“To assess whether a coordinated campaign is taking place, converging indicators are needed: similarities in the wording of the messages and methods of distribution, recurrence over time, links between digital infrastructures or groups involved in disseminating the messages, synchronization with other actions, and the deliberate amplification of fear,” he added.
That distinction is particularly important as Europe faces simultaneous security tensions associated with Russia’s war in Ukraine and the confrontation involving Iran, Israel and the United States.
The events of recent days illustrate how relatively inexpensive threats can impose substantial operational and economic costs.
On November 5, an Aer Lingus flight traveling from Dublin to Rome was diverted to a French military airbase following a bomb warning. Other flights involving Italy, Poland, Spain, Bulgaria and several European capitals were subjected to security checks. Italian fighter jets were also scrambled to escort a Finnair aircraft traveling from Helsinki to Rome.
By the end of that day, nearly 30 flights had been affected by the latest wave of warnings. Authorities reported no confirmed explosive devices.
The November 11 school threats appeared to follow a similar disruptive pattern, this time affecting an even more sensitive civilian environment.
The email circulated in Italy was signed by a purported individual identifying himself as Mikhail Andropov, leader of the so-called Vilayat of Misoginistan. The same name had appeared in threats sent to media organizations in Ireland and Bulgaria days earlier. Investigators have not established whether the sender’s claimed identity reflects the actual perpetrators.
“Targeting schools can maximize fear, media attention and pressure on the authorities, while involving relatively low costs and operational risks,” Garofalo explained.
Nima Baheli, an Iranian-Italian political analyst, similarly questions whether the methods employed necessarily indicate an operation conducted by sophisticated state intelligence or cyber units.
“Many of these attacks, whether those occurring today in Italy, in Rome, in schools, or those involving airplanes, are very simple attacks. They are not attacks that require significant cyber capabilities, such as those that Russia or China possess. They could also be carried out by very small entities or individuals interested in creating a situation of widespread disruption and damage,” he told The Media Line.
Baheli argues that the limited technical sophistication of the threats could support alternative explanations, including actions undertaken by smaller groups or domestic actors rather than foreign governments.
“We are in a context in which we do not know. There could also be interpretations linked to internal politics, following various upheavals and clashes in Italy, France or even Germany. At this point, I would not exclude an internal explanation involving entities or organizations that took part in these clashes and that, given the simplicity of the threats, could have carried them out,” he noted.
His assessment is speculative and has not been substantiated by investigators.
Beyond aviation and education, attacks on commercial refrigeration systems have highlighted another dimension of Europe’s security concerns.
France, others attribute attacks to IRGC, islamists
On October 11 and 12, cyberattacks disrupted refrigeration systems at hundreds of French supermarkets, reportedly manipulating temperature controls and forcing retailers to discard perishable products.
On November 9, French Foreign Minister Jean-Noël Barrot publicly attributed the attacks to Iran’s Islamic Revolutionary Guard Corps (IRGC). Paris summoned the Iranian ambassador the following day and warned that it could pursue European sanctions and other countermeasures. Tehran rejected the accusations, describing them as baseless and hostile.
The French accusations represent a significant diplomatic escalation. On November 9, France’s Cyber Crisis Coordination Center published a five-page report identifying Shahid Kaveh, an IRGC-linked cyber unit, as responsible for the October attacks. The report presented technical findings supporting France’s attribution, although Tehran continues to reject responsibility.
Baheli questioned whether the publicly available evidence was sufficient to establish Iranian involvement.
“At the moment, we do not have the data provided by the French explaining why they directly accused Iran. I hope that, when they identified Tehran as the source, they had evidence in hand that they have not yet made public, which would allow us to understand the situation more clearly,” Baheli said.
“However, what they mentioned – the ID, Persian scripts or other elements – does not seem so straightforward at the moment. Someone who simply wants to divert suspicion from themselves would have no particular difficulty using a VPN to modify an ID or inserting scripts in another language,” he added.
Baheli distinguishes between cyber operations against strategic infrastructure, where geopolitical motivations may be more apparent, and attacks against commercial systems that could also involve criminal or financial interests.
“In a cost-benefit analysis, it could be convenient for a geopolitical actor to demonstrate that it can hit water treatment or energy infrastructure, because that would have a very strong impact on the population,” he said.
Nevertheless, he questions whether Iran would benefit from opening another confrontation with European countries.
“From that perspective, there is a reason why Tehran could have carried out an attack to send a signal to the United Kingdom. But, from what I see and from what we know at the moment, there are no such critical disputes between Tehran and Paris that would justify risking the creation of another opponent on the Western front.”
