Italy: Intel471 reports outlier rates of vulnerability-based initial access

What happened

Dark Reading reports that threat intelligence firm Intel471 says Italy is an outlier in the global cyber threat landscape. The figures come from an Intel471 report that was shared with Dark Reading before its release (Dark Reading). The figures below are Intel471’s. They have not been independently verified, and the full report is not cited as published in the source.

According to Intel471, as reported by Dark Reading (Dark Reading):

• Italian organizations make up about 7% of all initial access data sold on cybercriminal forums. Intel471 says this is second only to the United States, at 30%.
• Italy ranks fourth among countries most targeted by ransomware.
• In Italy, initial access brokers got their foothold through vulnerabilities in 57% of cases. Credentials accounted for 23%.
• Access to victim-owned web infrastructure was sold in 49% of Italian cases. Remote access and remote desktop tools made up 26%.
• Intel471’s global figures for 2025 look very different. Remote access and remote desktop tools were targeted 67% of the time, credentials were the attack type in 49% of initial access broker listings, and exploited vulnerabilities appeared in only 6.5% of cases.
• Intel471 says 90% of initial access offers for Italy are “wholesale” offers. These are not aimed at Italy specifically but exploit vulnerabilities in bulk.

Gianluca Tiepolo, a cybercrime analyst at Intel471, gives three possible explanations (Dark Reading):

• Security hygiene. Italy may be slower than other countries to patch. Tiepolo says Italy has the largest number of end-of-life PHP 4, 5 and 7 installations in Europe, and he cites data from “PHP2Shell” as support.
• A network effect. Once attackers find an exploitation method that works, they can reuse it across many exposed systems.
• Business size. Italy has many small and medium-sized businesses, and Tiepolo says extortion groups disproportionately target them.

Dark Reading notes that the researchers could not say which specific technologies, vulnerabilities or exploits the network-effect theory refers to.

Milan-based firm Cleafy told Dark Reading it has seen a related pattern: attackers reusing tools and infrastructure across Italian banking targets. One example is the drIBAN web injection kit, which was used to exploit the Certified Electronic Mail (PEC) system. Cleafy did not endorse Intel471’s data or conclusions, and said such cases “don’t establish that Italy has a disproportionately large initial-access market” (Dark Reading).

The following are not confirmed: any specific CVEs, affected products or versions, named victims, and the threat actors involved.

Am I affected?

The source does not identify a single flaw or product, so there is no specific version check to run. Based on what Intel471 reports, these setups match the profile it describes (Dark Reading):

• Internet-facing web infrastructure run by organizations in Italy, especially small and medium-sized businesses.
• Systems still running end-of-life PHP 4, 5 or 7.
• Systems with known vulnerabilities that have not been patched.

What to do now

1. List your internet-facing web servers and applications, including any that are forgotten or legacy.
2. Find any end-of-life PHP 4, 5 or 7 installations, which Tiepolo flags as common in Italy. Plan to upgrade or decommission them.
3. Apply outstanding security patches to exposed systems, starting with known, widely exploited vulnerabilities. Intel471 describes the Italian access market as mostly opportunistic and bulk-driven.
4. Watch for the release of the full Intel471 report. Specific technologies or vulnerabilities behind these figures are not confirmed yet.

Sources

• Dark Reading: Cyber Vulnerabilities Besiege Italy, Absent Clear Cause