INC_RANSOM Ransomware Targets Miami Law Firm
INC_RANSOM Claims Attack on Miami Law Firm Golden Glasko Haddy
Impact Scope
Affected Companies
Industries Affected
Related Entities
Threat Actors
Other
Full Report
Executive Summary
Golden Glasko Haddy and Associates, P.A., a law firm in Miami, Florida, specializing in estate planning and probate law, has been targeted by the INC_RANSOM ransomware group. On July 14, 2026, the firm's name appeared on the threat actor's data leak site, a common tactic used in double-extortion schemes. The attackers claim to have breached the firm's network and exfiltrated sensitive internal files, which they are threatening to publish if a ransom is not paid. Given the firm's specialization, the stolen data could include highly sensitive and confidential client information, such as financial records, wills, and trusts, posing a significant risk to the firm and its clients.
Threat Overview
INC_RANSOM is a ransomware operation that emerged in late 2024 and has a history of targeting professional services firms, including legal practices. By listing Golden Glasko Haddy and Associates on their public leak site, the group is applying public pressure to force a payment. This tactic exploits the reputational damage and legal liability a law firm faces if confidential client data is exposed. The group has not yet released any samples of the stolen data or specified the volume exfiltrated, which is a typical step in their extortion process.
Technical Analysis
INC_RANSOM attacks often leverage common initial access vectors and tools. A likely attack chain would include:
- Initial Access: Gaining entry through exposed RDP, stolen VPN credentials, or a successful phishing campaign (
T1566 - Phishing). - Discovery: Once on the network, the attackers use native Windows tools (
net,whoami) and scripts to map the internal network and identify valuable data repositories, such as file servers containing client case files. - Credential Access: The group may use tools like Mimikatz to harvest credentials from memory to escalate privileges and move laterally (
T1003 - OS Credential Dumping). - Exfiltration & Impact: Before encryption, sensitive files are compressed and exfiltrated to an actor-controlled server (
T1560 - Archive Collected Data). Finally, the ransomware payload is deployed to encrypt files across the network (T1486 - Data Encrypted for Impact).
Impact Assessment
For a law firm specializing in estate and probate law, a data breach is particularly damaging. The potential impact includes:
- Breach of Attorney-Client Privilege: The exposure of confidential client communications and legal documents is a severe ethical and legal violation.
- Exposure of Sensitive PII/Financial Data: The stolen files could contain detailed financial statements, Social Security numbers, and inheritance details for numerous clients, leading to a high risk of identity theft and fraud.
- Operational Disruption: Encrypted systems would prevent lawyers from accessing case files, meeting deadlines, and communicating with clients, effectively halting the firm's operations.
- Regulatory and Legal Consequences: The firm could face significant fines under data privacy laws, as well as lawsuits from clients whose data was compromised.
IOCs — Directly from Articles
No specific Indicators of Compromise (IOCs) were provided in the source articles.
Cyber Observables — Hunting Hints
To detect activity associated with groups like INC_RANSOM, security teams can hunt for these general ransomware precursors:
nltest /dclist:mimikatz.exe*.incransomDetection & Response
- Monitor for Discovery Commands: Create SIEM alerts for the execution of reconnaissance commands like
nltest,net group "Domain Admins", andAdFind.exe. - Credential Dumping Protection: Deploy EDR and antivirus solutions with specific protections to block tools like Mimikatz and prevent access to the LSASS process memory.
- Behavioral Analysis: Use behavioral analytics to detect a user account suddenly accessing an abnormally large number of client files, which could be a sign of data staging for exfiltration.
Mitigation
- Secure RDP and VPN: If Remote Desktop Protocol (RDP) is exposed to the internet, it must be secured behind a VPN and require MFA. All VPN access must also be protected by MFA.
- Immutable Backups: Maintain segmented, immutable, and/or offline backups of all critical client data and firm operational data. Regularly test the backup restoration process.
- Client Data Segmentation: Where possible, segment access to client data so that a single compromised attorney account does not grant access to the entire firm's case files. Implement the principle of least privilege.
- Endpoint Detection and Response (EDR): An EDR solution can provide visibility into attacker activity and can often stop the ransomware execution chain before encryption begins.
Timeline of Events
MITRE ATT&CK Mitigations
Multi-factor Authentication
Securing all remote access points (like VPN and RDP) with MFA is crucial to prevent attackers from using stolen credentials for initial access.
Mapped D3FEND Techniques:
Encrypt Sensitive Information
Encrypting sensitive client files at rest can add a layer of protection, making the data useless to an attacker even if it is exfiltrated.
Applying the principle of least privilege to file shares ensures that a compromised user account can only access a limited set of data, reducing the breach's impact.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
For a law firm like Golden Glasko Haddy, which handles highly sensitive client data, implementing strict file and directory permissions is a critical countermeasure. The firm should move away from a flat network share where all attorneys can access all client files. Instead, access control lists (ACLs) on file servers must be configured to enforce the principle of least privilege. Each attorney or case team should only have read/write access to the specific case files they are actively working on. This segmentation of data access ensures that if a single attorney's account is compromised, the attacker cannot immediately access and exfiltrate the entire firm's client data, thus containing the breach to a small subset of information.
To combat ransomware groups like INC_RANSOM, law firms need modern endpoint protection that goes beyond traditional antivirus. An Endpoint Detection and Response (EDR) solution with behavioral analysis capabilities is essential. Such a tool can detect and block the ransomware execution chain by identifying suspicious behaviors. For example, it can detect and stop a process that attempts to dump credentials from LSASS (like Mimikatz), executes multiple reconnaissance commands in a row, or begins rapidly reading and writing to thousands of files. Upon detecting such a pattern, the EDR can automatically kill the malicious process and isolate the host from the network, preventing encryption and lateral movement.
Timeline of Events
INC_RANSOM lists Golden Glasko Haddy and Associates on its data leak site.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.