Kali…
Read article →
Phishing Kits Bypass MFA and Hijack companies's accounts in minutes
Intelligence · Phishing Kit · Q1 2026 April 24, 2026Fortgale CTI14 min readRPT-26-0424 Observation of the quarter The 2026 phishing ecosystem has outpaced traditional defenses. M…
Read article →
Investment-Targeted Phishing: How Phishing Kit Fuels Espionage in Funding Rounds
In the high-stakes world of venture capital and corporate funding, where millions hang in the balance and sensitive financial data flows freely, a new breed of cyber threat is em…
Read article →
Operation Storming Tide: A massive multi-stage intrusion campaign
In February 2026, the Fortgale Incident Response team investigated a multi-stage intrusion attributed to Mora_001, a Russian-origin threat actor exploiting Fortinet vulnerabiliti…
Read article →
Behind the Wheel: Unveiling the Supercar Phishing Kit Targeting Microsoft 365
UPDATES: 27.11.2024: As mentioned by TrustWave, "Supercar Phishing Kit" has an high level of overlapping with the most recent update of "Rockstar 2FA Phishing-as-a-Service" 26.09…
Read article →Cited by The Hacker News · Google Cloud Blog · GData · HiSolutions Research · Cybersecurity Trends · Tom's Hardware · All references
Our clients · sectors
Eleven strategic sectors,
each with its own adversaries.
Manufacturing
Ransomware with exfiltration, critical production downtime, integrated OT/IT.
Actors LockBit 4.0 BlackCat Akira +4
Industrial machinery
Ransomware with exfiltration of designs and technical drawings, remote access by suppliers and service technicians, halted deliveries.
Actors Akira LockBit Black Basta
Automotive
Ransomware along the component supply chain, halted just-in-time production lines, theft of design data.
Actors LockBit Black Basta
Building materials
Ransomware with exfiltration, plant and logistics downtime, compromise of ordering and production systems.
Actors Black Basta
Heavy industry
Ransomware on continuous processes, critical OT SCADA/PLC, industrial IP exfiltration.
Actors LockBit 4.0 BlackCat Sandworm +4
Technology and data storage
Software supply chain, OAuth/SSO token abuse, privileged cloud access, source code leaks.
Actors Scattered Spider Lapsus$ BlackCat +3
Banking and Finance
Advanced e-crime, banking supply chain, vishing against helpdesk and operators.
Actors Cl0p FIN7 Scattered Spider +3
Insurance
Digital claim fraud, data breach, ransomware on policy and claim platforms.
Actors Scattered Spider BlackCat Cl0p +2
Aerospace and Defence
State-sponsored APTs, software supply chain, IP and classified data exfiltration.
Actors APT28 APT29 Sandworm +3
Aviation
DDoS on public channels, ransomware on MRO/handling, carrier supply chain.
Actors NoName057(16) LockBit BlackCat +2
Maritime transport
OT on vessels and port terminals, cargo management ransomware, GPS/AIS spoofing, maritime supply chain.
Actors NoName057(16) LockBit RansomHub +2
Resources: cybersecurity guides and glossary → · Incident Response 24·7 →
Contact · first step
Book a meeting with our analysts.
A meeting protected by a non-disclosure agreement and a technical conversation with our senior analysts. Within 72 hours of the meeting you will receive the Report on your sector.