Initial Access, Ransomware and Vishing: How Threat Actors Are Targeting Italy in 2026

Italy ranks second globally and first in Europe for initial accesses offered for sale from January to September 2026. It was the fourth most targeted country for ransomware and extortion. This report shows security teams how threat actors are reaching Italian organizations and where to focus defenses.

The Intel 471 report covers the initial access market, the ransomware groups driving breaches and extortion in Italy and the recruitment of local language actors to support a new wave of sophisticated vishing campaigns. It also assesses pro-Russian hacktivist DDoS campaigns targeting Italian organizations.

Inside the report, your teams will find:

• Initial access: How brokers sell access to Italian organizations, which technologies are exposed, and the methods behind it
• Ransomware: Activity from Qilin, The Gentlemen, and LockBit 5.0, plus the sectors and company sizes most affected
• Social engineering and hacktivism: Vishing demand for Italian-speaking callers and NoName057(16)’s sustained DDoS targeting

Download Intel 471’s report Initial Access, Ransomware and Vishing: How Threat Actors Are Targeting Italy in 2026 to get our comprehensive analysis of the access brokers, ransomware groups, and social engineering campaigns shaping the threat landscape for Italian organizations.