Italian authorities dismantled a Russian espionage network in Rome that aimed to gather information on Western air defense systems provided to Ukraine, Defense News reported.
A Russian spy ring in Italy
Italian police surveilled a suspected officer of the Russian Main Intelligence Directorate (GRU) during interactions with an informant. The investigation recorded requests for data regarding the European Samp-T system, which has been transferred to Kyiv, and the Michelangelo Dome, an air defense system developed by the Italian company Leonardo that is scheduled for testing in Ukraine in November.
JOIN US ON TELEGRAM
Follow our coverage of the war on the @Kyivpost_official.
Investigators tracked the Russian national, identified as Mikhail Astakov, a military attache at the Russian embassy in Rome. Astakov held meetings with Gavino Piras, a 59-year-old former employee of the Italian secret service. Piras was arrested this week alongside another former Italian intelligence worker.
According to the investigation, Piras recruited informants within the Italian military to provide classified information requested by Astakov. Five suspected informants are currently under investigation.
Court documents state that Astakov provided Piras with lists of information requests during clandestine meetings. In exchange, Astakov received microSD cards containing the gathered data, which were left in a designated dead drop in a wall. Astakov paid €4,000 ($4,500) in cash for each data package.
The espionage requests focused on European assistance to Ukraine’s defense against missile and drone attacks. In addition to the Samp-T system, Astakov requested information on the MBDA CAMM-ER air defense missile, which Ukraine plans to assemble domestically, and the Michelangelo Dome system. Leonardo executives stated the Michelangelo Dome features an open architecture enabling partner countries to integrate existing air defense assets.
Ukrainian Forces Strike Syzran Oil Refinery, 10 Tankers and 4 Ferries
A September 2025 request sought intelligence on the effectiveness of strikes on Iranian nuclear facilities, damage to the program, and prospects for resuming operations.
The request also covered Italy’s plans to purchase Storm Shadow missiles, rearmament plans of Italy, the EU, and NATO, EU defense policy priorities, and assistance to Ukraine in developing long-range missiles. Astakov also requested data on an underwater drone Leonardo is testing in La Spezia, Italy.
Court documents indicate Piras informed the Russian attache that British, rather than Italian, intelligence assists Ukraine in executing long-range strikes on Russian oil facilities. Piras also reported that Italian specialists were analyzing the structure of a Russian T-90 tank, specifically noting they did not understand the autonomous operation principle of its mounted machine gun. Piras stated that if the specialists managed to extract this information, they would do so.
In April 2025, Astakov requested information on Avio, an Italian engine manufacturer, months before the company partnered with the US Army to supply solid-propellant rocket motors.
Following Piras’s arrest on Tuesday, his lawyer denied that Piras transferred classified information to Russia. On Thursday, the Italian government announced the expulsion of two military attaches from the Russian embassy, including Astakov.
Italian Foreign Minister Antonio Tajani stated that Moscow continues to utilize hybrid warfare against the West and Italy, characterizing the actions as interference in Italian institutions and national security.
Cyber espionage and logistics monitoring
The espionage arrests in Italy coincide with reports of Russian cyber operations targeting the logistics of Western military aid. Russian state-affiliated hackers compromised internet-connected security cameras and home intercom systems across NATO member states and Ukraine to monitor military transport.
The General Intelligence and Security Service (AIVD) and the Military Intelligence and Security Service (MIVD) of the Netherlands reported that the cyber operation targeted IP cameras located along established logistical routes used to transport military equipment to Kyiv. The operation aimed to collect intelligence regarding the types and volumes of weaponry supplied to Ukrainian forces.
“Organizations with IP cameras on these routes have already been warned so they can take action,” the Dutch intelligence services stated.
The intelligence assessment noted that hackers exploited vulnerabilities in consumer and commercial camera networks. The Dutch intelligence report indicated that internet-connected devices, such as home intercoms, often lack sufficient security protocols.
“When an IP camera is identified, an attacker can try to gain access to it via the internet,” the report stated. “This is often relatively easy, as many IP cameras connected to the internet are insufficiently protected.”
Hackers utilized standard factory-default passwords, outdated software, and unpatched firmware to gain access. This allowed Russian intelligence to monitor ground movements without deploying conventional drones or satellite imagery.
Recent investigations indicate that Russia is pursuing capabilities to counter Western logistical and communication networks. A joint report by The Insider, Der Spiegel, and Le Monde stated that Russia and China held discussions regarding plans to disrupt the US-operated Starlink satellite communication system.
You can also highlight the text and press Ctrl + Enter
