Italy Thwarts Russian Olympic Hacks

Every week, ISMG rounds up cybersecurity incidents and breaches around the world. This week, Italy blocked Russian cyberattacks targeting Olympic infrastructure. Actively exploited flaws in SolarWinds, Ivanti and Microsoft Office. Russia’s APT28 ramped up espionage across Europe and Ukraine, supply chain attacks hit developer ecosystems, regulators probed major breaches and a U.S. judge sentenced the operator of a major darkweb drug marketplace.

See Also: Why Cyberattackers Love ‘Living Off the Land’

The Italian government said it thwarted a series of Russian cyberattacks targeting government and Winter Olympics digital infrastructure, just days before opening day of the Milano Cortina 2026 Winter Games.

Italian cybersecurity authorities detected and blocked multiple intrusion attempts at diplomatic outposts, including its embassy in Washington, as well as Olympics websites and hotels in Cortina d’Ampezzo, Foreign Minister Antonio Tajani said Wednesday, reported Reuters. He described the activity as “of Russian origin.”

The attempted cyberattacks came as Italy intensifies security for the Olympics, which open Friday at Milan’s San Siro Stadium, with events spread across the region including Cortina d’Ampezzo.

“The conditions are absolutely ripe for cyberattacks on the Winter Games,” John Hultquist, chief analyst at Google’s Mandiant, said in post on Blue Sky. Precedents exist such as Russian intelligence’s attempted disruption of the 2018 opening ceremonies in South Korea and what he described as Russian sabotage activity in Europe reaching “fever pitch.”

Security analysts have flagged Italy as a target for Russian-aligned hacking for its support for Ukraine as it seeks to eject Russian invaders. Prior hacking campaigns attributed to pro-Russian hacktivist crews, including NoName057(16), have used distributed denial-of-service attacks to flood and disrupt Italian government, transport and financial services in the past year.

Interior Minister Matteo Piantedosi said Olympic security planning now explicitly integrates cyber defenses alongside physical measures, with thousands of personnel deployed across venues.

Security researchers and federal authorities are warning of a critical vulnerability in SolarWinds Web Help Desk confirmed as actively exploited in the wild.

The flaw, tracked as CVE-2025-40551, stems from a deserialization weakness that allows remote attackers to execute arbitrary code by sending crafted requests to affected servers. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities Catalog.

According to cybersecurity firm Horizon3.ai, the issue affects SolarWind’s ticketing software JSONRPC AjaxProxy component, where attacker-controlled data can be deserialized without adequate validation. Researchers said the same code path has been implicated in multiple prior SolarWinds Web Help Desk vulnerabilities, enabling attackers to repeatedly bypass earlier fixes.

Exploitation does not require authentication and can result in system-level command execution, giving attackers control over the underlying server. Web Help Desk is commonly integrated with directory services, ticketing workflows and administrative credentials, and compromise could provide a foothold for broader lateral movement inside enterprise networks.

Network appliance maker Ivanti patched two critical zero-day vulnerabilities in its Endpoint Manager Mobile platform after confirming active exploitation.

The flaws, tracked as CVE-2026-1281 and CVE-2026-1340, enable unauthenticated remote code execution on affected EPMM appliances. Both bugs carry a CVSS score of 9.8.

Ivanti said the flaws impact on-premises deployments only and that a limited number of customers were compromised before the fixes were released. CISA added CVE-2026-1281 to its Known Exploited Vulnerabilities Catalog.

Russian intelligence hackers commonly tracked as APT28 are exploiting a recently disclosed Microsoft Office security bypass vulnerability in cyberespionage campaigns targeting government and diplomatic organizations in Ukraine and European Union countries, Ukraine’s Computer Emergency Response Team warned.

Microsoft disclosed the vulnerability, tracked as CVE-2026-21509, on Jan. 26, confirming active exploitation in the wild (see: Microsoft Issues Patch Advisory for Actively Exploited Office Security Bypass).

APT28, also known as Forest Blizzard and Fancy Bear, is Unit 26165 of Russia’s General Staff Main Intelligence Directorate 85th Main Special Service Center.

CERT-UA identified multiple weaponized Word documents circulating publicly and through targeted phishing emails. The files impersonated official communications, including Ukrainian government bulletins and documents related to EU consultations on the war in Ukraine. Additional exploit-laced documents were later observed in attacks against European organizations.

Opening the malicious documents triggers a WebDAV-based attack chain that downloads shortcut files and executes malware with minimal user interaction. The infection relies on COM hijacking, scheduled task abuse and DLL side-loading to establish persistence.

CERT-UA said the attackers abused legitimate cloud services, using Filen.io infrastructure for command-and-control operations, complicating detection and network blocking. Several malicious domains tied to the campaign were registered on the same day they were used.

Analysis by risk management company Rescana linked the activity to APT28’s “Operation Neusploit,” in which attackers rapidly adapted their tooling following patch release.

StopICE.net, a crowdsourced service that sends real-time alerts about U.S. Immigration and Customs Enforcement activity, was the target of a Jan. 30 server attack that send fake SMS messages to users and disrupt normal operations. Service administrators confirmed the incident and said they isolated and neutralized the activity quickly.

Users on social media platforms Reddit and X shared screenshots of texts claiming their data had been compromised.

