Hybrid warfare is discussed every day in terms of states, armies and alliances. Much less is said about what it means for businesses, which are not parties to that conflict but sit on the ground it crosses: any company tied to a larger organisation, as a supplier or as a customer, or to a plant or an essential service, can become the way in to someone more important than itself.
What the institutions say
The Italian Ministry of Defence's non-paper (November 2025), an informational document signed by Minister Crosetto, defines the hybrid threat as a set of coordinated actions, carried out by state and non-state actors, below the threshold of armed conflict and often impossible to attribute.
The text describes it as an ongoing process whose targets include critical infrastructure, decision-making centres, essential services, commercial facilities, industry and supply chains.
For Italy, the document reports figures from the national cybersecurity agency (ACN): in 2024 cyber events grew by 40% and incidents with confirmed impact by 89%; in the first half of 2025 the increases were 53% and 98%. Among the sectors hit hardest it singles out manufacturing, where small and medium-sized businesses without adequate defences prevail: "our small companies are easy targets". The main compromise vector remains spearphishing.
For Defence supply chains, the text calls for stronger cooperation between public and private sectors, also to reduce the risk of industrial espionage.
Who acts, and why
The document names Russia, China, Iran and North Korea as the main actors, with different motivations (for a complete picture, we include those that are not directly about cyber):
Russia acts for war-related reasons: to undermine the cohesion of the Western front backing Ukraine, through sabotage, cyberattacks and disinformation, hitting energy and supply chains.
China pursues long-term economic and technological goals: acquiring strategic know-how and penetrating critical infrastructure and supply chains. It would aim at a weaker, more fragmented West, but with a stable, open European market to exploit.
Iran uses regional proxies and cyber tools, at a low profile, to put pressure on maritime chokepoints and destabilise strategic areas.
North Korea relies on ransomware, cryptocurrency theft and digital espionage to fund the regime.
These goals are pursued in two ways, which often overlap.
The first is operations run directly by states, through intelligence units. One documented case is Sandworm, unit 74455 of Russian military intelligence (GRU): in 2020 US authorities indicted six of its officers for the attacks on Ukraine's power grid in 2015 and 2016 and for NotPetya.
The second is murkier. Cybercriminal organisations operate from countries that tolerate or protect them, and so have a free hand against Western targets: the unwritten rule is not to hit at home or among allies, in exchange for the state's silence (The Parallel System covers this).
For the victim, the distinction is invisible: whoever is behind it can look like an ordinary criminal. The motivations change, the method does not: go in through whoever is least defended and easiest to attack.
What has been seen
Ukraine. On 24 February 2022, at the dawn of the invasion, an attack on Viasat's KA-SAT satellite network knocked thousands of modems out of service, including some used by Ukrainian military and government bodies, causing a serious loss of communications. The access began with a misconfigured VPN device in the provider's management network, from which the threat reached its customers' modems. The effects did not stop at the border: tens of thousands of users across several European countries were hit, and in Germany remote monitoring and control of about 5,800 wind turbines stayed down for weeks. On 10 May 2022 the United States, the United Kingdom and the European Union attributed the attack to Russia, which has always denied it.
The route: from small to large
The final target is not always critical infrastructure or an institution. It can be a large company that is not strategic in the strict sense, but whose name carries weight: hitting an iconic Italian brand does not endanger national security, but it is an enormous image event, certainly destabilising for public opinion.
Whoever wants to reach one of these targets meets strong defences, dedicated budgets, security teams. Its suppliers often have none. So the most convenient route is rarely a frontal assault: it goes through someone who already has legitimate access. A maintenance supplier, a customer with access to your systems, an IT service provider, the professional firm that handles confidential data, the logistics operator... It has a documented history.
Volt Typhoon. According to an advisory from US and allied security agencies (February 2024), a Chinese group positions itself in energy, communications, transport and water networks so it can disrupt their functions in a crisis. Among the victims are small organisations that provide services to larger ones; in some environments the access lasted at least five years.
Cloud Hopper. In 2018 the US Department of Justice indicted two people linked to the APT10 group, attributed to a unit of China's Ministry of State Security. By breaching managed service providers (MSPs), the group reached their customers' systems in at least twelve countries.
