Allied Intelligence — 2026-07-11

Italy Expels Two GRU Officers and Arrests Former Intelligence Agents in Russian Spy Ring Targeting Ukraine Air Defense Data

BLUFRome's public unmasking of a GRU network inside Italian defense structures signals NATO allies are shifting from quiet expulsions to attribution-as-deterrence against Russian targeting of Ukraine-bound arms pipelines.

Italian Foreign Minister Antonio Tajani announced on July 9 the expulsion of two Russian Embassy attachés, identified by The Insider as GRU officers Ivan Petrovich Gorbachev and Mikhail Vasilyevich Astakhov, ordering them to leave within three days amid a Rome prosecutors' espionage probe 123. The expulsions follow the July 7 arrest of two retired Italian intelligence officers, Gavino Raoul Piras and Vincenzo Di Pasquale, accused of selling classified data from six sources, four of them active-duty soldiers, to a Russian handler with diplomatic immunity 12. ANI reported the compromised material included classified details on Italian-French SAMP/T air defense systems bound for Ukraine, NATO mission data in Bulgaria, and proprietary information from aerospace firm Avio 2. Russia's Foreign Ministry said Moscow would deliver an "appropriate response" 3, and ANI reported that Moscow subsequently expelled an Italian diplomat in retaliation 2.

Analysis
Rome's decision to name the two attachés as GRU officers rather than expel them quietly marks a shift toward attribution as deterrence, raising the diplomatic cost for Moscow's Italy station, while the sustained, multi-year human network reaching SAMP/T data confirms deliberate targeting of Ukraine-bound air defense supply chains rather than opportunistic collection. Sourcing rests on one primary Italian wire account reinforced by three secondary outlets, with The Insider's independent identification work strengthening rather than merely repeating the official line. Crosetto's "tip of the iceberg" characterization points to further arrests within the same network, and Moscow's retaliatory expulsion of an Italian diplomat, following through on its threatened response, may reflect routine tit-for-tat protocol rather than genuine escalation. Read against the parallel Dutch disclosure of Russian hackers hijacking IP cameras on NATO logistics routes, the case signals a converging human and technical collection effort against Ukraine's supply lines.

4 sources