In a statement, StopICE traced the attack to a personal server associated with a U.S. Customs and Border Protection agent in Southern California and another CBP official in Boise, Idaho. Administrators said the attackers did not conceal their activity well, allowing StopICE to deploy “bait” data and identify network information, including IP addresses and phone numbers linked to the intrusion.

South Korean authorities have intensified their investigation into Coupang’s worst-ever cybersecurity failure, questioning interim CEO Harold Rogers on Friday and Saturday for more than 12 hours and examining allegations the company or its affiliates obscured evidence in the probe reported The Korea Herald.

Rogers is set to face another round of police questioning over suspected perjury during a National Assembly hearing, Yonhap News Agency reported Thursday.

The developments come as the e-commerce giant said an additional 165,000 South Korean user records were exposed in its massive breach, expanding a breach already believed to have affected approximately 33.7 million customers, nearly every South Korean adult.

Coupang acknowledged in late 2025 unauthorized access that exposed personal data, including names, phone numbers, email addresses, delivery information and certain order histories. The main suspect is a former Chinese national employee who fled to China (see: Coupang and the Horrible, No Good, Very Bad Data Breach).

Investigators are examining whether Coupang interfered with evidence preservation after discovering the intrusion, including the handling of devices linked to the former employee on suspicion of violating laws governing obstruction of official investigations.

A software supply chain attack on the Open VSX Registry allowed threat actors to distribute GlassWorm malware after compromising a trusted developer account, research from Socket found.

Attackers hijacked the account of a developer using the handle “oorzc” and pushed Trojanized updates to four previously legitimate Visual Studio Code extensions on Jan. 30. The extensions were benign for nearly two years and accumulated more than 22,000 times before the malicious updates were detected.

The updates installed a staged loader designed to run on macOS systems. Once installed, GlassWorm can steal browser credentials, cryptocurrency wallet data, system keychain contents and developer secrets, including SSH keys and cloud service credentials. The malware avoids execution on systems using Russian-language settings. It retrieves command-and-control instructions through Solana blockchain transactions.

Researchers assessed the activity as consistent with a developer account takeover rather than a malicious package planted by a new or unknown actor, allowing the attackers to bypass marketplace trust mechanisms by abusing an established distribution channel.

GlassWorm has been linked to earlier supply chain attacks targeting both Microsoft’s Visual Studio Code Marketplace and Open VSX, demonstrating continued focus on abusing trusted software distribution channels to reach developer environments.

The owner of Incognito Market, one of the world’s largest darkweb narcotics marketplaces, was sentenced to 30 years in federal prison by a Manhattan federal judge, the U.S. Department of Justice announced.

Rui-Siang Lin, 24, known online as “Pharaoh,” pleaded guilty in December 2024 to conspiracy to distribute narcotics, money laundering and conspiracy to sell adulterated and misbranded medication tied to his operation of Incognito Market.

From October 2020 until its closure in March 2024, Incognito Market facilitated the sale of more than $105 million in illegal drugs, including over a ton of cocaine and methamphetamine. The platform supported more than 400,000 buyer accounts and 1,800 vendors, and processed over 640,000 narcotics transactions before it was dismantled by law enforcement (see: Feds Say $100M Dark Web Drug Kingpin Arrested at JFK Airport).

Spain’s Ministry of Finance confirmed there was no cyberattack and no theft of personal data affecting millions of taxpayers, rejecting claims circulating online about a massive breach.

The denial follows alerts by online threat monitoring accounts on X, alleging incidents in which a threat actor going by the name “HaciendaSec” claimed to have obtained and offered for sale sensitive Spanish taxpayer data of roughly 47 million citizens, including national ID numbers, addresses, phone numbers, email addresses, IBAN bank account details and tax-related information.

The tax agency said it found no evidence of a breach or data exfiltration from its infrastructure. Systems and services were operating normally, and there were no indications of encrypted files, unauthorized access or data leaks.

The victim tally in the 2024 hacking incident on at U.S. health sector back-office services provider Conduent keeps on climbing.

The New Jersey-based Xerox offshoot told Texas regulators this week that its breach has affected about 15.5 million Texans – up from the nearly 14.8 million Lone Star residents the company reported affected just last month (see: Lawsuits, Investigations Piling up in Conduent Hack).

Conduent reported the incident to federal regulators in October as a HIPAA breach affecting only about 43,000 people.

If and when the U.S. Department of Health and Human Services updates the Conduent breach tally on the federal HIPAA Breach Reporting Tool website, the incident will rank either as the first or second largest health data breach reported in 2025.

Conduent declined Information Security Media Group’s request for a total number of people affected by the hack nationwide, and for comment on why the reported victim tally continues to climb.

In an April 2025 disclosure to the U.S. Securities and Exchange Commission, Conduent said that on Jan. 13, 2025, it experienced an operational disruption and learned that a threat actor gained unauthorized access to its network.

An investigation determined that the unnamed threat actor exfiltrated a set of files “associated with a limited number of the company’s clients.”

Darkweb monitoring platform Ransomware.live found that ransomware gang SafePay in February 2025 listed Conduent on its dark website as one of its victims, threatening to publish 8.5 terabytes of the company’s stolen data. Conduent has not commented on SafePay’s claims.

Other Stories From This Week

With reporting from Information Security Media Group’s Poulami Kundu in Bengaluru and Marianne Kolbasuk McGee in the Boston exurbs.