Chernyy & Associates Data Breach

Chernyy & Associates, a legal firm based in Russia and operating under the domain chernyy-law[.]com, was listed on the Booba Project ransomware group’s leak site on August 24, 2026. The targeting of a Russian legal firm by Booba Project is notable, as it demonstrates the group’s willingness to operate in jurisdictions that might typically be considered lower risk for threat actors, despite Russia being a known operational area for them. This incident highlights the ongoing threat of ransomware against professional services, particularly those handling sensitive client data. In the 60 days preceding this listing, Booba Project claimed 10 victims across the Business Services, Professional Services, and Technology sectors. Their primary geographic focus areas during this period included the United States, Russia, and Mexico. The group has shown a consistent interest in targeting legal and professional advisory firms across various jurisdictions. Previous victims attributed to Booba Project include Federis Abogados, URA Group, Country-Wide Insurance, and Davroc, indicating a pattern of targeting entities that possess valuable client information.

SOCRadar’s analysis of stealer-log telemetry returned no records associated with the domain chernyy-law[.]com within the queried data slice. It is crucial to note that this dataset represents a paginated sample and does not encompass all active log feeds, nor does it account for credentials potentially harvested under alternate corporate domains or through personal email aliases. Therefore, the absence of evidence in this specific query does not confirm that the organization is unaffected by credential compromise. The operational methodology of the Booba Project typically involves acquiring fresh infostealer logs from underground markets. These logs are then used for credential validation against platforms such as Microsoft 365, VPNs, or remote-access portals, potentially leading to further network intrusion and ransomware deployment. Given that law firms handle privileged client data, they represent a high-value target for extortion. The credential surface for screening should extend beyond the primary .com domain to include any jurisdictionally-specific email domains the firm might operate, especially considering the potential for both domestic and international client communications.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.