Illustrative image from the original report; it does not identify a NoName member. Source: Corriere della Sera
#Europe has spent days chewing on the latest blow from the pro-Russia #hackers: NoName057(16) and its Z-Pentest allies claim they hit European grocery distribution, #Italy included, and promise that #water and #power grids are next. Emergency meetings, #security committees, ministers at the microphones. And I keep asking a far less comfortable question: are we really scared of this enemy, or are we scared of looking at our own house?
Because the technical and judicial documents piling up over the past two years tell a far less epic story than the #headlines. And a far more humiliating one for us.
Mediocre, With a Megaphone
Start with what the agencies say, not what the groups brag about. The joint advisory from the #FBI, #CISA, the #NSA and some two dozen partners, first published on December 9, 2025 and revised on December 18 of the same month, describes these crews with devastating coldness: low-sophistication, low-impact attacks compared with the advanced, persistent groups that actually know what they are doing. Their great weapon? Industrial remote-access panels left exposed on the public #internet, protected by factory #passwords, weak ones, or none at all. No movie-grade wizardry: they walk in through control screens nobody should have left visible, poke at whatever they find, and post the clip to #Telegram as if it were a military feat.
The same document adds two details that deserve to lead every newscast. First: their victim selection is opportunistic. They attack what is available, not what is strategic. Second: they routinely exaggerate their feats and sometimes cannot even correctly identify whom they hit. They boast about taking down a piece of critical #infrastructure and the victim turns out to be someone else, a company they had not even identified correctly.
Careful, though: mediocre does not mean harmless. U.S. authorities attribute real physical damage to them. Public drinking water spilled at scale from municipal systems. A meat-processing plant in Los Angeles in November 2024, with spoiled product and an #ammonia leak that forced an evacuation. An incompetent with his hands on the panel of an industrial facility is still dangerous, precisely because he does not understand what he is touching. But the danger does not spring from his genius. It springs from our open door.
The Damage Is Documented; Who Did It Is Another Question
Nobody gets to hide behind “it’s just claims.” Italy’s national #cybersecurity agency, the #ACN, published a technical bulletin on October 13 after the incident that hit numerous #supermarket chains in #France: obsolete installations, administration interfaces exposed directly to the internet and weak #authentication allowed attackers to remotely trigger #defrost cycles and alter equipment parameters, breaking the cold chain and causing heavy economic damage. The agency pushed the bulletin back to the top on November 3 and 4, and in its November 3 statement it added two cases in Italy: a formal incident notification from an institutional catering company in Tuscany, and a detected attack on a frozen-food producer in Emilia-Romagna. Those are figures from that statement, not a final tally; and the attribution of the European episodes to NoName or Z-Pentest remains unconfirmed in the documents we consulted. But the incidents exist and are documented: neither mass hysteria nor a verified war bulletin.
That same bulletin contains the operational detail that should keep every executive awake: whoever gets into those panels can alter what they display and suppress the #alarms. And the ACN says it in black and white: getting the #temperature back does not, by itself, prove the goods were kept safe; you have to verify parameters and actual conditions with measurements independent of the compromised platform. That is the metric that matters: not how many attacks you announce you have repelled, but how long it takes you to trust your own instruments again.
Who Pays for the Party
Now to who is behind this circus, and here we are talking about formal charges, not convictions. According to the U.S. Department of #Justice, the Cyber Army of Russia Reborn was founded, funded and directed by the #GRU, Russian military intelligence; NoName057(16) is alleged to be a covert project inside an organization created by presidential order in #Moscow in 2018, officially to watch over Russian youth online. Their tool #DDoSia runs like a patriotic video game: volunteers download the program, there is a daily leaderboard of the most active, and the top performers get paid in #cryptocurrency. Research by the firm #Sekoia counted, back in 2024, close to twenty thousand members in the project’s Telegram channel, which is not twenty thousand enrolled operators, let alone twenty thousand attackers in action, and a community tracking the geopolitical calendar almost daily. Even the program’s fine print reassured anyone running it from #Russia: according to its administrators, legal trouble at home was very unlikely. That was their own assessment, of course.
So: neither an invincible cyber army nor a romantic digital guerrilla. A #propaganda scheme with incentives, politically sheltered, that outsources the enthusiasm. Operation #Eastwood in July 2025 took down more than a hundred #servers around the world, with police actions in eight countries, produced seven arrest warrants and warned eleven hundred collaborators of their potential criminal liability. It worked: imposing cost, friction and fear on the volunteer base is exactly what hurts a #franchise model. And yet the project kept operating. And here is my reading, mine and not any indictment’s: as long as the incentives and the #Kremlin’s political cover stay intact, dismantling servers is pruning the bush, not uprooting it.
