Loading story…
Group-IB reported that the Bloody Wolf threat actor has been targeting organizations tied to the justice sector, using intrusive access and blunt-force extortion tactics against law firms and legal service providers. The campaign was described as focused on stealing sensitive legal and case-related information, putting victims at risk of operational disruption, confidentiality breaches, and downstream pressure tied to exposed client data.
The activity highlights a growing threat to legal and judicial ecosystems, where attackers can monetize privileged documents, litigation records, and personally identifiable information without needing highly sophisticated tradecraft. For CISOs in affected sectors, the reporting underscores the need to harden remote access, monitor for unauthorized data staging and exfiltration, and prepare incident response plans for extortion scenarios involving stolen legal material.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Group-IB published a blog post titled "Bloody Wolf: A Blunt Crowbar Threat To Justice," indicating public disclosure of its findings on the Bloody Wolf threat activity. No additional event details are available from the provided reference content.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Silent Ransom Group** — also tracked as **UNC3753**, **Luna Moth**, and **Chatty Spider** — has been targeting U.S. law firms and other professional, financial, insurance, and healthcare organizations with data-theft extortion campaigns that rely on social engineering instead of file encryption. FBI alerts and Google Mandiant reporting say the actors send invoice-themed phishing emails and follow up with voice calls impersonating internal IT or help desk staff, persuading employees to join screen-sharing sessions or install legitimate remote management tools such as AnyDesk, Zoho Assist, Bomgar, Splashtop, Syncro, Atera, and SuperOps. Once inside, the group rapidly searches document repositories and cloud stores for legal files, tax records, financial data, PII, and other sensitive material, then exfiltrates it with tools including WinSCP, hidden or renamed Rclone, Google Drive, Microsoft OneDrive, or victim-controlled file-sharing channels. Authorities said the campaign has escalated beyond remote access attempts to **in-person intrusions**, with imposters arriving at offices posing as technicians and connecting USB drives or external disks to steal data when remote social engineering fails. Mandiant said dozens of U.S. organizations were targeted between January and May, and in some cases the intrusion, theft, and extortion cycle was completed within a single business day, with ransom demands sent shortly after access ended. Researchers and the FBI linked the operation to the post-Conti cybercrime ecosystem and noted that its abuse of legitimate tools leaves few forensic artifacts, while Resecurity reported fast-flux infrastructure supporting leak sites including `business-data-leaks[.]com` and `ep6pheij[.]com`. The FBI and Google urged organizations to verify anyone claiming to be IT staff, restrict unauthorized remote management and VDI access, harden USB and removable-media controls, deploy phishing-resistant MFA, and closely monitor sensitive document systems.
Jun 29, 2026
Ransomware operations are increasingly **industrialized**, shifting from simple file encryption to multi-stage extortion that combines **encryption**, **data theft/leak threats**, **DDoS**, and in some cases direct pressure on third parties such as customers, partners, or regulators. This “quadruple extortion” model has been associated with major groups including **ALPHV/BlackCat**, **CL0P**, and **LockBit**, reflecting a broader trend toward scalable, high-tempo campaigns designed to maximize coercion and revenue. At the same time, incident-response reporting indicates some **zero-day-driven, downstream mass data-theft extortion** campaigns—popularized by **CL0P** against widely used file-transfer platforms—are becoming less effective at driving payments, as organizations better understand that paying for “data suppression” does not remove notification obligations or meaningfully reduce litigation and re-extortion risk. Separately, GuidePoint assessed with high confidence that the new “**0APT**” leak site’s claimed victim list is largely **fabricated** (or recycled from other groups) and likely intended to enable opportunistic extortion, re-extortion, or affiliate fraud; organizations named by 0APT were advised to validate impact via concrete indicators (e.g., ransom note, encryption, direct communication) before treating the posting as evidence of compromise.
Jun 29, 2026
HWL Ebsworth, a prominent Australian law firm, suffered a ransomware attack by the ALPHV (BlackCat) group, resulting in the exfiltration of sensitive client data. In response, the firm obtained a court injunction intended to prevent the hackers from publishing or sharing the stolen data, as well as to restrict its dissemination by third parties, including journalists and security researchers. Despite being served with the injunction, the threat actors openly mocked the legal action and proceeded to release a substantial amount of the compromised data online, demonstrating the limited practical effect of such legal measures on criminal actors. The injunction, however, provided a legal basis for HWL Ebsworth to request that online platforms refrain from hosting or distributing the stolen data, potentially limiting its spread among legitimate entities. This case highlights the challenges organizations face in controlling the aftermath of a data breach, especially when dealing with transnational cybercriminals who are unlikely to respect legal orders. The incident also raises concerns about the balance between protecting sensitive information and the ability of journalists and security professionals to analyze and report on breaches for the public good. Meanwhile, law enforcement agencies continue to target cybercrime infrastructure, as evidenced by the recent seizure of BreachForums, a notorious platform for trading stolen data. The seizure was carried out by a coalition of U.S. and French authorities, including the Department of Justice, FBI, BL2C, and JUNALCO, and resulted in the takedown of both the clear net and onion versions of the forum. At the time of the seizure, the group ScatteredLAPSUS$Hunters was threatening to leak data from 39 Salesforce customers unless a ransom was paid, with high-profile companies such as Qantas, Air France & KLM, Disney/Hulu, UPS, FedEx, Home Depot, Gucci, and Toyota Motors among the potential victims. The law enforcement action included changing the name servers of the forum's domains to those controlled by the FBI, effectively cutting off access to the site and its backup domains. Despite these efforts, some elements of the criminal infrastructure, such as alternative onion sites, remained operational, illustrating the resilience and adaptability of cybercriminal networks. The seizure of BreachForums was met with mixed reactions in underground communities, with some users expressing defeat and others urging continued resistance. These events underscore the ongoing cat-and-mouse dynamic between cybercriminals and law enforcement, as well as the limitations of both legal and technical interventions in fully mitigating the risks and impacts of major data breaches. Organizations targeted by ransomware and data theft must navigate a complex landscape of legal, technical, and reputational challenges in their response efforts. The effectiveness of court injunctions and law enforcement takedowns is often constrained by the global and decentralized nature of cybercrime. Both incidents demonstrate the need for comprehensive, multi-layered strategies to address the evolving threat landscape and protect sensitive data from exposure and misuse.
Jun 29, 2026