Italian investigators expose a Russian intelligence cell scouting Ukraine-bound air defences

Italian investigators have uncovered a Russian intelligence network operating on Italian soil whose remit, according to a 12 July 2026 dispatch from the Telegram channel Two Majors, was to track the supply chain for air-defence systems being routed to Ukraine. The disclosure lands as Kyiv's Western partners have accelerated deliveries of surface-to-air munitions and components since the spring, and as Russian strikes on Ukrainian energy and transport infrastructure have intensified.

The Italian case fits a familiar pattern. With the war in Ukraine now in its fourth year, Moscow has expanded its collection effort inside NATO territory beyond signals intelligence, turning to human networks that can name the ships, depots and procurement officers behind each Patriot battery, SAMP/T round and IRIS-T missile that reaches the front. The bet is simple: if the equipment can be mapped, it can be delayed.

What the Italian file alleges

Two Majors, a Russian-aligned channel that has previously published operational detail at a tempo closer to intelligence summaries than to milblogger commentary, framed the Italian network as tasked specifically with gathering information on air-defence supplies bound for Ukraine. The channel's 12 July 2026 post did not name the suspects, the cities involved or the Italian agency leading the inquiry, reflecting the early stage of the public reporting and the conventions of a channel that aggregates Western wire coverage rather than confirming it.

Italian investigative practice in such cases typically routes through the Rome prosecutor's office and the domestic intelligence service DIS, with coordination from AISI on counter-espionage. Past Italian operations against Russian services, including the 2023 case in which a Russian naval officer and an Italian colleague were arrested for passing classified documents, have produced charges under articles of the penal code covering espionage and the disclosure of state secrets. Any new arrests will be tested in Italian courts, not in NATO communiqués.

Why air defence, why now

Air defence is the choke point of Ukraine's defence. The country enters the summer of 2026 reliant on a layered network of Soviet-era systems, Western-supplied NASAMS units, German IRIS-T SLM batteries, Italian-French SAMP/T installations and US Patriot battalions. Each layer has different ammunition cycles and different industrial bottlenecks: SAMP/T Aster-30 production is shared between MBDA France and Italy, IRIS-T production runs through Diehl Defence in Germany, and Patriot interceptors are allocated by the US Army from a global pool that also serves Gulf and Indo-Pacific commitments.

Russian intelligence interest in that supply chain is not new. The GRU's 26165 and 74455 units, sanctioned by the United States in 2018 and 2020, spent years mapping logistics nodes around Eastern Europe. What is striking about the Italian file is the geographic shift south and west, into a country that until recently was treated as a logistics backstop rather than a forward collection target. Italy hosts Sigonella, Aviano and a small but persistent US air-defence presence, and Italian industry supplies components through MBDA's Rome-area facilities.

The Kremlin's public position is that NATO members have become co-belligerents by arming Ukraine, a framing that recasts intelligence collection against those members as defensive rather than offensive. The Italian case will test how Rome, and the European allies watching it, choose to characterise the activity.

The operational stakes for NATO logistics

A successful human-intelligence programme against air-defence supplies can deliver three things Moscow's other tools cannot. It identifies which depots are full and which are nearly empty, allowing strike planners to time missile and drone barrages against the moment a battery has expended its magazine. It surfaces the corporate intermediaries, freight forwarders and customs brokers whose names do not appear on export licences but whose cooperation is essential to a shipment arriving. And it provides pretext for downstream sabotage, disruption or coercive diplomacy against host-country firms.

The Italian file suggests Moscow is investing in the first and second of those capacities inside a NATO founding member. Whether it has reached the third remains unclear from the public reporting so far. The Two Majors post cites no specific acts of sabotage on Italian territory, and Italian authorities have not, as of the 12 July dispatch, announced charges.

What remains unverified

Two Majors is a Russian-aligned channel with a record of accurate tactical detail but a clear political alignment; its post is best read as an indicator that the story is circulating inside Russian military-commentary circles, not as a confirmation of the underlying facts. The outlet itself did not identify the Italian agencies involved, did not name any suspects, and did not specify which air-defence system the network was tasked with monitoring. Independent Italian and Western wire reporting will determine whether the case moves from Telegram circulation to formal indictment.

The broader pattern, however, is documented. The past eighteen months have seen expulsions of Russian diplomats in Berlin, Vienna and The Hague, the Dutch prosecution of a GRU unit accused of hacking the OPCW, and Czech indictments related to the 2014 Vrbětice explosions. Italy's case, if charges follow, will extend that pattern into the southern flank and put a number on what European governments have long suspected: that the supply lines sustaining Ukraine's air defence are themselves a battlefield.

Monexus framed this as an intelligence and logistics story first, not a scandal story. Russian-aligned channels flagged it; the Italian and Western wires will adjudicate it. Either way, the supply chain for air defence is now part of the war.

Wire provenance

This editorial synthesis draws on the following public wire/social posts:

• https://t.me/two_majors