Intel471 Data Show Italy’s Cyber Threat Patterns Differ Sharply From Global Trends

Summary

Intel471 data show Italy disproportionately represented in initial-access listings and ransomware targeting, with vulnerability exploitation and web infrastructure prominent. Researchers suggest patching, technology reuse and SME prevalence may contribute, but no cause

Key points

Intel471 reported that Italian organizations accounted for about 7% of initial-access data sold on criminal forums, second only to the United States at 30%; Italy ranked fourth among countries targeted by ransomware.
In Italy-specific initial-access listings, vulnerabilities were cited in 57% of cases and credentials in 23%; Intel471’s global figures were 6.5% and 49%, respectively.
Victim web infrastructure appeared in 49% of Italian listings, while remote-access and remote-desktop tools appeared in 26%; globally, those tools featured in 67% of listings.
Intel471 characterized 90% of initial-access offers targeting Italian organizations as wholesale rather than specifically tailored to Italy.
Researchers offered lagging security investment and patching, reuse of methods against widely deployed technologies, and Italy’s prevalence of small businesses as possible explanations; they did not identify a specific technology or vulnerability behind the pattern.
Cleafy described reuse of tools, infrastructure and techniques across Italian banking targets, citing the drIBAN web-injection kit and the widely used PEC system as an example.

Article Details

Publisher: Dark Reading
Report Period: 2025 global comparison; exact reporting period and publication date not stated
Scope: Intel471 data on initial-access listings and cyberattack patterns affecting Italian organizations, compared with global data.
Sample Size: Not disclosed
Key Statistics: Italian organizations accounted for approximately 7% of initial-access data sold on cybercrime forums, second to the United States at 30%.
Italy ranked fourth among countries most targeted by ransomware.
Vulnerabilities accounted for 57% of reported initial footholds in Italy, compared with 6.5% globally.
Credentials accounted for 23% of Italian cases, compared with 49% of global IAB listings.
For Italy, 90% of initial-access offers were described as wholesale; victim-owned web infrastructure accounted for 49% of access sold, and remote-access or remote-desktop tools for 26%.