✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Legal Services
Breach intelligence, attack campaigns, and threat reports targeting the Legal Services sector.
Explore Other Sectors
Legal Services Threat Reports
MatrixPDF: How Advanced PDF Phishing Kits Are Bypassing Security in 2025
In September 2025, security researchers uncovered the MatrixPDF toolkit—an advanced phishing and malware distribution tool that leverages benign-looking PDF files to lure victims into credential theft or malware downloads. MatrixPDF allows attackers to embed JavaScript, blur sensitive fields, and add deceptive overlays within imported PDFs, guiding users to external phishing sites or payloads. Sold via cybercrime forums and Telegram for up to $1,500/year, MatrixPDF's PDFs can bypass popular email gateways, including Gmail, exploiting the trust users place in PDF attachments and the limits of email filtering. The primary impact is the heightened risk of successful phishing and malware campaigns targeting enterprises and individuals, resulting in potential credential compromise and further lateral movement. MatrixPDF exemplifies the growing sophistication of cybercriminal DIY toolkits and their focus on evading modern email defenses through social engineering and weaponized, interactive documents. This shift highlights the ongoing arms race between attackers engineering for delivery success and defenders developing detection tactics for multi-layered, context-aware threats.
6 months ago
Kill Chain
GoAnywhere MFT Zero-Day (CVE-2025-10035): Anatomy of a 2025 Enterprise Breach
In September 2025, a maximum severity zero-day vulnerability (CVE-2025-10035) in Fortra’s GoAnywhere Managed File Transfer (MFT) platform was actively exploited in the wild. Attackers remotely injected commands via a deserialization flaw in the License Servlet, requiring only a forged license response signature to achieve pre-authentication remote code execution. The breach timeline reveals attackers gained access at least a week before public disclosure, establishing persistence via a backdoor admin account and deploying secondary payloads like SimpleHelp for ongoing access, with evidence of lateral movement reconnaissance. The incident underscores the increasing sophistication and rapid weaponization of zero-day exploits targeting widely used enterprise file transfer solutions. With high-profile breaches tied to vulnerabilities in GoAnywhere, pressure is mounting for organizations to reassess their exposure and incident response practices amid a sharp uptick in exploit automation and data exfiltration attacks.
6 months ago
Kill Chain
Brickstorm Backdoor: UNC5221’s Stealthy Edge Device Supply Chain Attack (2024)
In a sophisticated cyber-espionage campaign uncovered in 2024, the China-linked group UNC5221 systematically compromised edge network appliances—such as firewalls, VPNs, and virtualization hosts—unable to run traditional EDR agents. By deploying a newly evolved backdoor known as 'Brickstorm,' the attackers gained highly persistent, stealthy access to organizations in technology, legal, SaaS, and outsourcing sectors. The malware, enhanced with delayed activation and strong obfuscation, leveraged unique command-and-control domains per victim and often exploited both zero-day and publicly known vulnerabilities. High-value credential harvesting and lateral movement to strategic systems, such as VMware vCenter, enabled the threat actor to maintain undetected access for an average of 393 days, facilitating both data theft and potential downstream customer compromise. This incident highlights the evolving risk posed by state-sponsored actors targeting blind spots in infrastructure—especially unmanaged or agentless edge devices critical to supply chains and cloud access. With ongoing innovation in stealth tactics and platform abuse, the Brickstorm campaign marks a serious escalation in the complexity and duration of modern supply chain threats.
6 months ago
Kill Chain
How Brickstorm Malware Evaded Detection in US Legal & Tech Sectors: A 2025 APT Case Study
In 2025, Google’s Threat Intelligence Group uncovered that the UNC5221 threat actor, suspected to have ties to China, used the Brickstorm malware to conduct stealthy, long-term espionage campaigns against U.S. legal and technology organizations, SaaS providers, and BPOs. The attackers exploited zero-day vulnerabilities in enterprise edge devices lacking EDR protection, establishing persistent access for an average dwell time of over a year. Brickstorm enabled credential theft, lateral movement, and data exfiltration, often targeting email and sensitive code repositories, all while obfuscating forensic traces and regularly changing infrastructure. This incident highlights a growing trend of persistent, supply-chain-oriented APT attacks targeting critical sectors via unmonitored infrastructure. It underscores the importance of timely patching, segmentation, and improved visibility for hybrid and edge environments facing increasing risks from nation-state adversaries.
6 months ago
Kill Chain
Brickstorm: The Next-Level Chinese APT Breach Impacting SaaS & Legal Sectors in 2025
In 2025, a highly sophisticated cyberespionage campaign attributed to a suspected Chinese advanced persistent threat (APT), utilizing malware later dubbed 'Brickstorm,' successfully infiltrated multiple US legal services and tech supply chain organizations. The attackers leveraged undisclosed zero-day vulnerabilities to gain initial access, maintain exceptional stealth with average dwell times of over 400 days, and move laterally into downstream customers. Their campaign targeted proprietary source code and sensitive trade/national security intelligence, making detection challenging through advanced cleanup techniques and non-overlapping infrastructure. This incident is particularly significant as it represents a new echelon of APT supply chain intrusions, echoing a rise in strategic, multi-year campaigns focusing on SaaS and cloud intermediaries. It highlights the growing need for robust east-west visibility, zero trust segmentation, and supply chain security amid evolving TTPs that routinely outpace traditional detection and response capabilities.
6 months ago
Kill Chain
ShadowLeak: Zero-Click OpenAI ChatGPT Bug Exposes Gmail Data in 2025
In June 2025, a critical zero-click vulnerability, codenamed ShadowLeak, was discovered in OpenAI ChatGPT’s Deep Research agent. This flaw enabled attackers to exfiltrate sensitive Gmail inbox content merely by sending a specially crafted email to victims using the agent, requiring no user action. Security researchers from Radware, after identifying the issue, disclosed it responsibly to OpenAI, which released a fix in early August 2025. The flaw had the potential to compromise confidential data across enterprise and personal Gmail accounts, raising major concerns around AI-driven integrations and email ecosystem security. This breach highlights the accelerating convergence of artificial intelligence with traditional email attack surfaces, raising unique risks around invisible, automated threat vectors. With GenAI agents increasingly embedded into communication flows, attackers are rapidly adapting zero-click tactics to exploit new behaviors and trust assumptions.
6 months ago
Kill Chain
How 'ShadowLeak' Turned ChatGPT into a Data Exfiltration Channel
In mid-2024, security researchers uncovered a novel cyberattack—dubbed 'ShadowLeak'—that exploits OpenAI’s ChatGPT platform to surreptitiously exfiltrate emails and sensitive enterprise data. Threat actors leveraged covert techniques to route data through OpenAI’s infrastructure, effectively bypassing traditional network security controls and leaving virtually no forensic traces within the victim organization. The attack exploits the trusted status of sanctioned AI platforms inside corporate environments, making malicious exfiltration activity blend in with legitimate AI-assisted workflow traffic. As a result, internal monitoring and traditional DLP tools fail to identify or intercept the breach, putting confidential business communications and data at risk. This incident spotlights the growing risk posed by increasingly sophisticated methods of data exfiltration over legitimate AI services. With organizations accelerating the adoption of generative AI in critical business processes, attackers are exploiting technical and policy blind spots, making traditional perimeter defenses inadequate against such stealthy insider threats.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports