Intel471 Data Finds Italy an Outlier in Cybercriminal Access Listings

Summary

Intel471 data says Italian organizations account for about 7% of initial-access listings and face unusually high vulnerability-based access; the article explores delayed patching, reusable attacks and Italy’s SME-heavy economy as possible explanations.

Key points

• Intel471 reports that Italian organizations account for about 7% of initial-access data sold on cybercriminal forums, second only to the United States at 30%; Italy ranks fourth among countries targeted by ransomware.
• In Italian initial-access broker listings, vulnerabilities were the stated foothold in 57% of cases and credentials in 23%. Web infrastructure appeared in 49% of access offers, compared with remote access and remote desktop tools at 26%.
• Intel471’s global 2025 data showed credentials in 49% of listings, remote access and remote desktop tools in 67%, and exploited vulnerabilities in 6.5%, contrasting with Italy’s figures.
• Intel471 analyst Gianluca Tiepolo suggests slower cybersecurity investment and patching may contribute. He says 90% of Italian initial-access offers were bulk or “wholesale” offers, not specifically targeted at Italy.
• The article presents two other possible explanations: reusable exploitation methods against commonly exposed systems, and Italy’s high proportion of small and medium-sized businesses, which Tiepolo says extortion groups target disproportionately.
• Cleafy describes reusable tools, infrastructure and techniques in campaigns against Italian banking targets, including the drIBAN Web injection kit targeting the widely used Certified Electronic Mail system; it says these cases do not establish a disproportionately large Italian initial-access market.
• The article does not identify the specific technologies or vulnerabilities behind the broader pattern, and presents the proposed explanations as theories rather than a settled cause.

People

Tools

Countries

Industries