In 2025 Italy did record an unprecedented level of cyber attacksIn twelve months they have been 116.498 episodes recorded, equal to 2.249 per week and an average of one attack every five minutesA frequency 17% higher than the global average, which places the country among the most exposed targets. Cybersecurity is thus entering a phase of great difficulty. This is the snapshot taken by the Threat Landscape 2025 of Tinexta Cyber, a company of the Tinexta group born from the integration of Corvallis, Swascan and Yoroi, which outlines a increasingly unstable digital ecosystem, marked by the intertwining of organized crime, geopolitical tensions, and the growing use of artificial intelligence. Today over 80% of cyber threats globally has a economic goal and in one case out of three the attack starts from stolen credentials.
Malware on the rise and ransomware accelerating
The pressure is not only quantitative but also qualitative. Everyday, in the world, are identified among the 450.000 and 560.000 new malware variants, bringing the total number of known malicious programs to over 1,2 billion. In Italy, the most alarming figure concerns ransomware, which grew by 48% compared to the previous period, with a peak in the month of July. These are increasingly targeted attacks, capable of blocking critical systems and services to obtain ransoms or generate prolonged outages, directly impacting the operations of companies and public administrations.
Hacktivism and public services in the crosshairs
In the first half of 2025 it was pressure on public sites and services has also intensifiedMany attacks are not aimed at stealing data, but at making portals and essential services inaccessible for citizens and businesses, creating slowdowns or temporary interruptions. This dynamic is closely linked to the growth of hacktivism (in English hacktivism), or politically or ideologically motivated attacks that use the cyberspace as a new battleground. And Italy has become a privileged target – especially by Russian hackers – for those who want to send messages, attract media attention, or put pressure on institutions and governments.
Artificial intelligence changes the rules of the game
2025 also marks a technological turning point. "The most significant change that we are observing in cybercrime it concerns the use of artificial intelligenceWe are no longer just talking about more credible phishing, but about attacks capable of autonomously adapting to the context and the victim", explains Andrew Monti, General Manager of Tinexta Cyber. “During 2025 we observed the first case of extortion attack generated entirely by an AI model, capable of modulating messages, timing, and methods based on the target's reactions: an evolution that radically changes the threat landscape." According to Monti, in the coming years, the use of generative models trained on real data stolen during breaches will make attacks increasingly targeted, contextualized, and difficult to detect.
The economy of stolen credentials
2025 was also the year of the big data theftsHackers no longer force entry into systems, but “log in directly”, exploiting legitimate identities and access. There are approximately circulating in the world 15 billion stolen credentials and, in 2025 alone, those compromised and resold on illegal markets increased by over 40%, equal to approximately 6 billion more.
It has strengthened the role of “Initial Access Brokers”, intermediaries specialized in the sale of stolen credentials, while the internal resource of the company, aware or manipulated, remains a key access vector.
“The picture is clear – concludes Monti – the Cybersecurity is no longer just a technical issue, but a strategic factor which impacts the economy, essential services, and trust." In this context, new European regulatory frameworks such as NIS2 and DORA are not simple obligations, but tools designed to strengthen the resilience of the economic system and the country.