His position contrasts with the French government’s assessment, while underscoring the difficulties of distinguishing geopolitical sabotage from other forms of cybercrime.
Russia has also emerged in discussions surrounding the disruptions, particularly because European governments have repeatedly raised concerns about Moscow’s use of hybrid tactics against countries supporting Ukraine.
The Russian-sounding signature attached to the school threats has added to those suspicions. However, no publicly established connection between the emails and the Russian government has been identified. Moscow has denied involvement in broader European destabilization activities.
“At present, attribution to Russia has not been established. The use of a Russian name as a signature and references to a self-proclaimed pro-Russian group are narrative clues, not evidence of a connection to the Russian state. The authorities have not attributed the threats to any group or government,” Garofalo said.
“For a credible attribution, converging technical and intelligence evidence would be required: analysis of the emails and the infrastructure used, connections to previous operations, the identities and relationships of those responsible, any possible financing or directives, and indicators of state control or support,” he added.
Baheli raises another question: whether Moscow would strategically benefit from intensifying tensions with European countries while diplomatic efforts involving Washington and Ukraine remain under discussion.
“Does Russia have any real interest, at this moment, in forcing Italy’s hand, when Italy, both in terms of its rapprochement with the United States and its internal economic problems, is still more reluctant to give support to Ukraine? I do not think so, same goes for Iran or China’s interests,” he said.
The possibility of false-flag operations further complicates the picture. Such an operation would involve perpetrators deliberately creating misleading indicators to redirect responsibility toward another actor.
“In my opinion, there could be false flags intended to delay potential compromises between Iran and the West or potential compromises between Russia and the West,” Baheli said.
However, the existence of misleading elements in a threatening email does not establish that a false-flag operation has occurred.
Italy’s Interior Minister Matteo Piantedosi similarly warned Wednesday that it was premature to conclude that the incidents were directed by a common organization, leaving that determination to investigators. He also identified copycat behavior as a possible explanation.
The uncertainty surrounding the European incidents is unfolding against a wider geopolitical backdrop, with the possibility of renewed military confrontation between Iran, Israel and the United States raising concerns about further regional instability.
Baheli warned that Tehran may already be ready for another confrontation if attacked, having drawn lessons from the previous conflicts.
“I think they do not exclude the possibility of another attack, but they are probably ready to respond in an adequate way. Their response would be calibrated against the regional assets of the United States or of countries in the area that could somehow support the attack,” he said.
Such an escalation would introduce another layer of uncertainty into an already volatile international environment, although no evidence currently establishes a direct connection between the European threats and preparations for renewed hostilities in the Middle East.
The latest incidents have also exposed the practical difficulties of responding to threats that may be technically simple but operationally disruptive.
Garofalo argues that Italy possesses security and cybersecurity structures capable of responding, but that the incidents test a different aspect of national preparedness.
“The vulnerable point is the ease with which an anonymous communication can force evacuations, security checks and disruptions across widely distributed facilities such as schools. This does not amount to a cyber intrusion into the schools’ systems,” he said.
“The real test of preparedness will be the ability to verify reports, protect people, contain the risk of copycat incidents and communicate promptly and consistently, without downplaying the threat or fueling panic,” he added.
The distinction is important for the European Union and NATO, whose responsibilities differ depending on the nature and severity of an attack.
“The European Union has instruments to share information, coordinate responses, counter information manipulation and cyberattacks, and impose restrictive measures when attribution is sufficiently well established,” Garofalo explained.
“NATO can share intelligence assessments, assist an ally and strengthen its resilience. Article 5 is not automatically triggered by a threat or a false alarm. The Alliance specifies that hybrid actions could lead to consideration of its activation, on a case-by-case basis, if they reached the threshold of an armed attack,” he added.
For European governments, the immediate challenge is therefore not only identifying potential foreign interference but ensuring that repeated warnings do not overwhelm emergency services, damage economic activity or erode confidence in public institutions.
The incidents across aviation, retail infrastructure and schools may ultimately prove to have different perpetrators and motivations. What connects them so far is their capacity to disrupt ordinary civilian life while leaving investigators with difficult questions about attribution.
As geopolitical tensions continue across Eastern Europe and the Middle East, the prospect of coordinated hybrid operations remains a serious concern. Yet neither the simultaneous occurrence of these events nor their disruptive consequences establishes a single geopolitical strategy.
“In the short term, the most concrete risk is destabilization below the threshold of armed conflict: disruptions, distrust and polarization,” Garofalo concluded.
For Europe, that risk already exists regardless of whether investigators ultimately identify a foreign state, a domestic group, or unrelated perpetrators behind the latest threats.
