Financially motivated cybercriminals accounted for 82% of malicious activity CrowdStrike observed against the legal sector between 1 September 2025 and 31 August 2026, with attacks on US law firms extending to physical infiltration and increasingly rapid data theft. Published in the CrowdStrike 2026 Legal Threat Landscape Report, the findings show that criminal groups named 455 legal organisations on data leak sites during that period, marking a 39% increase over the preceding 12 months.
The report examines a threat landscape spanning financially motivated extortion and state-linked espionage, in which attackers seek access to privileged client communications, corporate transactions, intellectual property and other confidential information. Across both financially motivated and state-linked threat actors, CrowdStrike’s intelligence indicates that intrusions targeting legal organisations have nearly doubled compared with its 2023 baseline.
ADVERSARY NAMING CONVENTIONS
-
BEAR RUSSIA
-
BISON BELARUS
-
BUFFALO VIETNAM
-
CHOLLIMA DPRK (NORTH KOREA)
-
CRANE ROK (REPUBLIC OF KOREA)
-
HAWK SYRIA
-
JACKAL HACKTIVIST
-
KITTEN IRAN
-
LEOPARD PAKISTAN
-
LYNX GEORGIA
-
OCELOT COLOMBIA
-
PANDA PEOPLE’S REPUBLIC OF CHINA
-
SAIGA KAZAKHSTAN
-
SPHINX EGYPT
-
SPIDER eCRIME
-
TIGER INDIA
-
WOLF TÜRKIYE
Remote access attacks extend to physical infiltration
CHATTY SPIDER emerged as one of the most active threats to US law firms, with law firms accounting for nearly 90% of victims in its observed intrusions during the reporting period. CrowdStrike recorded a 129% increase in the group’s malicious activity during the first eight months of 2026 compared with the whole of 2024, when it first observed the group targeting legal organisations.
The group typically impersonated IT employees and contacted lawyers or administrative staff, persuading them to establish remote support sessions through legitimate software such as Quick Assist, AnyDesk and RustDesk. More recent attacks involved Zoom and Cisco Webex, allowing attackers to access workstations and search for sensitive files. Its data theft methods also changed. Although CHATTY SPIDER previously relied on WinSCP to transfer stolen information, most observed intrusions in 2026 involved cloud storage services such as Google Drive and OneDrive, allowing the group to use familiar business applications during its attacks.
Beyond remote access methods, CHATTY SPIDER recruited a Russian national in November 2025 to enter a US law firm while posing as an internal IT employee. The individual gained access to an on-site workstation, enabled remote management software and attempted to transfer data through cloud storage services, before law enforcement detained the individual during a second attempted visit the following day. The report also cites public accounts of several physical intrusions involving US-based individuals during 2026.
In a separate attack in 2025, CHATTY SPIDER attempted to transfer sensitive information out of a law firm just four minutes after obtaining initial access. The incident illustrated how little time defenders might have to interrupt an intrusion before attackers begin extracting data.
Adam Meyers, head of counter adversary operations at CrowdStrike, described the combination of physical infiltration and remote access techniques: “We’re seeing criminals recruit individuals to physically infiltrate law firms, blurring the line between digital and physical attacks. Defenders need visibility across identities, endpoints, and cloud environments to detect and disrupt these operations before access turns into extortion.”
CrowdStrike assesses with high confidence that CHATTY SPIDER will continue targeting US law firms, with employee impersonation and legitimate remote access tools remaining central to its methods.
Extortion activity rises as criminal groups target client data
Criminal groups engaged in ransomware and data extortion named 455 legal organisations on dedicated data leak sites during the reporting period, compared with 327 in the preceding 12 months. The legal sector ranked eighth among industries by the number of organisations listed in both periods. North America accounted for 365 of the latest listings, followed by Europe with 51 and South America with 14, while Southeast Asia recorded six listings and East Asia recorded two. Singapore also appeared among the most targeted countries in CrowdStrike’s wider legal-sector threat overview, alongside Australia, Canada, Germany, Israel, Mexico, the United Kingdom and the United States.
These attacks exploit the confidential nature of legal work. Law firms routinely handle litigation strategies, financial records, intellectual property, merger and acquisition information, and privileged communications, providing criminal groups with material to pressure organisations into paying ransoms by threatening public disclosure. To obtain access, attackers rely on several methods, including exploiting software vulnerabilities, compromising account credentials and purchasing access from other criminals. CrowdStrike identified 24 advertisements offering access to legal organisations during the reporting period, involving 12 access brokers. Asking prices ranged from US$30 to US$6,000, with a median of US$1,000, and most advertised targets were based in the United States.
Identity-based attacks were also deployed against law firms by SNARKY SPIDER and CORDIAL SPIDER. SNARKY SPIDER used voice phishing calls to impersonate IT personnel and direct employees to fraudulent single sign-on pages. After obtaining access, the group stole information exclusively from software-as-a-service applications connected to single sign-on systems and threatened to publish it unless a ransom was paid. CORDIAL SPIDER employed similar methods, including calls claiming that employees needed to update their single sign-on passkeys. CrowdStrike observed both groups targeting the same law firm just one month apart, with both using similar techniques to pursue access to sensitive information.
