Italian intelligence and cybersecurity agencies are investigating direct operational links between pro-Russian hacking groups and radical networks organising violent anti-government protests in major cities across the country, according to Decode39.
Investigators have reportedly uncovered compelling evidence of coordinated and pre-planned activities involving domestic extremist elements and pro-Kremlin actors. The primary objective of this alleged alliance was to maximise disruption during nationwide demonstrations, undermine public order and weaken the country's institutional stability.
According to the investigation, Italian cyber intelligence has identified a dangerous trend of "cyber-physical convergence". In particular, the well-known pro-Russian hacking groups NoName057(16) and Dark Storm Team openly declared their solidarity with and support for the radical anti-establishment October 17 Movement (M1710) online. The hackers allegedly attempted to synchronise large-scale distributed denial-of-service (DDoS) attacks, designed to paralyse the official websites of Italian government institutions, ministries and defence agencies, with acts of vandalism and violent street unrest.
The threat reportedly reached a critical point when law enforcement authorities were forced to intervene at the last moment, just as the network was preparing to trigger coordinated outbreaks of violence in eight major Italian cities, including Milan, Rome, Turin and Bologna.
To conceal their activities and evade police monitoring, the alleged conspirators made extensive use of encrypted communication channels with tens of thousands of subscribers. A central element of the ongoing domestic investigation has been the arrest of key administrators of the movement's digital channels, many of whom had previously disseminated anti-establishment and anti-Western narratives online.
Investigators emphasised that the movement, which operated without a single publicly identifiable leader, had developed a sophisticated operational security infrastructure, including dedicated legal support, secure chat protocols and a rigid digital hierarchy.
Documents and communication records seized by police reportedly indicate that the organisers and their associates were implementing a large-scale destabilisation campaign, exploiting existing public discontent. The case has sparked a wider debate across Europe about how covert online radicalisation can rapidly translate into violent street protests.
Experts note that such cooperation between domestic agitators and external actors is a characteristic feature of modern hybrid warfare, in which Kremlin-linked networks exploit existing social and economic divisions within Western democracies to disrupt critical infrastructure across multiple domains.
Italian analysts stress that although pro-Russian hackers primarily rely on temporarily disabling websites through DDoS attacks rather than deploying destructive ransomware, the apparent coordination of cyberattacks with street violence presents unprecedented challenges to national security.
For Rome, countering these threats requires close and effective interagency coordination between domestic law enforcement and military cyber intelligence.
