Zero-day lets nation-state spies cross-examine elite US law firm Williams & Connolly
- Reference: 1760004970
- News link: https://www.theregister.co.uk/2025/10/09/zeroday_nationstate_us_law_firm/
- Source link:
In a [1]statement , the firm said it "recently discovered a cybersecurity incident involving access to certain systems on our network," and that the attackers had "leveraged what is known as a zero-day attack." It added that, based on an investigation conducted with CrowdStrike, the threat actor was affiliated with a nation-state group "responsible for recent attacks on a number of law firms and companies."
Security nightmare stories needed!
Boss get the company hacked because he taped passwords to his monitor? Coworker get phished by a Nigerian prince?
Share the dirty details and they might appear in a future edition of PWNED, our new weekly feature about the worst security breaches that never should have happened.
Drop us a line at [2]pwned@sitpub.com . Your anonymity is guaranteed.
Williams & Connolly stated that there was no evidence that confidential client data had been extracted from its databases, which store sensitive case files.
Williams & Connolly added that it had "blocked the threat actor" and found "no evidence of any unauthorized traffic" remaining on its network.
The breach is particularly sensitive given the firm's high-profile client roster, which includes Bill and Hillary Clinton, Theranos founder [3]Elizabeth Holmes , and major players in the technology, healthcare, and media industries.
[4]
While the firm stopped short of naming the country it believes responsible, some reports have attributed the intrusion to China-linked hackers. That aligns with a [5]September advisory from Google's Threat Analysis Group and Mandiant, which warned that China-nexus threat clusters had been exploiting multiple zero-day vulnerabilities to infiltrate the US legal sector and gather intelligence on national security and international trade.
[6]
[7]
According to Google, the attackers maintain long-term stealthy access to victim networks, averaging 393 days before detection, by planting custom malware on systems that don't typically run endpoint security tools, such as VPN appliances, VMware vCenter servers, and other edge devices. Once inside, they've been observed cloning virtual machines, creating rogue admin accounts, and using "common techniques to conduct bulk email access and exfiltration from Microsoft 365 Exchange Online."
Eau no! Dior tells customers their data was swiped in cyber snafu [8]READ MORE
An apparently similar campaign is thought to have breached more than a dozen law firms and technology companies in recent months. The intrusions reportedly focused on collecting information from attorneys and corporate advisors involved in politically or economically sensitive cases.
[9]Clop raid on Oracle E-Business Suite started months ago, researchers warn
[10]Microsoft blames Medusa ransomware affiliates for GoAnywhere exploits while Fortra keeps head buried
[11]Level-10 vuln lurking in Redis source code for 13 years could allow remote code execution
[12]India's tech talent pipeline is sputtering
Law firms have long been a prime target for state-backed espionage, serving as convenient proxies for intelligence gathering. They often hold confidential communications, deal data, and litigation materials tied to government policy and corporate negotiations, information far more difficult to extract directly from official or corporate systems.
With clients spanning former presidents and Fortune 100 companies, Williams & Connolly's inboxes are an attractive target for adversaries seeking leverage or insight into the US legal and policy apparatus.
Neither Williams & Connolly nor CrowdStrike has stated which zero-day flaw was used, although the firm's wording suggests that the exploit was patched only recently or remains unpatched elsewhere. "Williams & Connolly is committed to protecting the confidentiality and security of its clients' data," the firm said, adding that it continues to work with in-house and external cybersecurity experts to strengthen its defences.
[13]
For a law firm accustomed to arguing landmark cases, it's an unwelcome reminder that in Washington, even the best defences can be out-litigated by a zero-day. ®
Get our [14]Tech Resources
[1] https://www.documentcloud.org/documents/26182937-statement-of-williams-connolly-llp/
[2] mailto:pwned@sitpub.com
[3] https://www.theregister.com/2023/05/17/elizabeth_holmes_prison/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aOfcGHKSyOPwH7CFouS9NAAAAVM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aOfcGHKSyOPwH7CFouS9NAAAAVM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aOfcGHKSyOPwH7CFouS9NAAAAVM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2025/07/24/eau_no_dior_tells_customers/
[9] https://www.theregister.com/2025/10/07/clop_oracle_ebs/
[10] https://www.theregister.com/2025/10/06/microsoft_blames_medusa_ransomware_affiliates/
[11] https://www.theregister.com/2025/10/06/perfect_10_redis_rce_lurking/
[12] https://www.theregister.com/2025/10/04/india_tech_talent_pipeline/
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aOfcGHKSyOPwH7CFouS9NAAAAVM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
As a government cyber security person once told me "You will never know the Americans have been in your systems, you'll only know if the Russians have been, if they want you to know and you'll probably spot the Chinese but they are learning at a rapid rate and will soon surpass the Russians" that was 3 years ago.
There is a big difference between securing your IT systems against nation states and securing them against, for want of a better expression, private enterprise hacking. Realistically securing your systems against NSA intrusion is not financially viable. And that's before we even consider that your SaaS etc. are housed in readily available infrastructure in the US or touchable by the US. But that's like worrying about spy satellites taking pictures of you. A bit pointless. But so many of these "breaches" are not relying on nation state backing, basic cyber security hygiene is not observed. Your typical data breach relies on piss poor controls, so once a zero day is found and they penetrate your hard crunchy outer layer, they have relatively easy access internally, can move laterally, escalate permissions, all the good stuff we have seen for years. But with no internal controls, tripwires or monitoring, once in, they run rampant.
I have said it before and I will say it again, proper punitive punishments for Execs and boards would concentrate minds wonderfully. There are some well established frameworks out there to ensure that good hygiene is practiced. If every time a breach occurred, a forensic review by an independent 3rd party took place and if the company was found lacking, fines and prison time were on offering, you would see a remarkable reduction in these types of events.
We have the concept of fiduciary duty, a similar cyber security duty would be useful if properly implemented and with teeth.
A bit short on technical details ..
A bit short on technical details and what was such case files even doing accessible over the Internet. A local lawyer firm won't allow anything be brought into or out of the computer room - except paper.
> Williams & Connolly added that it had "blocked the threat actor" and found "no evidence of any unauthorized traffic" remaining on its network
This is self serving BS. I'm sure these state-linked Chinese hackers would have heard of "lateral movement". These kind of security breeches are a daily occurrence. In conclusion: yer modern integrated innovation isn't fit for purpose. And now they want to stick AI on top of this.