The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Legal Services
Breach intelligence, attack campaigns, and threat reports targeting the Legal Services sector.
Explore Other Sectors
Legal Services Threat Reports
CyberLeek's GTA VI Data Theft: How Gaming's Biggest Leak Redefined Cyber Extortion
In late 2024, threat actor 'CyberLeek' launched a sophisticated data theft and extortion campaign against Rockstar Games, leaking pre-release gameplay footage from the highly anticipated Grand Theft Auto VI game. The attacker published proprietary content across multiple platforms including Discord, demonstrating either insider access or a significant breach of Rockstar's development systems. The incident caused substantial reputational damage and prompted aggressive legal action from Take-Two Interactive, including federal subpoenas against Discord, Google, Microsoft, and X to identify the perpetrators. The attack employed a novel monetization strategy, combining cryptocurrency schemes with watermarked stolen content and crowdsourced pressure tactics to maximize financial gain from the leaked intellectual property. This incident represents an evolution in data extortion tactics, where threat actors leverage public anticipation and social media amplification to maximize pressure on victims. The attack demonstrates how modern cybercriminals are adapting traditional ransomware playbooks to target high-value intellectual property in the entertainment industry, creating new challenges for incident response and legal remediation.
4 weeks ago
Kill Chain
Microsoft Copilot Personal's CoSnitch Vulnerability: A Critical Security Flaw Exposed
In August 2026, Varonis Threat Labs disclosed a critical vulnerability in Microsoft Copilot Personal, dubbed 'CoSnitch' (CVE-2026-24301). This flaw allowed attackers to execute malicious prompts within a user's authenticated session by exploiting an undocumented URL parameter, 'autorun=1'. By crafting a specific link, attackers could trigger Copilot to run unauthorized commands, leading to the exfiltration of sensitive data from connected applications without user interaction. Microsoft addressed this vulnerability with a patch released on August 18, 2026. The CoSnitch vulnerability underscores the evolving risks associated with AI-driven platforms and the importance of rigorous security assessments. As AI assistants become more integrated into daily workflows, ensuring their security against novel attack vectors is paramount to protect user data and maintain trust in these technologies.
1 month ago
Kill Chain
Ransom Busters: A New Deceptive Tactic in Ransomware Attacks
In August 2026, a malicious entity known as "Ransom Busters" emerged, posing as an incident-recovery service to exploit victims of ransomware attacks. This group contacted victims, claiming to have infiltrated ransomware-as-a-service (RaaS) operations and offering to return stolen data and destroy backups for fees ranging from $20,000 to $60,000. Investigations revealed that Ransom Busters was likely a ransomware affiliate attempting to divert ransom payments from the original RaaS operators. This incident underscores the evolving tactics of ransomware affiliates, highlighting the need for organizations to exercise caution when approached by unsolicited recovery services. The deceptive practices employed by Ransom Busters emphasize the importance of verifying the legitimacy of any third-party offering assistance post-attack.
1 month ago
Kill Chain
U.S. Private Sector Empowered to Combat Foreign Cybercriminals
On August 12, 2026, President Donald Trump signed a memorandum instructing the National Coordination Center (NCC) to establish a program enabling vetted U.S. private sector companies to conduct cyber operations against foreign Transnational Criminal Organizations (TCOs). This initiative allows authorized firms to perform cyber surveillance and cyber effects operations, including accessing sensitive data and disrupting information systems, under federal oversight. The program aims to counter cyber-enabled crimes such as ransomware, phishing, and financial fraud targeting American citizens. This policy marks a significant expansion of the private sector's role in offensive cyber operations, raising legal and security considerations. Existing U.S. laws prohibit private entities from conducting cyber attacks without court authorization, and this development parallels international trends, such as Germany's recent legislation granting its intelligence agencies broader cyber capabilities.
1 month ago
Kill Chain
Ransomware Attack Disrupts Colombian Justice Ministry Amid Political Transition
In early August 2026, Colombia's Ministry of Justice experienced a ransomware attack that disrupted several public-facing services, including those related to illicit-drug monitoring and legal processes. The incident occurred just days before the nation's presidential transition, highlighting the vulnerability of critical government infrastructure during periods of political change. While some files were encrypted, acting Minister of Justice Cielo Rusinque confirmed that no data was exfiltrated. This attack is part of a broader trend of increasing cyber threats targeting Colombian government agencies and critical infrastructure. In the past year, exploit attempts in the country have more than tripled, with attackers focusing on exposed and potentially vulnerable systems. The incident underscores the urgent need for enhanced cybersecurity measures to protect national assets, especially during times of political transition.
1 month ago
Kill Chain
LexisNexis 2026 Third-Party Vendor Breach: A Wake-Up Call for Supply Chain Security
In August 2026, LexisNexis identified unusual activity on servers managed by a third-party vendor, leading to the immediate shutdown of its Diligence, Metabase API, and Newsdesk services. The company is collaborating with a cybersecurity forensic firm to investigate the incident and is rebuilding affected systems in a new environment before restoring services. This incident underscores the critical importance of securing third-party vendor relationships, as vulnerabilities in external systems can directly impact core business operations. Organizations must implement stringent vendor risk management practices to mitigate such risks.
1 month ago
Kill Chain
New CSS Attacks Expose Webmail Vulnerabilities: Protect Your Accounts
In August 2026, PortSwigger researcher Gareth Heyes unveiled a series of CSS-based attacks capable of breaching webmail defenses across platforms like Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. These techniques exploit vulnerabilities in HTML and CSS handling within webmail interfaces, allowing attackers to capture passwords, hijack third-party accounts, leak tokens, and manipulate AI tools that process emails. The research, presented at Black Hat USA 2026, demonstrated proof-of-concept attacks without evidence of malicious exploitation. Some providers have since addressed specific vulnerabilities, but others remain unpatched. This incident underscores the evolving nature of web-based threats, highlighting the need for continuous vigilance and proactive security measures. As attackers develop more sophisticated methods to exploit webmail platforms, organizations must prioritize regular security assessments and updates to protect sensitive user information.
1 month ago
Kill Chain
Swiss Government SharePoint Breach 2026: Exploiting CVE-2026-56164
In late July 2026, the Swiss Federal Office for Information Technology and Telecommunication (BIT) detected unauthorized access to its Microsoft SharePoint servers, compromising approximately 200 user accounts. The breach was identified on July 28, following unusual activity on the servers. BIT responded by blocking external internet access to SharePoint, patching vulnerabilities, and resetting affected account passwords. The attackers likely exploited SharePoint vulnerabilities disclosed and patched by Microsoft in mid-July, specifically CVE-2026-56164 and CVE-2026-50522. Investigations are ongoing, with no evidence of data theft beyond compromised login credentials. This incident underscores the critical importance of timely patch management and vigilant monitoring of enterprise applications. The exploitation of known vulnerabilities shortly after disclosure highlights the need for organizations to proactively address security updates to prevent unauthorized access and potential data breaches.
1 month ago
Kill Chain
Unveiling CSS Email Attacks: Insights from Black Hat 2026
In August 2026, at Black Hat USA, security researcher Gareth Heyes unveiled a series of novel attack techniques exploiting Cascading Style Sheets (CSS) within HTML emails. These methods enable attackers to compromise email accounts by bypassing traditional security measures, such as CSS sanitization and Content Security Policies, using only CSS and HTML. The attacks can lead to unauthorized data exfiltration, user tracking, and full account takeovers without the need for JavaScript or malicious attachments. ([portswigger.net](https://portswigger.net/research/talks?talkid=34&utm_source=openai)) This research highlights a significant shift in email-based attack vectors, emphasizing the need for enhanced security measures in webmail platforms. As attackers continue to innovate, organizations must adapt their defenses to address these emerging threats.
1 month ago
Kill Chain
Poison Claude: Unveiling Unauthorized Access to AI Models
In August 2026, cybersecurity researchers uncovered 'Poison Claude,' a clandestine service offering unauthorized access to Anthropic's Claude AI models at discounted rates. This operation exploited vulnerabilities to provide illicit access to models such as Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6. Notably, the operator of Poison Claude had the capability to monitor and record every prompt submitted by users, leading to significant data privacy concerns and potential intellectual property theft. This incident underscores the escalating risks associated with unauthorized AI model access and the exploitation of AI systems for malicious purposes. It highlights the urgent need for robust security measures and vigilant monitoring to prevent such breaches, especially as AI technologies become increasingly integrated into critical business operations.
1 month ago
Kill Chain
ExfilSquad Ransomware Group Breaches UK Police Database in 2026
In late July 2026, the ExfilSquad ransomware group claimed responsibility for a cyberattack targeting the U.K.'s Police National Legal Database (PNLD). The attackers allege they exfiltrated approximately 135,000 contact records, including full names, organizations, and email addresses of police officers, staff, criminal justice professionals, and government partners. Additionally, data from users of the 'Ask the Police' platform who submitted inquiries were compromised. The PNLD has confirmed the breach and is collaborating with cybersecurity experts and the National Crime Agency (NCA) to investigate the incident. No evidence suggests that passwords or other security credentials were compromised, and the PNLD does not store confidential information related to victims, witnesses, or offenders. ([cypro.co.uk](https://cypro.co.uk/insights/cyber-bulletins/exfilsquad-ransomware-claims-microsoft-data-breach/?utm_source=openai)) This incident underscores the persistent threat posed by ransomware groups like ExfilSquad, who continue to target public sector entities. The breach highlights the critical need for robust cybersecurity measures, including multi-factor authentication and continuous monitoring, to protect sensitive information and maintain public trust.
1 month ago
Kill Chain
HollowFrame and Matryoshka: Unveiling a Sophisticated Spear-Phishing Attack on a Law Firm
In July 2026, a sophisticated cyberattack targeted an undisclosed law firm using a previously undocumented Go-based loader named HollowFrame and a Rust-based backdoor called Matryoshka. The attack commenced with a spear-phishing email containing a link to an encrypted archive, which, when executed, initiated a multi-stage infection chain. This sequence involved privilege escalation, disabling Microsoft Defender protections, and downloading additional payloads. HollowFrame utilized DLL side-loading techniques to deploy Matryoshka, enabling persistent remote command execution, Active Directory reconnaissance, file transfers, and deployment of further malicious tools. These capabilities facilitated credential theft, lateral movement within the network, and potential broader domain compromise. This incident underscores the evolving threat landscape where attackers employ multi-stage, modular malware frameworks to infiltrate organizations. The use of spear-phishing as an initial vector highlights the critical need for robust email security measures and user awareness training to mitigate such sophisticated attacks.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports