Certified email

An attacker got into an Italian government's mailbox on the country's PEC system.

That's Posta Elettronica Certificata, Italy's legally recognized certified email network, apparently via an infosealer infection on a government employee's machine.

One of the addresses reported sits on the Interior Ministry's domain.

So, every email sent from it passed the usual security checks, making it look legitimate.

La posta.

La Posta Electronica Certificata, or PEC, which is basically the equivalent of registered mail or certified mail, and it's used by the Italian government, but also by companies, the courts, and citizens.

It appears that there was a login... affiliated with a Italian municipality that was like leaked on the dark web.

And this threat actor appears to have used that to then send legal requests, European investigative orders, asking Revolut, sent directly to Revolut, asking for additional information based on supplying those wallet addresses.