Flash Report: Sabotage and Cyber Disruptions at Milano Olympics

Key Findings

• The Russian Federation has a history of targeting the Olympics with cyberattacks as revenge for its formal exclusion from the Games (such as in the Paris 2024 Summer Olympics). With Russian athletes once again slated to compete as Individual Neutral Athletes rather than represent the country and the added factor of Italy’s continued support for Ukraine,¹ Russia-aligned hackers are likely to continue targeting the cyber infrastructure of the 2026 Winter Olympics.
• Pro-Russian hacktivists are very likely to continue conducting low-impact attacks targeting Olympics-related events and states that oppose Russia’s participation in the Games.
• Protests, travel disruptions, and acts of sabotage targeting transportation infrastructure have also taken place and are likely to continue through the Games.
• There is a roughly even chance that these efforts will result in minor disruptions to the event, dissuade spectators from attending, and lead to reputational damage for the host and the International Olympic Committee (IOC).

Details

ZeroFox has observed politically motivated, primarily pro-Russian threat actors overtly targeting the 2026 Winter Olympics since they began. Z-Pentest and NoName057(16)—two of the most active pro-Russian hacktivist groups—have claimed responsibility for the majority of these attacks.² These groups employ easily disseminated and replicated tactics, techniques, and procedures (TTPs), which enable widespread adoption and a consistently high rate of attack.

• Both Z-Pentest and NoName057(16) have largely stuck to their preferred attack types. Z-Pentest has primarily carried out intrusions into operational technology (OT) or industrial control systems (ICS), while NoName057(16) has launched dozens of distributed denial-of-service (DDoS) attacks.

Prior to the Olympics, several pro-Russian hacktivist groups claimed access to various CCTV or security camera systems in target countries, which NoName057(16) has replicated during the Olympics.³ ZeroFox has observed the group posting photos claiming access to various cameras throughout Italy. These cameras do not appear to be civilian security cameras that are operationally significant, which suggests this attack vector is likely intended as an intimidation tactic.

As of reporting, the attacks have been low-impact, which aligns with these groups’ level of sophistication. Historically, pro-Russia hacktivist groups have demonstrated limited capabilities and have relied on opportunistic methodology, targeting vulnerable internet-facing devices. Their low level of technical knowledge often results in haphazard attacks in which the threat actor intends to cause damage but cannot anticipate the real impact. Although pro-Russia hacktivists have occasionally damaged critical infrastructure, they often exaggerate their capabilities and the impact of their attacks to garner more attention.⁴

• Regardless of the true outcome, pro-Russia hacktivist groups post images or screen recordings of the attacks to their social media platforms, boasting and exaggerating the impact to garner increased attention.
• On February 7, Z-Pentest claimed an intrusion into an unidentified Heating, Ventilation and Air Conditioning (HVAC) climate control system “located in Italy”.⁵ The lack of details suggests this is a low-level target that would not directly impact the Games and reflects Z-Pentest’s low sophistication and opportunistic targeting. Rather than conducting a methodical campaign to target the Olympics, Z-Pentest likely used relatively unsophisticated tools to search for vulnerable Virtual Network Computing (VNC) devices in Italy.

Russia’s geopolitical strategies will almost certainly ensure these attacks continue on a frequent basis throughout the remainder of the Games. Russia very likely aims to retaliate against perceived support for Ukraine and the IOC ban on Russian athletes competing.

Italy’s status as a NATO member state presents an increased risk to Italian entities, as pro-Russian threat actors very likely seek to embarrass and disrupt supporters of Ukraine. 

