Studio Legale ESE Data Breach

Direwolf ransomware has listed Studio Legale ESE, an Italian law firm, as a victim on its dark web portal. This incident, identified via SOCRadar’s Dark Web Monitoring, marks an extension of the group’s activity into the Italian legal sector. Law firms are attractive targets for ransomware groups due to the sensitive nature of the data they handle, including client case files, correspondence, contracts, and confidential personal and commercial legal information. This type of data profile makes them high-value targets for extortion. In the 60 days preceding this listing, Direwolf claimed approximately 40 other victims. The group primarily targets organizations within the Technology, Healthcare, and Financial Services sectors. Their victims are most frequently located in the United States, Mexico, and Sweden. Recent victims with profiles similar to Studio Legale ESE, such as those in professional services or based in Europe, include AAM:HOA Management, Statista GmbH, Chat Jurídico, and National Kidney Registry. The inclusion of Studio Legale ESE aligns with Direwolf’s established pattern of targeting professional service organizations across various geographic regions.

A query against the domain studiolegaleese[.]it using stealer-log telemetry returned no records. It is important to note that these datasets are paginated and sampled. Therefore, the absence of records does not definitively mean that no compromise occurred. Credentials could have surfaced in unqueried feeds, been rotated before indexing, or been harvested via personal email aliases that fall outside a domain-filtered query. Infostealer-harvested credentials are a known vector for initial access by groups like Direwolf. Threat actors often source fresh logs from underground markets, validate corporate credentials, and then use them to gain access to platforms such as Microsoft 365, VPNs, or remote-access portals before deploying ransomware. While this query did not find evidence, it does not rule out this scenario. CTI teams should prioritize continued monitoring and proactive credential-hygiene checks rather than interpret a null result as exoneration.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.