Italian Ministry of Defense Issues Report – and Warning – on Hybrid War

Italy’s Ministry of Defense warns that Russia, Iran, China and North Korea are engaged in coordinated offensive actions designed to fall below a level requiring armed responses by those attacked.

As the report, Il Contrasto Alla Guerra Ibrida is published in Italian, a synopsis is provided:

Synopsis: Italian Ministry of Defense Non-Paper on Countering Hybrid Warfare

This November 2025 document from Italian Defense Minister Guido Crosetto presents a comprehensive analysis of hybrid threats facing Italy and the West, with urgent calls for systemic reform.

Context and Threat Assessment

Hybrid warfare represents coordinated actions across multiple domains by state and non-state actors operating below armed conflict thresholds. According to various analyses cited, principal actors include:

• Russia: Engaged in sabotage, disinformation, political influence, cyberattacks, mercenary use, and weaponization of migration
• China: Employing multi-vector strategies combining economic, technological, informational, and diplomatic leverage to weaken the EU
• Iran: Using regional proxies (Houthis, Hezbollah) and cyber coercion at maritime chokepoints
• North Korea: Conducting cyber operations including ransomware and cryptocurrency theft

Italy faces particular vulnerabilities in energy dependence, critical infrastructure protection, and its political-social ecosystem.

Key Characteristics and Domains

Hybrid threats exploit “plausible deniability” through proxy actors, making attribution difficult. They target democratic processes through election interference, disinformation campaigns, and social polarization. Primary operational domains include:

• Cyberspace: Italy managed 1,979 cyber events and 573 confirmed incidents in 2024 (up 40% and 89% respectively)
• Information manipulation: Deepfakes, micro-targeting, and AI-generated propaganda
• Geo-economic coercion: Export controls on critical materials, strategic acquisitions, debt-trap diplomacy
• Logistics chokepoints: Red Sea/Suez vulnerabilities affecting 40% of Italian maritime commerce
• Gray-zone military activities: Airspace violations, mercenary operations, GPS jamming

Case Study: Russia-Ukraine Conflict

The document extensively analyzes Russian hybrid operations, including the 2024 Doppelgänger campaign (fake news sites mimicking Le Monde, Der Spiegel, La Repubblica), 37 major sabotage events across Europe, weaponized migration from Belarus, and interference in Romanian elections leading to their cancellation.

Major Problems Identified

1. Organizational gaps: Inadequate cyber forces (currently minimal vs. needed 5,000 personnel)
2. Reactive posture: Western democracies respond slowly while adversaries act continuously
3. Attribution challenges: Difficulty proving state responsibility limits responses
4. Democratic vulnerabilities: Consensus-building delays enable adversary exploitation
5. Fragmented response: Lack of whole-of-government coordination
6. Insufficient deterrence: Adversaries perceive minimal consequences for hybrid attacks
7. Critical dependencies: Over-reliance on external suppliers for materials and energy
8. Technology gaps: Adversaries exploiting AI, autonomous systems faster than defenses

Key Recommendations

National Level:

• Define national cyber operational space for defense operations
• Create a Cyber Force of 5,000 personnel (initial goal: 1,200-1,500) with 75% operational capacity
• Establish functional protections for cyber specialists
• Create a Center for Countering Hybrid Warfare for coordination and strategic communication

European/International:

• Establish a European Center for Countering Hybrid Warfare
• Develop permanent EU monitoring/response mechanisms
• Strengthen digital literacy and civic education programs
• Enhance NATO-EU-G7 cooperation on hybrid threats
• Implement proactive rather than reactive defense strategies

Operational:

• Shift from “containment” to “proactive defense” posture
• Integrate cyber with electromagnetic and cognitive domains
• Develop multi-domain operational capabilities
• Accelerate decision-making processes
• Strengthen critical infrastructure protection with integrated cyber-physical approaches

Conclusion

Minister Crosetto emphasizes urgency with the phrase “hybrid bombs continue to fall” daily against critical infrastructure, decision-making centers, and essential services. The document argues that just as nations defend airspace, territorial waters, and land borders, they must now actively defend cyberspace with legitimate, timely reactions. The time to act, the Minister concludes, is “now.”

Note: Synopsis created with assistance from Claude (Anthropic), cross-checked in Perplexity for accuracy