White paper
The update was signed. That was the problem.
A 180-seat legal practice installed a routine update from a vendor it had every reason to trust. Eleven days later an adversary had mapped the network, reached the document management system, and opened a channel out. Nothing that ran was malware.
Why a law firm
High value, low friction, and almost never a security team.
A mid-sized practice holds merger terms, litigation strategy, settlement positions and the personal affairs of everyone it represents. Priced by what it would be worth to the other side of any one matter, it is among the most valuable networks of its size anywhere.
It also tends to have an IT manager rather than a security function, a heavy dependence on managed software, and a professional obligation to keep working. That combination is why the sector keeps appearing in breach reporting, and why the usual advice to isolate a suspect machine lands so badly.
11days
Between the update landing and the first analyst noticing anything
47
Signals raised across five tools, every one of them judged correctly
0
Pieces of malware involved at any stage of the intrusion
The uncomfortable part
Nobody made a mistake. Every tool reached the right verdict about the slice it could see, and the campaign was still invisible, because no tool could see across the others.
The paper
Eighteen pages, and the whole reconstruction.
How the campaign was assembled from events that individually meant nothing, how the command-and-control path was cut without taking a single matter offline, and what a firm without a security team can reasonably do about any of it.
- 01Why a legal practice is a high-value, low-friction target
- 02The trusted update: how signed software becomes the entry point
- 03Eleven days of living off the land, stage by stage
- 04The forty-seven signals, and why every one was judged correctly
- 05Reconstruction: linking events by behaviour rather than by source
- 06Disrupting at the edge without taking a single matter offline
- 07What a firm without a security team can reasonably do
- Passive deployment on a mirror port, in under an hour
- Works with the stack you own and replaces none of it
- Advised by former US defense, intelligence and industry security leaders
See it live
Or watch one get caught instead.
The same argument, as a walkthrough you can click through in five minutes, ending in the console that produced it.