Hoax Bomb Threats Target 6,300 Italian Schools as Suspected Hybrid Warfare Campaign Escalates Across Europe

Analysis
Confidence is moderate, resting on a sender account belonging to a reportedly hacked Taiwanese student and on the absence of any published forensic or intelligence finding tying the campaign to a state. The "Mikhail Andropov" signature links Wednesday's emails to last week's newsroom threats, which points to one operator or one template but not to a sponsor. Sourcing is only moderately independent: English-language accounts lean on a Reuters relay, and the Italian primary report alone supplies the ministry and sender-address detail. A public attribution of the school emails to a named state actor by an Italian, UK, Irish or EU government or police authority is very unlikely to happen between November 13 and December 12. Italian officials describe a strategy yet name no culprit, and the Defense Minister has allowed that attention-seekers could be responsible, so a lone hoaxer or small criminal group exploiting public school addresses may be the simpler explanation. The emails remain a criminal nuisance met with hardened school email filtering and cyber coordination rather than diplomatic retaliation, and any attribution that does come would start from France's Iran accusation in the supermarket case, not from these emails.