How ransomware tactics against law firms are changing

In brief

• Chris McKie details ransomware backdoor tactics in backup systems
• Beth Burgin Waller advises employee training on IT impersonation
• B. Stephanie Siegmann highlights third-party vendor vulnerabilities
• Jared D. Correia warns of excessive employee data access risks

Ransomware attacks against law firms have grown more sophisticated over the past year, with attackers increasingly posing as internal IT staff to gain access and stealing data without bothering to encrypt it.

The approach has changed, said Chris McKie, an independent product marketing consultant based in California who was previously the vice president of product marketing for Datto’s security suite.

“They try to find ways into your backup recovery systems, and then they plant a back door there,” said McKie. “So, when they hit you with ransomware [and] you go back and do your recovery, you’ve reloaded their malware. They’re back in business.”

He added: “Hackers have gotten around a lot of two-factor authentication systems. It’s scary because you can’t tell when that happens.”

Virginia attorney Beth Burgin Waller said the best defense against IT impersonation attacks is training everyone to expect them and to know how to respond.

“If an employee receives a helpdesk call out of the blue, the safest response is to hang up and call the known helpdesk number,” said Waller, who chairs the cybersecurity and data privacy practice at Woods Rogers. “If something feels off, it probably is. Hang up, verify, and then reconnect through a trusted channel.”

Third-party vendors are another way ransomware groups get in, said B. Stephanie Siegmann, who co-chairs the cybersecurity, privacy and data protection practice at Hinckley Allen.

She cites the recent security incident with Salesforce as one example.

“If there’s a vulnerability in one of those types of third-party vendors, [bad actors] can gain access to numerous companies’ networks,” said Siegmann, who previously served as national security chief at the U.S. Attorney’s Office for the District of Massachusetts.

That access could lead to a ransomware deployment across every firm relying on that vendor, she added.

Compounding the problem is the fact that a lot of law firms still allow people to use a thumb drive or flash drive, Siegmann said, and people impersonating IT contractors can exploit that.

Once inside, she said, attackers often install AnyDesk, a remote-access tool that can be used to exfiltrate data. Unrestricted screensharing over Zoom or similar platforms is another way in.

To combat this, Siegmann recommends that firms disable thumb drives outright and restrict unsolicited screen-share requests.

Employee and contractor access often goes further than a given job requires, said attorney Jared D. Correia, who runs Boston-based Red Cave Consulting, working primarily with solos and small firms.

The result, he said, is that “data can flow freely outside a platform without any alarms being triggered.”

McKie noted that AI has made thwarting access harder.

For example, a foreign accent used to be the easiest way to catch a vishing call, he said.

But “AI changes that. You can now use AI to create scripts that sound like someone is from Texas or Nebraska. You pick a state, pick a dialect, and they’ll match it,” he explained.

Siegmann said that AI is also straining defenders.

There are new AI models that have unbelievable capabilities to identify vulnerabilities, she said, but the result is “security update overload,” making it harder for firms to know which patches to prioritize first..

To pay or not to pay

If a ransomware attack is successful, firms face the choice of how to respond.

But experts say that payment doesn’t resolve much on its own.

“Almost always, they will give you the decryption key and they have customer service people that’ll help you in decrypting your data,” Siegmann said. “[But] they are criminals. There’s no guarantee that they’re actually going to delete it.”

Further, she said, while most ransomware groups aren’t on the U.S. Treasury’s Office of Foreign Assets Control sanctions list, violating the rules tied to that is a felony. Companies that violate sanctions law can face criminal fines that run into the millions.

Siegmann said that before advising a client, she conducts her own due diligence, retains a ransomware negotiator and checks with contacts at the FBI, on top of whatever review a cyber insurer requires.

“I don’t advise them to pay,” she added. “I give them the pros and cons.”

There can also be court involvement if a firm is sued in the wake of security breach. Settlements of class actions brought by affected clients increasingly include specific technical requirements, which a judge must sign off on as part of final approval. A $8.5 million settlement by a Florida firm this year required it to adopt endpoint detection and response software (EDR) and harden its backup infrastructure. It also had to undergo a SOC 2 (System and Organization Controls 2) audit of its data security practices..

Aside from lawsuits, firms that are attacked can face state attorney general or regulatory enforcement action if investigators find that security fell short.

McKie said the important question for a firm to ask its managed service provider, or MSP, isn’t about a certification like SOC 2, it is which cybersecurity framework the provider follows and whether that matches the firm’s own.

He also said it’s critical to rehearse your ransomware response before an incident occurs.

“I would insist that my MSP conduct quarterly tabletop exercises” that walk through exactly who gets called and what gets disclosed if a ransomware attack hits, McKie said. “If your MSP doesn’t do it, I would suggest getting a different MSP. You’d rather have simulated pain versus real pain.”

Being prepared

Experts say that law firms still underestimate the risk of attack, with some believing they are too small to be worth targeting.

But Siegmann said that’s a mistake.

“No one’s too small,” she said. It’s usually not a question of if a firm gets hit, “but when.”

Vulnerability comes down to risk management, not size, agreed McKie.

“There’s a term in security called an asymmetrical battle,” he said. “The attacker has the advantage. They only need to find one way in. As the MSP, you need to block every possible way.”