Your Lawyers Are Increasingly Targeted by Phishing Attacks, Ransomware
Researchers at Bitdefender warn that law firms are high-value targets for ransomware gangs and other criminal threat actors. Attackers frequently use phishing to gain initial access to an organization’s networks.
“Phishing is one of the most common attacks in the legal field,” the researchers write. “Cybercriminals pose as legitimate entities, tricking employees into divulging sensitive information or clicking malicious links.
Phishing attacks use social engineering to prey on trust and a sense of urgency. For example, an attacker can impersonate a senior partner and email an associate requesting sensitive client files or bank account information. If the associate is tricked, the cybercriminal gains access to confidential data.”
Phishing also often precedes ransomware attacks, granting threat actors a foothold from which they can exfiltrate data and deploy their malware.
“Ransomware attacks have been on the rise, with legal firms frequently targeted,” the researchers write. “In these attacks, cybercriminals encrypt a firm’s data and demand a ransom in exchange for its release, but a data breach often accompanies these attacks.
“Ransomware is also one of the few cyberattacks that can close down a company if it goes on long enough, if the data stolen by criminals ends up online, or even if the firm simply has no backup system. In some situations, hackers have used the stolen data from legal cases and tried to extort people involved, such as witnesses.”
Bitdefender says organizations should implement the following best practices to defend themselves against these attacks:
- Employee training — regular cybersecurity awareness training is critical because employees must be able to quickly recognize phishing attempts
- Endpoint protection – Devices need protection enabled at all times so that even if an employee clicks on a dangerous link or opens up an attachment, the danger is averted
- Multi-Factor Authentication (MFA) —MFA adds an extra layer of security, ensuring that even if login credentials are compromised, unauthorized access is prevented
New-school security awareness training can give your organization an essential layer of defense against phishing and other social engineering attacks. KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Bitdefender has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW