Threat Actors Legal Sector Cyber-Attack Continues to Evolve As Courts Struggle to Replace Core Infrastructure
The September 2026 Cyber N.E.T. Forensics Threat Assessment Report’s Findings warn that the legal profession’s most consequential cyber risk now reaches across identity, cloud authority, DNS, mail, portals and the records those systems make authoritative.
September 15, 2026
Cyber N.E.T. Forensics, in collaboration with associates and strategic partners within the Joint Cyber Defense Collaborative Ecosystem.
Lead Author- Research Director – Outreach Investigation Coordinator – Jay Lewis Farrow
WASHINGTON, D.C. As the top NASA Director notoriously questioned as the first reports of the damage to Apollo 13 came in – What’s actually working on the spacecraft?
The September 2026 Threat Assessment Report by Cyber-N.E.T. Forensics whom, with other entities and individuals, mapped the Advanced Persistent Threat which targets lawyers, law firms, courts, legal proceedings and judicial cyber-infrastructure provides a similarly damaging outlook as to the current state of the evolving cyber-attack which one may also ask, what trusted court and court adjacent trusted systems have not been compromised.
That is the central professional problem raised by Cyber-N.E.T. Forensics’ September 2026 assessment, Cyber-N.E.T. Forensics: cAPTure-to-Kill APT—Mapping, Attributing, and Containing an Evolving Threat.
While experts may remain highly concerned, their Threat Assessment and message is strikingly aligned with the mindset that legal sector professionals must remain vigilant while not assuming that threat actors maintain total control over each eFiling, eService and communication related to court proceedings.
They do, however, desire to invite legal professionals into a new mindset which provides that they are now on the front lines of cyber-defense and that their specific training can unlock and decode a possible cyber-attack upon legal matters prior to their IT teams.
In short, the Expert Threat Assessment Report, which overlays threat actor activities for nearly a year since their last Integrated eForensic Report with defined, mapped and determined substantial attribution as to the cAPTure to Kill APT which targets attorneys, law firms, courts, court officials and court-adjacent relationships to manipulate proceedings, as opposed to, by example a ransom demand.
Currently, as before, the September 2026 Threat Assessment does not assume or ask legal sector professionals to presume that every irregularity as malicious. It asks them to stop treating authentication as the end of the inquiry when the account, tenant, mailbox, DNS zone, service list or filing identity may be the thing under dispute.
The report’s most useful contribution for practicing lawyers is the phrase “trusted control plane.” In the legal environment, that plane is not a single network appliance.
It is the combined authority by which a person is allowed to act and a downstream system accepts that act as legitimate: account identity, cloud permissions, DNS, mail routing, document custody, filing portals, service lists, case-management systems, professional directories, collaboration platforms and the publication channels through which official action becomes visible.
The report’s proposition is blunt: an adversary who captures that plane can obtain more leverage than an adversary who merely encrypts one laptop
The control plane lawyers actually use
Law firms have spent years improving endpoint hygiene, and they should. But a modern matter is no longer controlled only from the lawyer’s device. Draft pleadings may sit in cloud storage. Experts send appendices through collaboration tools. DNS records decide which web server and mail exchanger answer for a domain.
A filing portal decides which identity can submit a document. A service list decides who receives notice. A repository or public-indexing system decides whether a later investigator can find the order. The September assessment argues that the attack surface is the workflow itself.
That framing is especially useful because it does not rely on one dramatic malware family.
The assessment uses a four-layer proof model. The first layer is source-side evidence, such as endpoint artifacts, DNS and RDAP records, MX history, headers, portal events, court records, document-state differences and preserved timing.
The second layer is prior expert analysis from separate rails including Marlin Technologies, Cyber-N.E.T. Forensics October 22, 2025 Report and CNF 2026 Series Reports, Bridge-Gate E.S.S. Division’s Restricted Access Portal Solutions Unit (“RAPS”), and the Cryptographically Counterfeit Defense Group (“CCDG”).
The third is independent authority: government advisories, vendor research, official documentation, sworn declarations and court orders.
The fourth is later corroboration showing the same operational primitive in another environment. The report says conclusions are strongest only when those layers converge.
That is why the report repeatedly warns against shortcuts. A remote-management agent may be legitimate software. A Route 53 change may be ordinary administration. An email may pass SPF, DKIM and DMARC. A professional profile may be genuine. A portal may record a successful login.
A docket may display a document. None of those facts, standing alone, proves hostile control. The assessment’s evidence standard is not suspicion by accumulation; it is correlation across independently preserved states that point toward the same mechanism and leave fewer benign explanations.
A CC0 computer-vision reference photograph of a photographer and camera. The image is used as an illustrative visual for source-object documentation and independent verification.Image: Lav Varshney, via scikit-image sample data. Source and rights documentation. License: CC0/no copyright restrictions, as stated in the scikit-image data documentation
For lawyers, the hardest adjustment is conceptual. Authentication proves that a system accepted a credential or path. It does not necessarily prove that the intended human being controlled it.
The report’s communications rail, CCDG, makes the point through email: a message can pass authentication and still be operationally counterfeit if an adversary controls the authorized account, tenant, relay, signing path, mailbox permission or DNS state. RAPS extends the same idea to portals, where the filing object, intake object, docket object, service notice, recipient copy and public copy can become separate evidentiary states.
Public-source verification supports the mechanism even where it does not prove any specific subject event. Truffle Security reported in August 2026 that it re-verified 10,616 leaked AWS key pairs and found that 88 percent still authenticated, including 768 live business-linked keys with root or AdministratorAccess privileges.
AWS documentation confirms that Route 53 record changes can be submitted as transactional batches and that IAM permissions govern which identities can perform those actions. Those public facts do not identify who controlled a disputed DNS event in any particular legal matter. They do show why a cloud provider may process a technically valid request while the customer-side authority behind it remains the real question.
The same discipline applies to timing. A registration-data update timestamp proves that a registrar or registry record changed or refreshed at that time. It does not automatically prove the second an attacker changed a DNS record or identify the person responsible.
The assessment uses synchronized update windows as investigative constructs, not automatic guilt markers. Their probative value comes from recurrence, narrow timing, common provider or nameserver families, surrounding communications, portal events and litigation milestones. The unresolved evidence remains customer-side custody and provider audit history.
The report’s mailbox and identity findings are similarly bounded. It points to public reporting on server-side mailbox and token persistence to explain why replacing a device and rotating a password may not end access when permissions, OAuth grants, refresh tokens or another organizational account remain active.
Microsoft’s identity research has separately described adversary-in-the-middle phishing, device-code abuse and OAuth consent attacks that can produce access tokens or persistent cloud authorization. The lesson is not that multifactor authentication is futile. It is that MFA must be interpreted within a larger credential lifecycle that includes device registration, app consent, service principals, mailbox permissions and recovery paths.
A public-domain reference image of printed handwriting used in computer-vision examples. It illustrates why record-object states must be preserved and compared by source, version and hash. Image: Wikipedia source image distributed with scikit-image sample data. Source and rights documentation. License: no known copyright restrictions/public domain, as stated in the scikit-image data documentation
What public records now verify
The federal judiciary’s own disclosures supply the institutional anchor. On August 7, 2025, the Administrative Office of the U.S. Courts announced strengthened cybersecurity measures after escalated attacks of a sophisticated and persistent nature against the Judiciary’s case-management system.
PACER had already announced a 2025 MFA rollout under which CM/ECF-level users would be required to use MFA by the end of 2025, while PACER-only users could enroll but were not nationally required to do so. In 2026, the Judiciary described accelerated modernization of the aging CM/ECF platform and later approved funding for secure cloud storage and replacement components. Those actions verify the risk class. They do not prove that any particular docket anomaly was malicious.
The assessment’s outside litigation comparator is Microsoft Corporation, Fortra, LLC and Health-ISAC, Inc. v. John Does 1-16, No. 1:23-cv-02447 in the Eastern District of New York. Microsoft and its partners announced a 2023 legal and technical action against cracked legacy copies of Cobalt Strike, and the public order entered on September 8, 2025, adopted a permanent injunction with domain, DNS, IP, server, preservation and continuing-enforcement provisions.
The report treats that case as a model of evidence specificity: declarations and orders matter because they describe configuration, watermark, telemetry, controlled infection, victim data, credentials, process behavior and role relationships, not because the same large cloud provider appears in more than one event.
That distinction protects both attribution and fairness. The assessment does not conclude that Amazon, Microsoft, Cloudflare, any court, any law firm, any registrar or any collaboration platform did something wrong merely because their services appear in a trust chain. Large providers are valuable precisely because legitimate traffic flows through them.
The question is customer-side authority: which account, role, tenant, hosted zone, origin, mailbox, portal profile or administrative identity controlled the action at the material time? A shared ASN or CDN is an investigative lead, not an actor identity.
The preservation shift
The practical consequence for lawyers is a change in what must be preserved at the beginning of a suspected incident.
The first question is still whether devices are clean, but it is no longer sufficient. Lawyers need DNS and MX history, registrar and hosted-zone events, cloud-audit logs, mailbox permissions, forwarding rules, OAuth grants, device registrations, application-consent records, portal access telemetry, NEFs and service lists, file hashes, page counts, attachment lists, public-copy versions and repository timestamps. They also need to preserve who had authority to change those states.
