WASHINGTON, D.C., NEW YORK, CHICAGO, MIAMI: A nearly three-year forensic investigation is mapping a commercial cyber pipeline that can steal a lawyer’s secrets, counterfeit professional authority and distort the digital pathways that carry a case toward judicial action — while the beneficiary may sit several contracts away from the keyboard.
Author: Jay Lewis Farrow
CYBER MERCENARIES / EXPOSE ARTICLE ONE • OCTOBER 15, 2026
Fifteen digital-forensics and incident-response teams have spent nearly three years quietly mapping attacks on lawyers, litigants and the systems around them across more than 35 countries — incidents that once looked separate. They compared compromised mailboxes, altered communications, cloud and domain records, court files, professional identities and known hacker-for-hire prosecutions.
The recurring pattern they describe is more consequential than a stolen password: money can move through layers of advisers, investigators and technical crews until a legal adversary’s private strategy, identity or communications become another instrument in the fight. Taken together, the work amounts to a counter-operation against a service industry: trace the client chain, fingerprint the operators, test suspected incidents against controls, and follow the benefit back toward whoever wanted the result.
The public record shows how the first part of that business works. In 2013, ViSalus, a California network-marketing company fighting a Utah competitor called Ocean Avenue, hired private investigator Nathan Moser. Moser worked with investigator Peter Siragusa, who prosecutors said hired hackers in California and India to break into opponents’ email, Skype and computer accounts. The purpose, the Justice Department later said, was to obtain information useful to paying clients in civil lawsuits. A Reuters reconstruction traced the money and assignments through the chain.
That case ended with guilty pleas. The investigation assembled for this series asks what happens farther down the conveyor: after access is gained, when the target is a lawyer, when a professional identity is copied or controlled, when messages stop reaching the people meant to receive them, or when a seemingly ordinary digital input reaches a court, regulator, employer or publisher and produces a real-world result.
PHOTO 1 | Courtroom interior, documentary-style image for Article 1. Used here to underscore the article’s central point that legal outcomes depend on real people, real rooms, and trusted institutional process.
The business behind the hands on keyboard
The ViSalus case stripped away the mythology of the lone hacker. Carlo Pacileo, the company’s security director, did not need to locate a foreign intrusion crew himself. He retained Moser, a private investigator he knew. Moser and Siragusa knew technical operators. Prosecutors identified Trent Williams in California and Sumit Gupta in India as hackers they employed. The service moved through recognizable business relationships: client, investigator, specialist, result.
That model became much larger. In 2020, the University of Toronto’s Citizen Lab published a multi-year investigation called Dark Basin, documenting thousands of targets on six continents, including lawyers, journalists, activists and people involved in high-stakes disputes. A WIRED account described the scale of the operation and its link to personnel associated with India-based BellTroX. Two years later, Google’s threat researchers explained the commercial division of labor in even plainer terms: private investigators could commission account intrusions from Indian suppliers and receive stolen information after the job was done.
The companies and personnel do not have to remain static for the market to survive. Workers migrate. Freelancers appear. A firm closes or changes names. The customer still knows a lawyer, security executive, political consultant or investigator who knows the next person in the chain. Reuters’ investigation of the Appin ecosystem showed how an Indian training startup became part of a much broader global hack-for-hire story that spanned years, companies and continents.
Aviram Azari’s criminal case showed the economics from the broker’s side. From November 2014 through September 2019, clients paid his Israeli private-intelligence business more than $4.8 million. His teams maintained project lists, ranked targets, attacked people surrounding the main target and sent progress reports when an account had been successfully opened. On November 16, 2023, a federal judge in Manhattan sentenced Azari to 80 months in prison.
The Justice Department’s sentencing account described victims living with financial loss, fear, sleeplessness and what one called “psychological assault.”
The keyboard operator was only one job in the enterprise. The broker owned the customer relationship. Supervisors managed the work. Targets included relatives, colleagues and associates because surrounding people offered another route into the principal target — and another way to consume time, trust and emotional reserves.
DIAGRAM 1 | THE CYBER MERCENARY CONVEYOR. Original graphic for Article 1. It separates the customer, adviser, broker and technical crew, then shows how tasking and payment move down the chain while stolen material, status reports and advantage move back up.
The Cyber-Fingerprint Emerges
The newer forensic work starts where most breach reports stop. Investigators are not simply asking whether malware ran on a laptop. They are reconstructing a sequence: who had something to gain; which adviser or investigator was engaged; whose account, device or professional identity was targeted; what changed in the flow of messages or records; what an institution received; and what happened to the person or case afterward.
The source materials describe 15 independently working forensic and incident-response teams, comparisons against more than 40 federal cyber cases and takedowns, tests involving thousands of email addresses, endpoint and cloud records, and case-study work across a large population of federal proceedings.
One Southern District of Florida source table became a test population because recurring defense-side attorney appearances could be compared with service records, communications and later procedural events. The table is only one piece of the puzzle towards determining whose fingerprints were on those keyboards during active cyber attacks. Thus, Its value is that it gave investigators a repeatable place to test whether the same combinations of identity, timing and communications appeared again.