• In one incident, NoName057(16) claimed to have targeted the websites of Spanish, Lithuanian, and Polish Olympic Committees alongside Sea Aeroporti di Milano.⁶

Protests and Transportation Disruptions

Several smaller anti-Olympics protests took place in the lead-up to the opening ceremony, culminating in a much larger demonstration on February 7 in Milan. In the days before the Games formally began, small groups of demonstrators held protests in towns throughout Italy as the Olympic torch relay passed through. These protests predominantly denounced Israel’s participation in the Games and the alleged environmental impact of the Olympics.⁷

• On February 7, the day after the opening ceremony, a much larger protest organized by the Comitato Insostenibili Olimpiadi (CIO) group took place in Milan and saw thousands of participants. While most demonstrators were peaceful, a group of several dozen masked individuals shot firecrackers and threw bottles at police as the march wound down at nightfall.⁸ The incident drew condemnation from Italy’s prime minister.

Besides protests, the Games have also seen disruptions from the sabotage of railways by self-described anarchist groups. 

• On February 7, saboteurs damaged railway infrastructure in three different locations across northern Italy, leading to delays of up to two and a half hours. A self-described anarchist group subsequently claimed responsibility, alleging that the action was precipitated by the passage of a new security law giving police the authority to proactively arrest individuals suspected of planning violent or disruptive acts. The group’s statement implied that additional actions were likely planned.⁹
• On February 11, the Lecco-Tirano rail line in northern Italy suffered another act of sabotage.¹⁰

There is a roughly even chance of additional protests against the newly passed security law during the Olympics; these additional protests are almost certain to occur in the coming weeks.

Conclusion

ZeroFox assesses that further efforts to disrupt the Games are very likely. Geopolitically motivated cyber threat actors such as NoName057(16) and Z-Pentest are conducting attacks daily, while transportation strikes have been announced for February 16 and in the days following the Olympics when Olympics-related travel will likely still be occurring. However, authorities have likely prepared for these low-level disruptions, which have occurred at previous Olympic games. However, more sophisticated attacks from state-backed advanced persistent threat groups cannot be ruled out. Meanwhile, deliberate acts of sabotage, like those along northern Italian rail lines are likely to prove more disruptive, as they occur without warning and the damage to physical infrastructure is less easily repaired.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 11:45 AM (EST) on February 13, 2026; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

ZeroFox Intelligence Probability Scale 

All ZeroFox intelligence products leverage probabilistic assessment language in analytic judgments. Qualitative statements used in these judgments refer to associated probability ranges, which state the likelihood of occurrence of an event or development. Ranges are used to avoid a false impression of accuracy. This scale is a standard that aligns with how readers should interpret such terms.

1. hXXps://www.themoscowtimes[.]com/2026/02/12/at-milan-cortina-winter-olympics-russian-athletes-are-a-diminished-presence-a91929.
2. hXXps://t[.]me/zpentestalliance/1058
3. ZeroFox Intelligence
4. hXXps://www.cisa[.]gov/news-events/cybersecurity-advisories/aa25-343a
5. ZeroFox Intelligence
6. hXXps://x[.]com/FalconFeedsio/status/2020835161819202017
7. hXXps://www.instagram[.]com/p/DTyXUBQiERI/
8. hXXps://www.aljazeera[.]com/news/2026/2/8/italys-meloni-condemns-anti-olympics-protesters-in-milan
9. hXXps://www.reuters[.]com/world/anarchists-claim-responsibility-rail-sabotage-during-italy-olympics-2026-02-09/
10. htXXs://milano.corriere[.]it/notizie/cronaca/26_febbraio_11/olimpiadi-sabotaggio-sulla-linea-ferroviaria-lecco-tirano-che-porta-a-bormio-e-livigno-a-fuoco-con-una-molotov-7-cavi-di-una-7e63cf4f-1e63-4fbf-9867-92d5ce2c9xlk.shtml
11. htXXs://milano.corriere[.]it/notizie/cronaca/26_febbraio_11/olimpiadi-sabotaggio-sulla-linea-ferroviaria-lecco-tirano-che-porta-a-bormio-e-livigno-a-fuoco-con-una-molotov-7-cavi-di-una-7e63cf4f-1e63-4fbf-9867-92d5ce2c9xlk.shtml