The September assessment is intentionally falsifiable. A provider’s audit history might show that a disputed DNS change was made by a known administrator. A mailbox log might show no permission alteration. A portal backend might prove that a filing originated from a recognized device and session. A hash comparison might establish that the filer, intake, docket and recipient copies are identical.
Those results would narrow or defeat the assessment for that event. The point is to obtain the records needed to answer the question, not to preserve a theory at all costs.
A CC0 brick-wall texture image used as an illustrative visual for layered trust surfaces. It is not evidence of any reported event.Image: CC0Textures source image, via scikit-image sample data. Source and rights documentation. License: Creative Commons CC0, as stated in the scikit-image data documentation
The methodology also matters for client counseling. A lawyer presented with a disputed filing, altered DNS record, missing notice or authenticated message should not begin by accusing the court, the provider, opposing counsel or a vendor.
The disciplined starting point is preservation.
The source object, the credential history, the service path, the mailbox state and the public version must be fixed before remediation overwrites the evidence. That is why the report treats separate expert rails as a strength rather than a flourish. Marlin, Team B, RAPS, CCDG, Sinkhole, Avatar and the federal-court audit examined different objects and different trust boundaries. Their work becomes significant only where those independent rails converge; it does not make every isolated observation hostile.
Professional identity is a second uncomfortable example. The assessment discusses public FBI and Department of Justice recordsabout North Korean remote IT worker schemes not to suggest that every sparse biography or unusual online profile is synthetic, but to show that legitimate institutions can issue real credentials to the wrong human actor. Once that happens, downstream systems do not see a fake profile.
They see an employee, contractor, collaborator or verified account. For law firms, bar organizations, vendors and courts, the practical question becomes provenance: who was identity-proofed, who received the device, who controlled the account, who enrolled the authenticator and who approved recovery when a credential was reissued.
That emphasis changes the first hour of response.
The right question is not only whether the workstation is infected. It is whether a session survived in the browser, whether an OAuth grant remains live, whether a mailbox rule forwards or exposes messages, whether a hosted zone or registrar account changed, whether a cloud key has permissions beyond its intended role, whether a filing credential was recovered or reactivated, and whether the served copy matches the submitted and docketed copies.
Lawyers do not need to become cloud engineers to preserve those questions. They need an incident plan that prevents ordinary cleanup from destroying the very logs and object states required to prove control, clear the channel or disprove the allegation.
No law practice can eliminate every compromised channel before work resumes. The stronger standard is selective independence. Critical instructions should be confirmed outside the suspected path. Provider records should be requested before retention windows close. Domain, mailbox and portal administrators should be identified as evidentiary custodians, not merely support contacts.
When the integrity of a filing or notice is disputed, lawyers should ask for the source object and transmission history rather than debating screenshots. That shift is not defensive paranoia. It is ordinary proof practice applied to systems that now create legal consequences automatically.
That is also how the report avoids turning technology into an accusation. The appearance of a cloud provider, registrar, law firm, court system or repository in a trust chain is not a finding of culpability. In a legal cyber incident, those entities are often the only institutions capable of proving what occurred. The task is to ask for source-native evidence before ordinary assumptions harden into a procedural outcome.
That is the professional line lawyers should hold. The report’s cAPTure-to-Kill label is an analytical framework, not a government threat-group designation and not a shortcut to naming a natural person. Its operational warning is stronger because it is narrower: trusted systems can produce valid-looking legal consequences even when the authority behind the transaction is contested.
The future of legal-sector incident response will turn on proving or disproving authority, object identity, routing, recipient state and publication state before the ordinary-looking record becomes the irreversible record.
About the Author – Jay Lewis Farrow
Jay Lewis Farrow is a legal-sector cybersecurity analyst, writer, and training developer whose work focuses on advanced persistent threats affecting attorneys, law firms, judicial and quasi-judicial infrastructure, court-clerk operations, and legal-industry supply chains.
Farrow, working with national and international cybersecurity professionals and organizations who participate within the Joint Cyber Defense Collaborative ecosystem, has contributed to published forensic expert reports and published analysis addressing litigation forensics, endpoint analysis, DNS hijacking, cloud-service abuse, counterfeit communications, restricted-access portals, professional-identity risk, evidence preservation, and strategic incident response. Most recently, Farrow was the Lead Author- Research Director – Outreach Investigation Coordinator of the September 2026 Cyber-N.E.T. Forensics’ cAPTure-to-Kill APT Threat Assessment Report.
He is the founder and chair of the National Attorneys Cybersecurity Association (NACABAR) and serves as its CLE course developer and featured speaker for a Florida Bar-Accredited Technology CLE course. Additional content and materials by Jay Lewis Farrow can be found on NACABAR YOUTUBE CHANNEL, NACABAR FACEBOOK PAGE, and on NACABAR INSTAGRAM.