The private study population is broad enough to test repetition rather than anecdote. Its source materials describe nearly 200 federal proceedings in one district in which investigators examined professional identities, appearances, communications and later case events, alongside records from cyber takedowns and known intrusions. Investigators used controls—ordinary amended filings, routine lawyer substitutions, benign cloud changes—to separate common court administration from the combinations they were actually hunting.
The method is closer to accident reconstruction than signature matching: establish the normal route, identify where it changed, then work backward through the digital evidence to find who had control at each step.
Some tests are simple enough to explain without cyber jargon. If a message says it came from a lawyer, investigators ask whether the lawyer actually sent it. If a filing carries an attorney’s name, they compare the filed document, the account used to submit it and the notices sent afterward. If email suddenly stops arriving, they examine whether a forwarding rule, mailbox session or mail-routing setting changed. If a document in an official system is replaced, they compare versions, timestamps and the event that authorized the replacement.
Other work follows infrastructure. The internet has address books that tell browsers where a domain lives and email where to go. An attacker who controls those settings can redirect a visitor or a message without changing the familiar name the victim typed. Investigators therefore compare time-specific domain records, cloud configuration, message headers, account histories and provider logs. A shared cloud provider means little by itself.
A timed change that coincides with account access, altered delivery and a consequential legal event means much more.
When attackers keep access, reuse identities and infrastructure, watch a target over time and adapt when defenders intervene, cyber professionals call the behavior an advanced persistent threat. The phrase is less important than the practice: persistence turns a break-in into an operation.
This is where Shakespeare’s old lawyer joke becomes less funny. “The first thing we do, let’s kill all the lawyers” is spoken from a rebel camp imagining power without legal restraint. The modern version does not require killing anyone. Compromise the lawyer who can fight, keep the other side’s counsel fully operational, and let the institutions around them continue to look normal.
PHOTO 2 | Law library reading room, documentary-style image for Article 1. The image reinforces the article’s focus on legal work product, professional judgment, and the institutional culture that cyber interference seeks to exploit.
When the lawyer or law firm become the target
London supplied a documented example in the summer of 2020. Princess Haya bint Al Hussein, estranged wife of Dubai ruler Sheikh Mohammed bin Rashid Al Maktoum, was fighting over the welfare and arrangements for their two children in the Family Division of England’s High Court. Her legal team included Fiona Shackleton, one of Britain’s best-known family solicitors, and Nicholas Manners. Their job depended on private conversations: what evidence existed, what the client feared, what strategy to pursue and what to tell the judge.
On August 5, 2020, Shackleton received two warnings that the legal team might be under electronic surveillance. One warning reached her through barrister Cherie Blair after a senior figure at an Israeli surveillance company raised an alarm. The Guardian reconstructed the day, while a separate report detailed Blair’s warning to Shackleton.
The tool involved could silently enter a smartphone and copy messages, contacts, location data and other private material, sometimes without the owner clicking anything. Its commercial name was Pegasus. After examining the technical evidence, Sir Andrew McFarlane, president of the Family Division, found on May 5, 2021, that approximately 265 megabytes of data had been taken from Haya’s phone and that the phones used by Shackleton and Manners had probably been successfully hacked.
The court attributed the surveillance to the ruler’s express or implied authority. The findings became public that October, when the Guardian reported the judgment.
A lawyer can replace a handset. A client cannot retrieve a privileged conversation after the opposing side has heard it. That is the operational prize: not “data” in the abstract, but foreknowledge of the adversary’s preparation.
The personal consequence can arrive through reputation as well as procedure. In October 2022, former Wall Street Journal chief foreign correspondent Jay Solomon sued over what he said was a hack-and-leak campaign built from private emails between him and Azima, one of his sources. The messages were assembled into a dossier and surfaced at the point of maximum professional vulnerability; Solomon lost his job in 2017. A Reuters report on the lawsuit described his allegation that Indian hackers had been used to obtain the correspondence.
The remaining federal claims were later dismissed, while some defendants settled. The episode shows why a stolen message is not merely intelligence. Once selected, packaged and delivered into an employer or newsroom, it can become a career event.
A poisoned judgment can take years to unwind
The longer cost appears in another English case. In September 2016, the Ras Al Khaimah Investment Authority, a state investment body in the United Arab Emirates, sued American aviation businessman Farhad Azima in London over disputed commission payments. Roughly 30 gigabytes of Azima’s emails and computer data had been hacked and published online. Material from the trove entered the litigation. After a January-February 2020 trial, the High Court ruled against him.
Azima then had to fight the result itself. He pursued evidence about the hacking, brought further claims and sought to set aside the judgments.
On March 25, 2024, Justice Michael Green set aside earlier High Court and Court of Appeal judgments as procured by fraud in proceedings in which the investment authority was no longer participating. Reuters later described how the hacking litigation generated separate claims and settlements, including Azima’s 2024 settlement with Dechert and the resolution of related U.S. lawsuits in 2025.
