Kravit Law Firm Targeted by Qilin Ransomware Group
Incident Date:
September 23, 2024
Overview
Title
Kravit Law Firm Targeted by Qilin Ransomware Group
Victim
Kravit, Hovel & Krawczyk SC
Attacker
Qilin
Location
First Reported
September 23, 2024
Ransomware Attack on Kravit, Hovel & Krawczyk SC by Qilin Group
Kravit, Hovel & Krawczyk SC, a prominent boutique law firm based in Milwaukee, Wisconsin, has recently fallen victim to a ransomware attack orchestrated by the Qilin group. Known for its specialization in complex litigation, the firm is recognized for its aggressive approach termed "aggravated litigation," which addresses high-stakes disputes. The attack, disclosed on September 23, 2024, on Qilin's dark web leak site, reportedly involved the exfiltration of 510 GB of sensitive data.
About Kravit, Hovel & Krawczyk SC
Kravit Law is a distinguished firm in the legal sector, particularly noted for its expertise in business and commercial litigation, insurance litigation, employment law, intellectual property disputes, and securities litigation. The firm operates with a boutique structure, allowing for personalized client attention and a focused litigation approach. Its attorneys are highly credentialed, with extensive experience in both state and federal courts. The firm's reputation for aggressive representation and significant victories in complex cases makes it a formidable entity in the legal industry.
Vulnerabilities and Attack Overview
The firm's focus on high-stakes litigation and its handling of sensitive client information may have made it an attractive target for cybercriminals. The Qilin ransomware group, known for its sophisticated attack strategies, likely exploited vulnerabilities within the firm's network to gain access. The attack involved a double extortion strategy, where data was both encrypted and exfiltrated, with threats to release the information if the ransom was not paid. The breach highlights the critical need for effective cybersecurity measures in law firms handling sensitive data.
Qilin Ransomware Group
Qilin, also known as Agenda, is a notorious ransomware group operating under a Ransomware-as-a-Service model. The group has gained notoriety for its use of Rust-based malware, enhancing its evasion capabilities and allowing for attacks across multiple operating systems. Qilin's operations have targeted over 150 organizations in 25 countries, employing tactics such as phishing emails for initial access and data exfiltration before encryption. The group's dark web presence serves as a platform for extortion and public shaming of victims.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.