Morpheus Ransomware Targets Chicago Law Firm

Dinizulu Law Group LTD, a prominent civil litigation firm based in Chicago, has been listed as the latest victim of the Morpheus ransomware group, a cybercriminal operation linked to sophisticated attacks on high-value sectors.

The breach, discovered on February 25, 2025, exposed confidential legal documents, financial records, employee and client personal data, business plans, and videoconference recordings tied to active court cases.

The incident underscores escalating risks to legal institutions managing sensitive client information and highlights the evolving tactics of ransomware affiliates leveraging shared technical infrastructures.

Technical Profile of the Morpheus Ransomware Operation

According to the post from FalconFeeds, Morpheus, operational since December 2024, employs a ransomware-as-a-service (RaaS) model, providing affiliates with customizable payloads to execute attacks.

Forensic analyses by SentinelOne and the Hacker News reveal that Morpheus shares a near-identical codebase with the HellCat ransomware group, another RaaS operation active since mid-2024.

Both groups use a 64-bit portable executable that integrates the Windows Cryptographic API (BCrypt) for file encryption.

This approach generates unique keys for each attack while excluding critical system files (e.g., .dll, .exe) to avoid disrupting operations and prolonging dwell time.

Notably, Morpheus payloads do not alter file extensions post-encryption, a tactic designed to delay detection.

Instead, they overwrite file contents with AES-256-CTR encryption, leaving metadata intact.

The group’s ransom notes, mirroring those of the defunct Underground Team ransomware, demand payments via TOR-based portals and threaten data leaks on its dark web data-leak site (DLS).

Impact on Dinizulu Law Group and Legal Sector Vulnerabilities

The compromise of 2.1 TB of data—including privileged attorney-client communications and case strategy documents—poses severe risks.

Exfiltrated employee data (Social Security numbers, payroll details) and client financial records could fuel identity theft or secondary extortion campaigns.

Legal experts warn that leaked court records might undermine ongoing cases or violate confidentiality agreements, exposing the firm to regulatory penalties under GDPR and Illinois’ Biometric Information Privacy Act.

Morpheus’ focus on legal entities aligns with broader ransomware trends targeting sectors with high-pressure compliance environments.

Unlike HellCat, which publicly boasts about “big game” government targets, Morpheus operates discreetly, suggesting a calculated strategy to maximize payouts from less-prepared organizations.

Connections to Broader Cybercrime Ecosystems

The technical overlap between Morpheus and HellCat points to a shared builder infrastructure or collaborative affiliate networks.

Both groups upload nearly identical payloads to VirusTotal, differing only in victim-specific contact details embedded in their binaries.

SentinelOne researchers note that this code reuse reduces development costs for affiliates while complicating attribution efforts.

Morpheus’ emergence coincides with a 47% YoY increase in ransomware attacks on professional services firms, per CISA’s 2024 Threat Landscape Report.

The group’s TTPs—including Living-Off-the-Land (LotL) techniques and credential phishing—mirror tactics observed in recent breaches linked to Black Basta and LockBit 4.0.

Mitigation Strategies and Industry Response

Cybersecurity firms advocate for zero-trust architectures and immutable backups to counter ransomware encryption.

Dinizulu Law Group has partnered with forensic specialists to assess the breach’s scope, though data recovery remains uncertain.

The No More Ransom Initiative, a coalition including Europol and Kaspersky, urges victims to avoid payments and report incidents to law enforcement.

“Legal firms must prioritize network segmentation and endpoint detection,” advises Jim Walter of SentinelOne.

“Morpheus’ avoidance of system files indicates attackers are learning to balance disruption with stealth—a dangerous evolution.”

The Dinizulu Law Group breach exemplifies the growing sophistication of RaaS operations exploiting shared codebases and psychological pressure tactics.

With Morpheus demanding ransoms exceeding $3 million in recent attacks, the incident highlights critical gaps in third-party risk management and incident response planning.

As regulatory scrutiny intensifies, legal institutions face mounting pressure to adopt AI-driven threat detection and real-time traffic analysis frameworks to safeguard sensitive data.

Also Read:

Orange Group Confirms Major Data Breach By HellCat

See more