University of Turin under cyberattack: pro-Russian hackers launch DDoS blitz on Italian institutions

Table of contents

• A coordinated attack on Italy’s digital infrastructure
• The method: flood the servers, block the users
• Who’s behind the attack?
• Other Italian targets under fire
• Cyber security response and next steps

A coordinated attack on Italy’s digital infrastructure

The University of Turin has become the latest target of a cyberattack that’s part of a broader campaign by pro-Russian hacker groups. On June 13, 2025, a DDoS (Distributed Denial of Service) attack hit the university’s website, disrupting access to services. Despite the pressure, the site remained partially functional thanks to its internal cyber defense systems.

Police sources confirm this is part of a broader series of attacks on Italian strategic targets, including public authorities and companies linked to the defense sector.

The method: flood the servers, block the users

The attack was carried out using a DDoS strategy, in which hackers flood a website with fake traffic until it becomes inaccessible to real users. At the University of Turin, the attack aimed to block access to staff accounts, a goal only partially achieved due to prompt reaction from the university’s digital security team.

Who’s behind the attack?

Three hacker groups have been identified:

• NoName057(16), active since the start of the Ukraine war
• Dark Storm, reportedly aligned with pro-Palestinian causes
• Mr Hamza, already known for past cyber incursions

These groups operate through international botnets, launching coordinated traffic floods at selected targets. The timing just one day after the university elected its first female rector has led many to believe the incident may have a symbolic and political motivation as well.

Other Italian targets under fire

The hackers also targeted local government websites and defense supply chain companies in at least four Italian regions. Though none of the sites suffered long-term shutdowns, the attacks clearly show an intention to undermine Italy’s digital infrastructure.

Cyber security response and next steps

Thanks to the university’s responsive defense system, major damage was avoided. The internal IT team is currently analyzing data logs and reinforcing countermeasures. Meanwhile, law enforcement and cybercrime units are working to trace the malicious traffic and identify the networks involved.

Questions and answers

1. What kind of attack hit the University of Turin?
   A DDoS attack that floods servers with fake traffic.
2. Who are the perpetrators?
   Pro-Russian hacker groups like NoName057(16), Dark Storm, and Mr Hamza.
3. Was the university website offline?
   It was slow and temporarily inaccessible at times.
4. Were other targets affected?
   Yes, local administrations and companies in the arms industry were also attacked.
5. Any permanent damage reported?
   No. Thanks to prompt cyber security response, major impacts were avoided.
6. Why was the university attacked now?
   Possibly due to the recent election of its new rector or symbolic targeting of public institutions.
7. How does a DDoS attack work?
   By overloading servers with excessive traffic, making them unusable.
8. How did the university respond?
   It immediately activated its cyber security team to contain the threat.
9. Is this an isolated event?
   No, it is part of a coordinated campaign targeting multiple institutions in Italy.
10. What actions are being taken?
    Security logs are being analyzed, defenses reinforced, and investigations launched by authorities.