Pasdaran, Islamists, KGB and misogynistic groups: the thousand signatures behind the hybrid war on Italy and Europe

The text is almost identical. The signature changes. The email that triggered the bomb scare in 6,000 Italian schools yesterday morning repeats, in many passages, the one that arrived on November 2nd in 271 institutions. But under the same threats two opposite identities emerge: then the Iranian Pasdaran, yesterday a self-styled leader with a Russian surname, the same as a former head of the KGB.

It is on this terrain, where identities multiply and claims become confused, that the security apparatus of the Aisi and the Aise, the National Cybersecurity Agency and the judicial police, from the Post Office to the Digos, move. Who is behind the emails that are alarming the country? There is no clear answer, for now. The most accredited lead remains the Russian one, as Foreign Minister Antonio Tajani recalled, referring to actions coming from the East. But in hybrid warfare, intelligence analysts believe, giving a name to the perpetrator is very difficult, even more so when cyber actions by China, North Korea and Iran also overlap and mix against the West. This is demonstrated by the case of supermarket refrigerators and the blood bank in France: Paris attributes the attacks to Tehran, while in Italy actions of the same type were claimed and attributed to pro-Russian hackers. Same technique, two apparently different matrices. Not necessarily a common direction.

The plot also emerges from the emails. The one of 11 November, signed "Mikhail Andropov", and the one of 2 November, attributed to the "Iranian Pasdaran", practically follow the same script: explosive hidden in a plastic bag, remote detonator, survivors to be finished off "with stabs". Even the word that introduces this last threat is identical: "After that". The new message adds "genocide against Italians" and a bomb in Prime Minister Giorgia Meloni's car. Same words, different signatures. A single hand that changes identity? Or an imitation built to mislead?

And the signatures tell an even more intricate story. «Mikhail Andropov» had already appeared on 6 November in the threats delivered to the Irish public television Rté and the Bulgarian Nova TV. He presented himself as one of the leaders of the group responsible for the false bomb scares on European flights. The same alarms that on November 5, at least in Italian airports, bore the signature of the "fighters of the Male State", an acronym that refers to a Russian misogynist movement. And Andropov is not just any surname: Yuri Andropov led the KGB before rising to the top of the Soviet Union. The subject of the emails sent to television stations also refers to him, "Message to the West", which recalls the title of one of his biography published in the United States in 1983.

But the Russian and misogynistic one is not the only mask. In the previous weeks, the threats to schools had taken on another face: Islamist. On 19 October at least fifty Italian institutes received an email with the subject "Death is near". The address imitated that of the Saudi Ministry of Education, the message announced attacks "with the permission of Allah". At the same time, similar threats reached hundreds of schools in Northern Ireland, Scotland and Serbia. And some editorial offices in Hungary. Then, on November 2, the email almost identical to yesterday's, but signed by the "Islamic Revolutionary Guard Corps", the Iranian Pasdaran. Now the references are mixed again. In yesterday's email Andropov appears to be wearing both masks and proclaims himself the leader of the «Vilayat of Misoginistan». Vilayat is the term used by the Islamic State to indicate its provinces. Misoginistan, the "land of misogynists", instead recalls the Male State and the Russian radical group. The result is a signature that mixes Islamist references and Russian misogyny.