Allied Intelligence — 2026-10-27

Italian Intelligence Investigates Possible Operational Link Between Pro-Russian Hackers and Domestic Extremist Networks

BLUFNoName057(16)'s unverified claims of coordinating with Italian domestic extremists serve as low-cost influence amplification, not evidence of operational direction, but Rome's real exposure remains the group's proven DDoS capability against government networks.

Italy's Comando interforze Cyber Intel is examining a possible link between the "Movimento 17 ottobre" and pro-Russian hacker groups including NoName057(16), according to Corriere della Sera as relayed by Open 1. Milan prosecutors detained Youssef Siher, 30, who ran the movement's 32,000-follower Instagram page, and his wife is also under investigation for terrorism-related offenses 1. NoName057(16) and Dark Storm Team announced support for protests planned for October 24 in eight cities, but Open reports this was limited to solidarity messages without direct threats 12. Quotidiano.net reports NoName057(16) claimed it promoted an Empoli student protest, and whether this reflects real coordination is unverified 34. Putin denied Russian involvement 13, and the European Commission says it lacks evidence that foreign powers orchestrated the unrest 3.

Analysis
Italian investigators have not shown that NoName057(16) or Dark Storm Team coordinated with the Movimento 17 ottobre, and the public record supports only declared online solidarity. NoName057(16)'s claim to have promoted the Empoli student protest is self-attributed and untied to organizers, and such claims let the group take credit for domestic unrest at no operational cost, blurring amplification and direction. The hackers may have simply attached themselves to protests already underway for propaganda value, with no contact with organizers. Confidence is low: all four sources derive from one Corriere della Sera account relayed by Open, with no named investigative source, seized communications or technical attribution. Rome's defensive priority remains DDoS exposure of police, defense and video-surveillance networks, which the group has hit before regardless of any movement link.

4 sources