Legal Firms Increasingly Targeted by Phishing Attacks, Ransomware

Researchers at Bitdefender warn that law firms are high-value targets for ransomware gangs and other criminal threat actors. Attackers frequently use phishing to gain initial access to an organization’s networks.

“Phishing is one of the most common attacks in the legal field,” the researchers write. “Cybercriminals pose as legitimate entities, tricking employees into divulging sensitive information or clicking malicious links.

Phishing attacks use social engineering to prey on trust and a sense of urgency. For example, an attacker can impersonate a senior partner and email an associate requesting sensitive client files or bank account information. If the associate is tricked, the cybercriminal gains access to confidential data.”

Phishing also often precedes ransomware attacks, granting threat actors a foothold from which they can exfiltrate data and deploy their malware.

“Ransomware attacks have been on the rise, with legal firms frequently targeted,” the researchers write. “In these attacks, cybercriminals encrypt a firm’s data and demand a ransom in exchange for its release, but a data breach often accompanies these attacks.

“Ransomware is also one of the few cyberattacks that can close down a company if it goes on long enough, if the data stolen by criminals ends up online, or even if the firm simply has no backup system. In some situations, hackers have used the stolen data from legal cases and tried to extort people involved, such as witnesses.”

Bitdefender says organizations should implement the following best practices to defend themselves against these attacks:

• Employee training — regular cybersecurity awareness training is critical because employees must be able to quickly recognize phishing attempts
• Endpoint protection – Devices need protection enabled at all times so that even if an employee clicks on a dangerous link or opens up an attachment, the danger is averted
• Multi-Factor Authentication (MFA) —MFA adds an extra layer of security, ensuring that even if login credentials are compromised, unauthorized access is prevented

New-school security awareness training can give your organization an essential layer of defense against phishing and other social engineering attacks. KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

Bitdefender has the story.