Small countries on the world map are big targets for cybercriminals. This is the strange case of Italy, which in 2023 confirmed itself as the European country most affected by malware attacks. It came fourth globally, behind Japan, the United States, and India. This was revealed by the study Calibrating Expansion: Annual Cybersecurity Threat Report by Trend Micro, a cybersecurity company that protects more than 500,000 companies and employs 7,000 people in 65 countries.

A useful overview to understand the growth of hacker attacks, the solutions with which companies defend themselves, and the limits they must overcome to improve protection, the report lists many numbers that show how Italy is still lagging behind in the search for effective countermeasures to cybercriminal threats. A giant problem because the continuous increase in attacks combined with their greater quality has convinced cybersecurity teams that the point is no longer to defend oneself to avoid being hit but to defend oneself to be ready when the attack comes. Because it is only a question of when, not if, it will come.

Alarming numbers

If malware represents the most widespread threat to Italian companies, the other numbers outline a critical context that can only be improved with an immediate and collective response. The reason is quickly stated. With 8,343 attacks, Italy is the seventh most affected country in the world for macro malware, while last year, 19,632 ransomware attacks have damaged companies and users in the country. 206,694717 email threats arrived on Italian organisations in 2023, although there are those in Europe who are far worse off, such as the Netherlands and Germany, the third and fifth worst-hit countries in the world, with 1,222,110,043 and 1,101,398,365 attacks suffered.

In Italy, the number of malicious applications downloaded during the year was also high, at 165,879,889. There were 12,233,257 visits to malicious sites, with 126,777 of these hosted in the country being blocked permanently. Expanding the horizon, however, Trend Micro in 2023 blocked a total of 161 billion threats, registering a 10% increase over the previous year.

Analysing the numbers in this and other reports on the subject, such as the Clusit Report 2024 produced by the Italian Association for Information Security, the most worrying fact is the continued growth in the incidence of attacks aimed at Italian companies compared to companies in other countries. In 2022, attacks against Italian targets were 7.6% of the total sample; in 2023, the share rose to 11.2%. This is a growth to reflect on because it has been constant since 2019 when this figure was 2.2%. It also testifies to how company improvements are proceeding at a slower pace compared to the speed with which cybercriminals increase their attacks in quantitative and qualitative terms.

The sectors most impacted by cyber-attacks in Italy are healthcare and banking, closely followed by public administration and manufacturing. The latter, in particular, is a critical area for our country, as a significant portion of our small and medium-sized companies operate in this sector. Their size often translates to limited financial resources and a lack of cybersecurity expertise, making them more susceptible to attacks and less capable of identifying vulnerabilities in their security infrastructure. These are vulnerabilities that hackers are well aware of, making Italy a more attractive target than other European countries.

Sophisticated attacks

The Trend Micro report also noted how cybercriminals’ tactics are changing. They are relying less on generic phishing campaigns to target selected profiles. Attacks that involve the user reacting by clicking on malicious links in emails or redirecting to websites have been partly overcome in favour of more sophisticated and specific offensives to deceive a smaller circle of targets. This is a way of circumventing network and email filters, resulting in more malicious files on endpoints. 

The only remedy for a problem that is already enormous and destined to remain so in the future is to be prepared, culturally before than technically, because the second aspect is a consequence of the first. Many companies realise that allocating part of the budget to investments in technology to safeguard the security infrastructure is a priority on the same level as the investments required for the company’s operations.

Monitoring assets and securing them, along with monitoring cloud applications, is one of Trend Micro’s recommendations to identify system vulnerabilities and ensure the Security Operation Centre is effective. Constantly checking that operating systems and applications are up-to-date with the latest releases and using comprehensive security protocols to control and tighten configuration settings, control application access, and improve account and device security are other key aspects of keeping your network secure and responding immediately to an attack because the response time depends to a large extent on the possibility of limiting the damage or sending the breach attempt back to the sender.