Companies that have fallen victim to espionage on the geopolitical stage

Nachreiner: the focus is shifting from malware to data transfer and privilege escalation

Sensitive information and access to strategic supply chains

Nachreiner: watch out for unusual behaviour

The situation in Italia

Cyber espionage is a tool of strategic and economic competition: this is a well-known fact, given the prolonged period of geopolitical instability, but one that is constantly taking on new forms. The campaign attributed by WatchGuard Technologies, another US cybersecurity firm, to the Iranian group MuddyWater is a case in point.

In the second half of February this year, just before the latest escalation between Iran, Israel and the United States, criminal activity affected high-value organisations across four different continents (Asia, the Middle East, Latin America and Europe) for a week, spanning sectors from manufacturing to aviation, from finance to education and the public sector.

Sensitive information and access to strategic supply chains

The targets of state- espionage activities therefore also include businesses (and not just government bodies) that hold sensitive information or have access to strategic supply chains. The best-documented case involves a major South Korean electronics manufacturer, from which the attackers stole data and copied Windows credential files. This was a genuine, sustained intelligence operation, rather than an attempt to disrupt the company’s network and systems.

“This phenomenon,” explained Corey Nachreiner, CISO at WatchGuard, to *Il Sole 24 Ore*, “is becoming more stealthy, more patient and increasingly difficult to distinguish from normal IT activities.” In this regard, the MuddyWater campaign reflects an even broader trend in espionage carried out by ‘nation-state’ actors, according to which attackers are relying less and less on malware or easily recognisable malicious code, and increasingly on legitimate cloud services and genuine software already present within the victim’s IT systems, using them without authorisation and for hostile purposes.

“Rather than ceasing their operations immediately,” Nachreiner adds, “they often aim to gain privileges and persistent access, whilst remaining undetected for as long as possible.”

Nachreiner: watch out for unusual behaviour

For organisations that find themselves targeted by these threats, the approach to defence changes accordingly, because known signatures and indicators of compromise are no longer sufficient if the attacker uses authorised tools, valid identities and public services. The priority therefore becomes identifying who is already inside one’s systems and blending in with normal operational activities. ‘The focus,’ explains WatchGuard’s CISO, ‘is shifting from detecting malware to identifying anomalous behaviour such as privilege escalation, unusual data transfers or unexpected use of administrative tools.’

In the case of the South Korean company, for example, a script automated several tasks, although it has not been confirmed that the campaign utilised autonomous AI agents. In general, Nachreiner adds, all organisations are potentially at risk even if they are not a direct target: ‘Whether the aim is to acquire strategic information or to exert political influence, companies become indirect participants in geopolitical conflicts simply because they hold valuable data, intellectual property or access to critical supply chains.’

North Korea, however, adds another dimension to the phenomenon, as evidenced by groups such as Lazarus, which combine espionage on behalf of third parties with the theft of cryptocurrencies, turning cyber-attacks into a profit-driven industry. Identity monitoring, and visibility across endpoints, networks and the cloud, therefore take on even greater importance and, as Nachreiner warns, we must already be defending ourselves against so-called ‘living-off-the-AI’ attacks, which exploit the privileges granted by organisations to their artificial intelligence agents.

The situation in Italia

The fact that information, expertise and access are the primary targets of cyber-espionage actors is also evident in the Italian cases compiled in a dossier authored by Sofia Scozzari, CEO and founder of Hackmanac (a Dubai-based threat intelligence firm) and a member of the Clusit Board since 2011. Italia’s strategic position within the EU and NATO is in itself a ‘reason for interest’, and the report cites the APT28 group in this regard, which has been targeting the logistics and technology sectors of countries (including Italy) that have provided aid to Ukraine. Furthermore, an ESET report cited by the expert attributes to Lazarus an attack carried out in 2025 against an Italian aerospace company, targeting its expertise in unmanned systems. The theft of data (names, roles and operational locations) relating to around 5,000 DIGOS officers engaged in counter-terrorism activities, carried out by Chinese cybercriminals between 2024 and 2025 and made public last February, is said to have been used to track down dissidents of the Beijing government residing in Italia, but is not believed to have led to the sabotage of the Interior Ministry’s IT systems.

Being the target of a campaign does not necessarily mean the attack has succeeded, but when it comes to cyber espionage, the alert level remains high in any case.

Notizie e approfondimenti sugli avvenimenti politici, economici e finanziari.