The reversal did not end the expense. On June 10, 2024, Green addressed Azima’s effort to freeze assets while enforcing awards and costs exceeding £20 million. Nearly eight years after the original lawsuit began, the fight had moved from winning the case, to proving the case had been corrupted, to collecting on the correction.
A target must survive the first proceeding, preserve evidence, hire forensic specialists and another legal team, win a second fight and then enforce the result. The original intrusion can take minutes. Restoring a legal record can take years.
DIAGRAM 2 | FROM COMPROMISED INPUT TO REAL-WORLD CONSEQUENCE. Original graphic for Article 1. The upper lane shows adversarial control of identity or communications; the lower lane shows how a genuine institution can still take real action on corrupted upstream input.
The courthouse and court adjacent cyber-infrastructure is part of the attack surface
American courts now have their own reason to understand that distinction. On August 7, 2025, the Administrative Office of the U.S. Courts publicly disclosed sophisticated and persistent cyberattacks against the nationwide system used by federal courts to receive filings and manage cases. Reuters reported the disclosure; POLITICO reported that core filing infrastructure had been compromised.
For a nonlawyer, the function is straightforward. Lawyers submit motions and evidence through an electronic system. The system records what was filed and tells other participants what they must answer. Stronger login protection can make stolen credentials harder to use. It cannot, by itself, tell a judge whether a message arriving from a compromised mailbox was truly authorized, whether a document was altered before submission or whether a professional identity had already been co-opted upstream.
The counter-offensive is also becoming more organized. In March 2023, Microsoft, Fortra and the Health Information Sharing and Analysis Center won a federal order in Brooklyn to disrupt servers distributing cracked copies of Cobalt Strike, a legitimate security-testing tool abused by criminals.
BleepingComputer documented the operation: technical researchers mapped infrastructure, lawyers obtained judicial authority and providers were enlisted to dismantle it. That case involved a different class of cybercrime, but it showed what disrupting an ecosystem requires — not merely catching one person at a keyboard.
The pressure is moving up the supply chain. In September 2026, Reuters reported that a bipartisan group of lawmakers urged the Commerce Department to blacklist three India-based firms linked in investigations and reporting to hack-for-hire activity.
A separate criminal case against Israeli investigator Amit Forlit has focused attention on who allegedly commissioned attacks against climate advocates; Grist traced the alleged chain, while Reuters covered Forlit’s London extradition proceedings. Forlit has pleaded not guilty.
Accountability can reach corporations as well as operators. After eBay security personnel terrorized newsletter publishers David and Ina Steiner in Massachusetts in 2019, the company entered a federal deferred-prosecution agreement and paid a $3 million criminal penalty. In July 2026, Reuters reported a further civil settlement worth $55.7 million.
That was a corporate intimidation campaign, not the same hack-for-hire operation, but it demonstrates that distance from the hands-on actor need not end responsibility.
PHOTO 3 | Court-records service counter, documentary-style image for Article 1. The image illustrates the ordinary intake and records workflow through which compromised information can enter legitimate institutions and produce real consequences.
The investigation’s central finding is not a malware name. It is a business architecture: money and instructions can travel down through layers while stolen information, status reports and strategic advantage travel back up. Between those two directions sit real people — lawyers, clients, clerks, reporters, witnesses — and real institutions that can act in good faith on information they have reason to trust.
DIAGRAM 3 | THE BUSINESS LOOP. Original graphic for Article 1. It shows how money, status reports and completion of a client’s wish list can produce repeat business and a broader chilling effect.
The next installment follows the next fight: how victims and defenders use civil litigation itself as a cyber-defense weapon — and what happens when takedown strategies, evidence preservation and the lawyers bringing those cases become targets too.
About The Author: Jay Lewis Farrow
Jay Lewis Farrow is a cybersecurity operator, investigative researcher, author, and crisis-response specialist whose work spans the legal, insurance, private equity, financial, and corporate sectors, focusing on how sophisticated cyber threats exploit trusted communications, institutional authority, and professional relationships.
Farrow’s current research and operational engagements include how templated APT tradecraft exploits interconnected attack surfaces of authority, intake, routing, reputation, and institutional outcomes, as well as, field emergency incident-response coordination with independent cybersecurity specialists and those within the broader Joint Cyber Defense Collaborative ecosystem.
Farrow is the Founder and Chairman of the National Attorneys Cybersecurity Association, NACABAR, a Florida-based national nonprofit advancing cybersecurity awareness, investigative research, education, and collaborative resilience throughout the legal profession. Now entering its third year, NACABAR’s monthly out-of-band outreach program has grown to over 300 federal, state, and local bar associations throughout all fifty states, and has launched an initiative to issue regular legal-sector threat assessments.
In July 2026, NACABAR was honored to become an Official CLE Provider and its First Technology Course accredited by The Florida Bar which is facilitated by Farrow as both featured speaker and facilitator.
Farrow also serves as Executive Curator of the Cyber Law Library, an independent, open-access research resource preserving hard-to-find judicial records, forensic reports, investigative scholarship, and specialized cybersecurity literature.