Italian authorities have uncovered an alleged Russian espionage network involving former Italian intelligence officials accused of passing sensitive defence and security information to Moscow through a Russian military intelligence officer operating under diplomatic cover in Rome.
The investigation led to the arrest of two former intelligence officials on July 7, 2026. A Rome judge placed both under house arrest on charges of espionage and unauthorised access to computer systems.
Two days later, Italy expelled two Russian military attachés from its embassy in Rome, accusing them of involvement in the alleged espionage activities. Italian foreign minister Antonio Tajani named them as Ivan Petrovich Gorbachev and Mikhail Vasilyevich Astakhov and said they had been given 72 hours to leave.
Moscow has announced that it will respond to the expulsions. Its foreign ministry, quoted by the state news agency Ria Novosti, said the Russian side would give an adequate response. Tajani has dismissed any counter-measure as political retaliation rather than a decision based on evidence.
The material allegedly targeted by the network reportedly included NATO-related activities, defence programmes, cyber-security capabilities and intelligence operations linked to countering Russian influence.
The investigation began in May 2025 after Italy’s domestic intelligence service, the Internal Information and Security Agency (AISI), identified suspicious contacts involving one of its former officials. It was carried out by the Carabinieri’s Special Operational Group (ROS) using surveillance operations, communication monitoring and intelligence gathering.
The main suspect identified by prosecutors is Gavino Raoul Piras, 59, a retired agent of AISI and a former Carabinieri warrant officer who left the service in 2012. He trained at the NATO school in Oberammergau, southern Germany, and took part in the alliance’s Unified Blade exercises. A second former AISI official, Vincenzo Di Pasquale, 59, originally from Matera in southern Italy, was also arrested.
Investigators are also examining the possible involvement of additional defence personnel suspected of being linked to Piras and Di Pasquale as part of an alleged espionage cell. Five further people are under investigation, four of them military personnel serving in the defence ministry’s cyber units at the time of the alleged offences. None has been charged and all are presumed innocent.
According to Italian prosecutors, the alleged network relied on traditional human intelligence methods.
Investigators believe Piras was the sole Italian interlocutor of Astakhov, an officer of the GRU, Russia’s military intelligence service, who was operating under diplomatic cover. Prosecutors allege the collaboration dates back to 2013, while Il Post, citing investigative papers, reported that the two men began meeting in Rome in 2023.
The exchanges reportedly took place through face-to-face meetings in public locations around Rome, including cafés, parks and other areas where surveillance would have been more difficult to detect. Intercepts gathered by the ROS and reported by Corriere della Sera place one such meeting on a bench in Bracciano, northwest of the capital, on October 9, 2025.
Prosecutors allege that the Russian intelligence officer provided handwritten requests identifying the information sought by Moscow. Piras allegedly returned with documents, summaries or intelligence gathered through his contacts inside Italy’s defence and security structures. Surveillance footage is said to show the pair passing notes concealed in shirt pockets, exchanging mobile phones inside a microwave oven and leaving SD cards in cracks in street walls.
Investigators also claim that payments were made in cash, with the two men allegedly agreeing a price of €4,000 for each item of information. Some €20,000 in cash was seized during the searches of July 7, 2026.
Italian prosecutors believe the case may involve more than a single intelligence leak, with investigators examining whether a wider network of sources connected to Italy’s defence establishment was involved.
Authorities allege that Piras maintained contact with six confidential sources, including active-duty military personnel who are now under investigation.
The information allegedly passed to Moscow reportedly included details related to Italian defence procurement programmes, NATO-related military activities, cyber-defence capabilities, developments in the defence industry and the identities of intelligence personnel involved in monitoring Russian activities. Italian media have reported that the requests also covered the SAMP/T air-defence system, Italian and European rearmament plans and weapons supplied to Ukraine.
Italian officials have linked the alleged espionage case to wider concerns about Russian hybrid warfare against Western countries.
Italian defence minister Guido Crosetto described the affair as part of a broader effort by Moscow to gather sensitive information, exploit vulnerabilities and weaken Western security structures.
Crosetto said the investigation represented “the tip of a gigantic iceberg”, warning that the case should be viewed within the broader context of attempts to penetrate European security institutions. He described a daily hybrid conflict waged to weaken Italy’s institutions, alliances and security, and said the country faced both external enemies and internal traitors ready to sell out their nation for money or power.
He also described the alleged activities as part of a hybrid war, involving not only cyber operations and disinformation campaigns but also intelligence operations aimed at obtaining strategic information and influencing Western countries.
The investigation recalls the Walter Biot case of 2021, when an Italian naval officer was arrested on March 30 that year while handing over classified documents to a Russian embassy official in a Rome car park in exchange for money. A military court sentenced him to almost 30 years; in May 2026 Italy’s Court of Cassation upheld a separate 20-year sentence.
Italian investigators, though, consider the current case potentially more serious because it allegedly involved a broader network connecting former intelligence personnel with individuals still serving inside the defence system.
