La Sapienza University suffered a cyberattack

The historic La Sapienza of Rome, one of the largest and most important educational institutions in Europe, has been the target of a serious cyberattack that affected its information systems. The incident caused widespread operational difficulties, highlighting once again how vulnerable the academic sector can be to modern digital threats.

The university's administration announced the incident via a post on social media earlier this week, confirming that the institution's IT infrastructure "became the target of a cyberattack."

Immediate shutdown for data protection

According to the official announcement, the university took drastic measures to limit the extent of the attack.

See also: Spanish Ministry of Science: Shutting down IT systems due to attack?

" As a precautionary measure and with the aim of ensuring the integrity and security of data, an immediate shutdown of network systems was ordered ," the organization said

This decision resulted in the temporary deactivation of essential services, likely affecting student platforms, administrative processes, and digital applications used daily by thousands of members of the university community.

Suspicions of ransomware attack

Although La Sapienza has not yet given many details about the nature of the attack or the perpetrators, Italian media are adding a more worrying dimension.

The Corriere Della Sera newspaper claims that this is a ransomware attack , attributed to a pro-Russian threat actor called Femwar02 . According to the information, the attack resulted in the encryption of data , which could paralyze critical services of the institution.

Connection with Bablock/Rorschach

The same publication reports that the technical characteristics of the malware resemble those of the Bablock, also known as Rorschach.

This particular strain first appeared in 2023 and immediately stood out due to its extremely fast encryption speeds, as well as the customization capabilities it provides to attackers.

See also: Italy thwarted Russian cyberattacks targeting Winter Olympics

Cybersecurity firm Check Point had estimated that Rorschach is a "hybrid" project, based on parts of source code from leaked ransomware such as Babuk, LockBit v2.0 , and DarkSide.

Ransom and the 72-hour "timer"

According to sources at Corriere Della Sera, the attackers have left a ransom note, however, university staff have not opened it, in order to avoid triggering the well-known 72-hour time limit that often accompanies such attacks.

Thus, the amount of the ransom remains unknown, while crisis management continues with particular caution.

Cooperation with Italian authorities for restoration

The university's technical teams are already working in collaboration with the Italian CSIRT, as well as experts from the Agenzia per la Cybersicurezza Nazionale (ACN) and the Polizia Postale.

The main goal is to restore systems through backups, which – according to information so far – have not been affected, which is a significant advantage in the recovery effort.

See also: Substack data leak exposed emails and phone numbers

The risk of data leakage remains

Although the Rorschach ransomware does not have a known dark web ransom portal, experts warn that stolen data may be spread or sold to other criminal groups.

This means that the risk of sensitive information appearing online remains, even if the attack is technically addressed.

Phishing warning to students and staff

Under these circumstances, La Sapienza students and staff are urged to remain on heightened alert. Experts recommend avoiding clicking on suspicious links, being wary of spam emails , and regularly checking accounts for unusual activity.

The incident is yet another example of how universities, as knowledge and data hubs, are becoming key targets for digital crime.

Source: www.bleepingcomputer.com