The mechanism is the flow of information. Every day, invoices, orders, quotes, technical documents, shared files and payment requests pass between a business and its suppliers and customers: expected exchanges, with known people, over channels that are already open. If a threat takes control of a supplier's mailbox, it can send a genuine invoice, in the usual format, to someone who is waiting for it: with an infected attachment, a link, a changed IBAN. Nobody suspects it, because it comes from someone used to writing. There is no door to force: it is enough to slip into a flow nobody is watching.
IT suppliers can be a bridge too, and a more powerful one: IT support firms, MSPs, vendors of business software, integrators who connect machinery. Beyond documents, they have direct access to customers' systems, maintenance accounts, management tools and signed updates. Compromising one of them means a clear road to all of its customers: the relationship is one to many. In the 2026 Verizon report, breaches involving a third party account for 48% of the total, up from 30% the year before: an increase of 60%.
How it concerns you
So far, the scenario as described by the institutions. What remains is what it means for those who run a business.
The question is no longer just "am I big enough to be of interest?", but also "where do I sit in the supply chain?". There are three ways of being involved. You can be the target, if you belong to a strategic sector or supply chain, or if you are a name whose visibility makes you attractive. You can be the go-between, if you work for someone who is: the road to the big company runs through you. You can be collateral damage, if you end up within reach of an operation aimed at someone else. In all three cases, position matters more than size. Here is how it changes, depending on who you are.
If you supply larger companies
Maintenance, plant, services, software, logistics: for whoever is preparing an operation, your value lies in what you can touch. Remote access to a customer's systems, a maintenance account, credentials your customer gave you, an update you send. It is the door nobody questions, because it belongs to a known supplier. The real risk is that someone comes in through you to reach your customer. And it is a risk that better-organised customers cannot ignore: the NIS2 directive, transposed in Italy by Legislative Decree 138/2024, requires organisations within its scope to manage supply chain security, and so to demand guarantees from those who supply them with products and services. If it happens, your customer will hold you to account even if you were not the target, and the damage will be contractual and reputational before it is technical.
If you are an IT provider or an MSP
For you, the one-to-many relationship is literal: a single compromised access to your management tools can open dozens of customers. Cloud Hopper is exactly this. The risk is not only being breached: it is your environment becoming the passage to everyone else. Three things matter: who has access to your management tools, with which credentials, and whether you would notice.
HOXEY made the opposite choice: we have no access to the devices installed in our customers' networks, as the Hoxey Security Model explains.
If you have plant or machines connected to the network
Industry, energy, construction, logistics and, increasingly, agriculture. If you have controllers, machines or plant reachable remotely, the risk is not only losing data, it is stopping real things.
In the Viasat case, one misconfigured VPN device was enough to reach customers' modems. Devices like this are found in small companies too: no sophisticated techniques are needed, just missing basic defences.
With Shodan you can see which of your devices are reachable from the internet: the article shows how, with an example you can repeat. The basic measures are in Practical Hardening and Resilience tips.
If you are in an exposed sector
Energy, transport, telecommunications, finance, healthcare: these are the sectors the non-paper identifies as critical infrastructure, because hitting just one can put the whole country in difficulty. The perimeter does not stop at the big names: around each one is a network of smaller suppliers, for maintenance, IT integration and operational technology. Public sources hold no Italian data on how many incidents pass through them: it is a reasonable inference, not a figure. As noted, NIS2 requires these organisations to manage their relationships with direct suppliers as well: whoever works for them will be asked.
What holds for everyone
The problem is not only blocking the entry. Volt Typhoon stayed inside for years, using tools already present in the systems and selectively deleting logs. An operation prepared well in advance is, by definition, something that was already there beforehand. What matters is how long someone has been there and whether you noticed. The logic of a threat that has time is told in Mighty Walls. No Alarm.
There may be no ransom. NotPetya, the malware spread in 2017 through Ukrainian accounting software, looked like ransomware but destroyed data. When a state is behind it, the ransom note can be just a cover, and paying brings nothing back. In that case what counts is having backups that work and that someone has actually tried to restore.
Who is behind it does not change the damage. A military unit, a criminal on contract or both: for the victim the result is the same, and you are the one who has to answer to your customers.
Four questions to ask yourself
- Which suppliers and collaborators have access to my systems, and with which credentials?
- Whose systems do I have access to, and what would happen if someone used my access?
- Which routers, VPNs and devices have I forgotten that are out of date or still on factory credentials?
- If someone were already inside, what would tell me, and when?
For a business, the question is not how high the wall is, but what, in your network, would make visible whoever is already inside.