LockBit5 and Qilin Lead Ransomware Attacks in Italy
Italy's manufacturing sector became the primary target of cyberattacks.
1The Scale of Ransomware Attacks in Italy
In the first half of 2026, Italy experienced 148 confirmed ransomware attacks. The majority of these attacks targeted the manufacturing sector. Attackers claimed to have exfiltrated over 13,400 GB of data. However, this figure was only disclosed in 64 cases. The monthly average of attacks was 24.7, while the weekly average was 5.7. Northwest Italy emerged as the most affected region.
2Geographical Distribution and Sectoral Impact
Northwest Italy, with 63 victims, was the region most affected by the attacks. Northeast Italy followed with 36 victims. The Lombardy region alone surpassed the total number of victims in the center, south, and islands combined, with 45 victims. The manufacturing sector, with 59 victims, became the primary target of these attacks. This sector is particularly attractive to attackers due to its proprietary designs and operational technologies.
3The Most Active Ransomware Groups
LockBit5 and Qilin, each with 21 victims, were the most active ransomware groups in Italy. LockBit5 stood out by carrying out nearly half of its attacks in a single month, March. Qilin, on the other hand, consistently targeted small and medium-sized businesses over six months. Italy's cybersecurity team CSIRT issued a specific advisory warning against Qilin's systematic targeting.
4The Surge in June and Its Details
June was the busiest month of the first half, with 31 attacks, marking a 72% increase compared to May. However, a significant portion of this surge was due to a single-day attack by a group called Deadlock, which targeted 12 victims. Safepay also claimed to have stolen nearly 1,900 GB of data in June. Excluding these bursts, June appears much less dramatic.
5The Relationship Between Data Volume and Victim Count
There is no direct correlation between data volume and the number of victims. February had the fewest attacks but the largest data haul, primarily due to two major attacks against Gruppo SEAC and Sofinter Group, each involving approximately 2,000 GB of data. Two big fish can outweigh a dozen small ones on paper.
6The Methods Behind the Attacks
The majority of the attacks were carried out using credentials from old breaches, unpatched public-facing systems, and exposed RDP. CL0P's four attacks in January and February were linked to a mass exploitation campaign against Oracle E-Business Suite. This highlights how a single unpatched system can lead to victim lists months later.
7The Volatile Nature of Ransomware Groups
During this period, 30 different ransomware groups were identified in Italy, each claiming at least one victim. However, 11 of these groups appeared only once. This demonstrates how volatile and disposable ransomware brands have become. Affiliates rebrand, spin up new names, and disappear within weeks. Basing your threat model on which 'brand' is currently trending is akin to planning for weather using yesterday's forecast.
8Italy's Cybersecurity Landscape
Italy's cybersecurity agency ACN supports what this dataset shows locally: cyber incidents increased in June compared to May, with pressure concentrated on smaller, lower-resilience organizations. If you run a mid-sized manufacturing company in Lombardy with RDP exposed to the internet, you're not a hypothetical target. You're the median one.
Original article: Security Affairs — LockBit5 ve Qilin İtalya'da Ransomware Saldırılarını Yönetti