Avv Emilio Marco Casali targeted by Direwolf ransomware group

• Ransomware group: Direwolf
• Country: Italy
• Sector: Professional Services
• Announcement date: August 14, 2025

Direwolf claims data breach at Avv Emilio Marco Casali

The threat actor known as Direwolf has claimed responsibility for a cyberattack against Avv Emilio Marco Casali. According to an announcement made on a leak site on August 14, 2025, the group alleges they have successfully exfiltrated a significant volume of data belonging to the organization. The total size of the claimed data breach is reported to be 173 GB.

The incident follows a pattern often seen in modern ransomware operations, where attackers move beyond simple encryption to focus on data theft. This method is a core component of double extortion tactics. In such scenarios, threat actors do not merely lock an organization's systems to demand a ransom for decryption; they also threaten to leak sensitive information on public leak sites to pressure the victim into paying. This dual-threat approach significantly increases the pressure on the target organization, as the exposure of private data can lead to long-term consequences that persist even if systems are successfully restored from backups.

Details of the alleged attack

The Direwolf group announced that they obtained access to the data belonging to Avv Emilio Marco Casali on August 14, 2025. The group has outlined a specific timeline for the potential release of the stolen information. They stated their intention to publish a file list and sample files on August 16, 2025. If the demands are not met, the group has claimed they will proceed to release all documents on August 30, 2025.

Publicly available information regarding the Direwolf group remains limited, making it difficult to determine the full scope of their operations or their specific technical methodologies. The group's announcement serves as a direct notification of the breach, utilizing the psychological pressure of a countdown to influence the victim.

Nature of the compromised data

The data allegedly stolen by the threat actor is highly sensitive, given the nature of the victim's business. The leak is claimed to include a variety of documents that could pose significant risks to the individuals involved. The types of data mentioned in the announcement include:

• Legal documents
• Customer information
• Confidentiality agreements
• Passport copies
• User documents

The presence of such specific and sensitive information, particularly passport copies and customer details, significantly elevates the severity of the breach. When identity documents and personal customer data are compromised, the risk of identity theft and highly targeted phishing attacks against the affected individuals increases substantially. Such attacks often use the stolen information to build trust with the victim, making fraudulent communications much harder to detect.

The target organization

Avv. Emilio Marco Casali is an independent law firm based in Milan, Italy. The firm provides professional legal consulting and advocacy services to its clients.

Implications and risks for professional services

The breach of a law firm presents unique challenges and risks. The disclosure of sensitive legal data can lead to severe breaches of client confidentiality and may raise significant issues regarding professional ethics. Furthermore, because the institution is based in Italy, the incident may lead to legal consequences under the EU General Data Protection Regulation (GDPR), which mandates strict protections for personal data and imposes heavy penalties for non-compliance or failure to secure data.

For organizations in the professional services sector, such incidents underscore the critical importance of robust cybersecurity frameworks. To mitigate the risks of data exfiltration, organizations typically implement multi-layered defense strategies. This includes strict access controls to ensure that sensitive documents are only available to authorized personnel, comprehensive encryption for data both at rest and in transit, and continuous monitoring of network activity to detect unauthorized data movements. Additionally, maintaining a rigorous incident response plan and conducting regular security awareness training can help organizations prepare for and respond more effectively to the evolving threats posed by ransomware groups like Direwolf.