State-linked attackers exploit legal software and cloud systems
CROWDSTRIKE MANAGED SERVICES INTRUSION BREAKDOWN
- BeaverTail
- Akira
- BlackChaos
- FlowCloud
- IceGiant
- MisakaNetwork
- Sinobi
- SocksShell
- TrueSightKiller
TOP TOOLS
State-sponsored activity accounted for approximately 18% of intrusions observed by CrowdStrike's managed services during the reporting period, with China-linked groups representing the largest share. Although the overall volume of China-linked attacks against legal organisations remained relatively consistent, the number of distinct groups targeting the sector nearly doubled between 2023 and 2026. Their operations involved vulnerabilities in enterprise infrastructure, cloud environments and software used specifically by law firms.
In April 2026, TITAN PANDA exploited a hardcoded Internet Information Services (IIS) machine key vulnerability in Intapp Time Server, an application used primarily by law firms for timekeeping and billing. CrowdStrike assessed that the group highly likely compromised a US legal organisation on 20 April before exploiting the same vulnerability at a US technology company on 28 April. The attacks used a technique known as ViewState deserialisation to execute malicious code remotely. In the technology company intrusion, TITAN PANDA deployed IceGiant modules to examine the compromised system. IceGiant is an in-memory framework that supports reconnaissance, persistence, movement across compromised systems and data theft while limiting evidence of malicious activity. The vulnerability was associated with default machine key configurations, which could expose other organisations using affected installations of the software.
Another China-linked group, WARP PANDA, exploited a previously unknown vulnerability in VMware ESXi, tracked as CVE-2026-41709, which allowed attackers to bypass command logging and reduce the visibility of malicious activity within virtualisation infrastructure. In some intrusions, WARP PANDA also obtained cloud session tokens to access Microsoft 365 environments without triggering conventional credential-based alerts. In at least one case, the group registered an additional multifactor authentication device on a compromised account, maintaining access even after a password reset. CrowdStrike assesses with moderate confidence that WARP PANDA will continue prioritising vulnerabilities in virtualisation infrastructure and internet-facing devices through at least mid-2027. It also expects TITAN PANDA to continue targeting IIS-based application vulnerabilities at North American law firms over the same period, an assessment made with high confidence.
Other operations focused on legal executives and employee accounts. OVERCAST PANDA deployed FlowCloud malware against executive-level employees at a UK law firm in September and October 2025. CrowdStrike also documented a July 2025 password-spraying campaign by MURKY PANDA, which fell just outside the report's main observation period. During that operation, one US law firm experienced nearly 500 failed login attempts against as many accounts from approximately 300 IP addresses over 30 days.
North Korea-linked groups conducted more limited operations against legal organisations. In late January 2026, SILENT CHOLLIMA deployed TigerRAT malware against a European public legal entity, reportedly attempting to obtain documents concerning anti-money-laundering legislation. FAMOUS CHOLLIMA also targeted legal organisations as part of wider financially motivated operations involving malware and fraudulent IT worker arrangements. Russian-linked operations were likewise limited during the reporting period, though CrowdStrike documented several COZY BEAR phishing attempts against a US legal organisation in August and September 2025, involving Microsoft Entra ID OAuth 2.0 phishing links designed to obtain access to employee accounts. The report also identified limited Iran-linked activity against legal organisations. Separately, pro-Russian hacktivist groups Z-Pentest and BOUNTY JACKAL targeted several legal entities in Spain during July 2026, as part of a wider campaign affecting government, critical infrastructure and private sector organisations.
Law firms face wider identity and infrastructure security demands
CrowdStrike's recommendations focus on strengthening protection across employee identities, remote access systems, cloud applications and the infrastructure supporting legal operations. To address attacks involving impersonation and compromised accounts, the report recommends stronger multifactor authentication, tighter controls over remote access tools and restrictions on employee privileges. It also calls for monitoring suspicious authentication activity, cloud session tokens and newly registered authentication devices.
Because the Intapp Time Server and VMware ESXi attacks involved vulnerabilities in business applications and virtualisation infrastructure, legal organisations are advised to maintain visibility over internet-facing systems, address vulnerabilities in business-critical applications and review default or hardcoded configurations. Security monitoring should also cover identity systems, cloud services, email, remote access and virtualisation infrastructure, allowing organisations to identify related suspicious activity across different environments.
CrowdStrike further recommends limiting access to confidential information, separating sensitive systems and monitoring unusual file access or transfers. Regularly tested incident response and recovery plans can help organisations prepare for data theft, extortion and operational disruption. The report also recommends using threat intelligence and proactive security monitoring to identify persistent access and emerging attacks before they escalate.
