Law firms increasingly targeted by phishing attacks and ransomware

Bitdefender researchers warn that law firms are high-value targets for ransomware gangs and other criminal threat actors. Attackers often use phishing to gain first access to an organization’s networks.

“Phishing is one of the most common attacks in the legal sector,” the researchers write. “Cybercriminals pose as legitimate entities and trick employees into providing sensitive information or clicking on malicious links.

Phishing attacks use social engineering to exploit trust and a sense of urgency. For example, an attacker might pose as a senior partner and send an email to an employee asking for sensitive client files or bank account information. If the employee is fooled, the cybercriminal can gain access to confidential data.”

Phishing often precedes ransomware attacks, giving attackers an entry point to steal data and spread their malware.

“Ransomware attacks are on the rise, with law firms often being targeted,” the researchers wrote. “In these attacks, cybercriminals encrypt a firm’s data and demand a ransom in exchange for its release, but these attacks are often accompanied by a data breach.

“Ransomware is also one of the few cyberattacks that can take a business down if it lasts long enough, if the data stolen by the criminals ends up online, or even if the company simply doesn’t have a backup system in place. In some situations, hackers have used stolen data from lawsuits and tried to extort data from those involved, such as witnesses.”

According to Bitdefender, organizations should implement the following best practices to defend themselves against these attacks:

• Employee Training: Regular cybersecurity awareness training is critical as employees need to be able to quickly recognize phishing attempts.
• Endpoint Security – Devices must be secured at all times so that even if an employee clicks on a dangerous link or opens an attachment, the danger is averted.
• Multi-Factor Authentication (MFA) — MFA adds an extra layer of security, preventing unauthorized access even if credentials are compromised

New security awareness training can provide your organization with a critical layer of defense against phishing and other social engineering attacks. KnowBe4 empowers your workforce to make smarter security decisions every day. More than 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

Bitdefender has the story.