Loading story…
Williams & Connolly, a prominent U.S. law firm known for representing high-profile politicians and major media outlets, experienced a targeted cyberattack attributed to a Chinese-linked threat actor. The attackers exploited a zero-day vulnerability to compromise the email accounts of a small number of attorneys at the firm. The incident is part of a broader campaign by Chinese-nexus threat clusters, as reported by Google’s Mandiant and Threat Intelligence Group, which have been targeting U.S. law firms and technology companies to support espionage objectives. The law firm promptly notified its clients about the breach, emphasizing that there is no evidence of confidential client data being exfiltrated from central databases. Williams & Connolly stated that, following the attack, there is no indication of ongoing unauthorized activity within their network. The firm has engaged cybersecurity firm CrowdStrike to assist in the investigation and has taken steps to block the threat actor’s access. The FBI’s Washington Field Office is also investigating the incident, though it has not provided public comment. Analysts believe the Chinese threat actors aim for long-term access to sensitive targets, seeking to install backdoors and avoid detection for extended periods. The attack on Williams & Connolly is notable due to the firm’s involvement in sensitive legal matters, including First Amendment cases and representation of former U.S. presidents. The campaign against law firms is part of a larger pattern of Chinese cyber-espionage targeting sectors with access to valuable national security and international trade information. In the same timeframe, other U.S. law firms have reported breaches, but Williams & Connolly’s case is distinguished by the use of a zero-day exploit and the high-profile nature of its clientele. The firm has reassured clients that, based on current evidence, their confidential information remains secure. The incident underscores the persistent threat posed by nation-state actors to the legal sector, particularly those handling sensitive political and governmental matters. The breach highlights the importance of rapid detection, transparent communication with clients, and collaboration with both private cybersecurity firms and federal law enforcement. The attack has raised concerns about the broader vulnerability of the legal sector to sophisticated, state-sponsored cyber campaigns. Williams & Connolly’s response demonstrates a commitment to transparency and proactive risk mitigation in the face of advanced persistent threats. The ongoing investigation may yield further insights into the tactics, techniques, and procedures employed by the attackers. The incident serves as a warning to other law firms and organizations with sensitive data to bolster their defenses against similar nation-state campaigns.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Follow-up reporting attributed the intrusion at the prominent political U.S. law firm to Chinese-linked hackers. This appears to be an attribution development rather than a separate incident.
A major U.S. law firm said hackers gained access to attorneys' email accounts, publicly disclosing the intrusion. The available references do not provide a more specific incident date, so the disclosure date is used as the best estimate.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
bankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Group-IB reported that the **Bloody Wolf** threat actor has been targeting organizations tied to the justice sector, using intrusive access and blunt-force extortion tactics against law firms and legal service providers. The campaign was described as focused on stealing sensitive legal and case-related information, putting victims at risk of operational disruption, confidentiality breaches, and downstream pressure tied to exposed client data. The activity highlights a growing threat to legal and judicial ecosystems, where attackers can monetize privileged documents, litigation records, and personally identifiable information without needing highly sophisticated tradecraft. For CISOs in affected sectors, the reporting underscores the need to harden remote access, monitor for unauthorized data staging and exfiltration, and prepare incident response plans for extortion scenarios involving stolen legal material.
Jul 12, 2026
The **Silent Ransom Group** — also tracked as **UNC3753**, **Luna Moth**, and **Chatty Spider** — has been targeting U.S. law firms and other professional, financial, insurance, and healthcare organizations with data-theft extortion campaigns that rely on social engineering instead of file encryption. FBI alerts and Google Mandiant reporting say the actors send invoice-themed phishing emails and follow up with voice calls impersonating internal IT or help desk staff, persuading employees to join screen-sharing sessions or install legitimate remote management tools such as AnyDesk, Zoho Assist, Bomgar, Splashtop, Syncro, Atera, and SuperOps. Once inside, the group rapidly searches document repositories and cloud stores for legal files, tax records, financial data, PII, and other sensitive material, then exfiltrates it with tools including WinSCP, hidden or renamed Rclone, Google Drive, Microsoft OneDrive, or victim-controlled file-sharing channels. Authorities said the campaign has escalated beyond remote access attempts to **in-person intrusions**, with imposters arriving at offices posing as technicians and connecting USB drives or external disks to steal data when remote social engineering fails. Mandiant said dozens of U.S. organizations were targeted between January and May, and in some cases the intrusion, theft, and extortion cycle was completed within a single business day, with ransom demands sent shortly after access ended. Researchers and the FBI linked the operation to the post-Conti cybercrime ecosystem and noted that its abuse of legitimate tools leaves few forensic artifacts, while Resecurity reported fast-flux infrastructure supporting leak sites including `business-data-leaks[.]com` and `ep6pheij[.]com`. The FBI and Google urged organizations to verify anyone claiming to be IT staff, restrict unauthorized remote management and VDI access, harden USB and removable-media controls, deploy phishing-resistant MFA, and closely monitor sensitive document systems.
Jun 29, 2026
The FBI confirmed that **suspicious cyber activity** targeted one of its internal surveillance networks, and officials later classified the intrusion as a **"major incident"** under FISMA because of the potential national security impact. Reporting indicates the affected environment included systems tied to the FBI’s Virgin Islands operations, where attackers accessed highly sensitive law-enforcement information, including **pen register** and **trap-and-trace** returns as well as personally identifiable information connected to active investigations. The bureau said it detected unusual activity in February, informed lawmakers in early March, and publicly acknowledged that the activity had been contained while the investigation continued. Multiple reports said investigators linked the operation to **China**, and that the attackers appear to have reached FBI systems through a commercial internet service provider’s vendor infrastructure rather than by directly breaching the bureau first. The incident prompted a broader U.S. government response, with the White House convening officials from the FBI, NSA, and CISA and the Justice Department establishing a working group to strengthen resilience and incident response. The breach was reported as separate from another cyber matter involving the FBI director’s personal email, underscoring that the bureau was confronting several cyber threats at the same time.
Jun 29, 2026