One note of honesty the case files themselves force on us: they do not tell the same story. To the American prosecution, CARR and Z-Pentest are the same actor, directed by the GRU; CISA’s technical advisory, instead, dates Z-Pentest’s birth to September 2024 as a splinter and assesses it, in that phase, as separate from GRU involvement. That is not proof the investigators are clueless, nor proof it is all smoke: each source groups actors and time periods in its own way, while the groups themselves are born, merge and rebrand chasing an audience. Which is why whatever holds for one acronym in 2024 cannot be stamped automatically onto every attack of 2026. For the public debate the lesson is humbler: while we argue over org charts, the control we actually lack sits in the access points exposed to the internet, and in who holds the key.
Five questions, five different kinds of evidence. Conceptual diagram by Raffaele Di Marzio, not a confirmed sequence in every incident. CISA AA25-343A ACN / CSIRT Italia
The Metric of Self-Congratulation
Now, the target at home. Facing the wave, Italy’s foreign minister, Antonio #Tajani, stated, in remarks reported by Corriere della Sera, that Italy has repelled a great many attacks, that it reacts and that it is able to do so. I take that statement as the perfect specimen of the wrong metric: every repelled attack is still a counted attack, and the siege narrative fattens with each press conference. An aggressor who lives on noise profits even from the failed assault, because the failed assault also makes the news. And it is worth remembering what a #DDoS actually is: flooding a service with requests until it becomes unreachable. Mitigating that flood costs real money and real work, and nobody should take that away from the technicians who do it; but stopping the traffic does not prove that nobody got into the control systems, or that parameters and goods are intact. The problem is not defending yourself: it is waving the counter around as if it were the health report of your facilities.
The grown-up metric of #defense is boring and verifiable: how many exposed remote-access points did we close this year, how long does a water plant or a cold chain take to resume operating on trustworthy data after an incident, how many organizations can run on manual without panicking. That takes continuous work and #maintenance; waving the counter around, instead, only takes a press conference.
The Open Door Has an Owner
And we reach the part that makes no headlines: the economics of the open door. Those remote-access points are not installed by the enemy. Many exist because remote #assistance and remote maintenance are convenient and cheap, and the ACN itself devotes entire measures to the maintainers’ connections: restrict their access to authorized systems and time windows, log their activity, revoke their credentials when the job is done. Read that for what it is: a map of the contractual battlefield. Because if a contract leaves the #vendor permanent access, with no logging and no revocation, the risk sits with the buyer while the vendor saves itself the management; and renegotiating that convenience costs money and a bargaining position many small operators simply do not have. CISA, for its part, asks the #manufacturers for no default credentials, robust authentication and activity logs at no extra charge. Those are recommendations, not a portrait of every signed contract; but they mark exactly where this war should be fought: in the #clauses, not in the press releases.
That is the boring, decisive battle we should be fighting: #bargaining power for industrial customers, manufacturer responsibility, access hygiene as a condition of the #contract, independent measurements so operators can trust their own facilities again. Everything else is collecting exotic #acronyms and #crisis committees while a gang of opportunists with delusions of grandeur gets paid twice: in cryptocurrency, through the daily leaderboard, and in media #attention, at our expense.
So the next time somebody climbs a lectern to count the attacks they have repelled, let them answer three verifiable questions first. How many control interfaces in their sector are still exposed to the internet? How many maintenance contracts include access revocation and activity logging? How many operators have checked their goods with independent measurements, rather than with the panel the intruder may have tampered with? Whoever cannot answer should put down the microphone: they are using it to sing backup for the enemy.
Raffaele Di Marzio
🎧 Prefer listening to reading? I talk about it on the podcast, unfiltered and straight to the point.
Pick your platform:
- 🍎 Apple: https://podcasts.apple.com/it/podcast/cyberium/id1770980085
- 🟢 Spotify: https://open.spotify.com/show/5XGYml8cungSi1Hfkai2ZD
- 📻 iHeart: https://www.iheart.com/podcast/53-cyberium-224923335/
- 🎧 Amazon / Audible: https://music.amazon.fr/podcasts/64fb49fa-8fdf-4549-affe-8be9f97d8f22/cyberium
- 🎵 Deezer: https://www.deezer.com/it/show/1001270131
If you enjoy it, subscribe and share it with someone who needs to hear it.
All my “insane” books on cybersecurity and governance are here 👇 https://cyberium.limited/bookshelf.html
Illustrative image. Source: Corriere della Sera (https://roma.corriere.it/notizie/cronaca/26_novembre_08/europa-attacco-cyber-chi-sono-i-noname-e-alleati-hacker-301135ac-5c22-44a6-8de0-68c4bf566xlk.shtml).