Italian targets gain traction in criminal forums

Over recent months we have observed exponential growth in cyberattacks and ransomware campaigns. The organization of attacks and the trading of information occurs on increasingly accessible and frequented forums.

We have tracked a marked increase in targeting of Italian entities. Both for obtaining access to organizations and for acquisition of sensitive information.

In this specific case, we identified the sale of 1 million sensitive data records related to Italian citizens for USD 150, linked to the Forex sector.

The database reportedly contains: name, surname, email, mobile phone number, gender, postal code, and IP address of users.

In recent weeks we identified specific requests for acquisition of information concerning Italian email addresses:

These same posts are frequently replicated across multiple forums and platforms:

The proliferation of Italian-targeted data sales and reconnaissance activity on underground forums underscores the necessity for organizations to implement continuous monitoring and Cyber Threat Intelligence capabilities to detect early indicators of compromise and data exposure. Incident response readiness and threat hunting operations remain critical defensive measures against organized threat actors operating in this ecosystem.