3.2 | Cyber Security trends | Italy

3.2 | Cyber Security trends | Italy

In 2023, Cyber Crime in Italy also showed a significant and constant increase compared to previous years, thus confirming the global trends previously analysed. The first half of 2024 showed a slight improvement, but it should be considered that in 2023, a similar situation was followed by an increase in incidents in the second part of the year.
Between 2023 and 2024 in Italy the following was observed¹:

+ 20%
Malware
Attacks

Constant increase of DDOS
attacks
27% of total attacks

Significant number of attacks via email (phishing and social engineering)

Online scams on the increase, thanks in part to new AI techniques

Manufactiring al primo posto come settore vittima di attacchi cyber

Attacks Severity
Critical: 8%
High: 50%
Medium: 41%
Low: 1%

"Financial cybercrime" attacks through "man in the middle" (BEC Fraud, CEO Fraud)

Increase in SMS attacks with access to personal information (Smishing)

Attacks aimed at identity theft, including SIM Swap (SIM replacement)

Although all the types of attack identified above are significant, we would like to take a closer look at the situation regarding attacks via email: for companies, emails received by employees and the actions they take based on them are often the primary means of cybercriminals accessing the company network.

Compared to previous years, there has been a clear decrease in the number of generic mass mail attacks in favour of TARGETED and CUSTOMISED attacks that:

  • Make it easier to overcome the security measures implemented by companies.
  • Thanks to the personalised information they contain, decrease the level of attention and analysis of those who receive them, thus making them more effective.

The ever-increasing evolution of Social Engineering and Deep Fake techniques used by attackers allows them to effectively identify the most suitable targets to obtain, thanks also to phishing and deception, the desired result which typically takes the form of:

Data Encryption

Data Exfiltration

The ultimate aim of this fraudulent activity is to demand a ransom from the company in exchange for not publishing the stolen data or to be able to decrypt it.

The use of Deep Fake techniques is at the root of the phenomenon known as CEO Fraud. Cybercriminals collect publicly available information on these important people and recreate their voices and mannerisms, which are then used to ask employees to make bank transfers for confidential and urgent financial transactions that obviously don’t exist.

To minimise the risk associated with this type of attack, the company must:

  1. Implement adequate and effective IT security measures, including for email.
  2. Properly train staff so that they are aware of the threats they may face and are able to recognise and manage them accordingly.

Email Security and the constant training of human resources are, therefore, areas to which Italian companies must pay particular attention today, to avoid the risk of suffering significant economic damage resulting from the theft of information that is fundamental to their business.