Advisories
UK Law Firms Face Rising Phishing and Ransomware Threats – NCSC Guidance
The NCSC report shows UK legal practices of all sizes are increasingly targeted by phishing and ransomware attacks. Defenders should enforce MFA, secure email gateways, keep software patched, maintain regular backups, and run incident response drills.
What Happened
The National Cyber Security Centre (NCSC) released a focused threat report indicating a surge in targeted phishing and ransomware campaigns against UK law firms. The attacks exploit credential theft, malicious attachments, and ransomware-as-a-service platforms.
Impact on the Legal Sector
Law firms, from solo practitioners to large corporate practices, are affected due to the high value of client data and the need for confidentiality. Breaches can lead to data loss, regulatory fines, and reputational damage.
Common Threat Vectors
- Phishing emails with spoofed client or regulatory contacts.
- Malicious attachments or links delivering ransomware.
- Exploitation of unpatched software and weak passwords.
Mitigation Steps for Defenders
- Deploy multi‑factor authentication (MFA) on all user accounts, especially for email and remote access.
- Implement advanced email filtering and sandboxing to block malicious attachments.
- Maintain a strict patch management schedule; prioritize critical OS and application updates.
- Enforce strong password policies and regular password rotation.
- Back up critical data regularly and test restore procedures; store backups offline.
- Develop and rehearse an incident response plan that includes legal, compliance, and client communication protocols.
Additional Resources
For detailed guidance, consult the NCSC’s Cyber Threat Report: UK Legal Sector and the NCSC’s Cyber Essentials checklist.
Related vulnerabilities
CISA & FBI Release Guidance on Clear Crisis Messaging During IT/OT Outages
CISA, the FBI and international partners have issued new best‑practice guidance for service providers on how to communicate during IT and OT outages. The document stresses that clear, timely, accurate, and audience‑appropriate messaging is essential to prevent panic, contain cascading failures and maintain public trust. It outlines core principles—clarity, accountability, transparency—and offers concrete steps for crisis communication planning, legal alignment, operational security, and coordination with law enforcement. The guidance also ties into CISA’s CI Fortify program, which equips criti
Read briefing
SMB Cyber Readiness: Building Resilience Against Rising Threats
SMBs are increasingly targeted by ransomware and phishing attacks, yet many lack mature security controls. This briefing outlines the key steps to assess risk, prioritize defenses, and build a resilient security posture. Focus on patching, MFA, backups, and employee training to reduce exposure.
Read briefing
Iranian Targeted Malware Campaign: CHOSEN BRICK Exploits Dissidents, Activists, and Journalists
The National Cyber Security Centre (NCSC) has identified a new Iranian‑originated malware family, CHOSEN BRICK, that is specifically targeting dissidents, activists and journalists. The malware is delivered via spear‑phishing emails and exploits a Windows credential‑dumping tool to gain persistence. Defenders should block the associated domains, update endpoint protection, and enforce multi‑factor authentication for all users.
Read briefing
CISA & Australia Issue Joint Guidance on Isolating OT and Enabling Systems in Critical Infrastructure
The Cybersecurity and Infrastructure Security Agency (CISA) has teamed up with Australian authorities and other partners to publish a comprehensive set of best‑practice recommendations for segregating operational technology (OT) and enabling systems from enterprise IT networks. The guidance stresses the importance of network segmentation, strict remote‑access controls, continuous monitoring, and incident‑response readiness to protect critical infrastructure from cyber threats that could arise from interconnected systems.
Read briefing