Singapore – Financially motivated adversaries accounted for 82% of malicious activity observed against the legal sector, according to the CrowdStrike report released on 28 October 2026.
The cybercrime group CHATTY SPIDER emerged as the dominant threat to US law firms, with its activity growing by 129%.
In one intrusion, the group recruited an individual to impersonate IT staff and physically infiltrate law firms to establish remote access. In another, it attempted to exfiltrate sensitive data just four minutes after gaining initial access.
Extortion also climbed sharply. Big Game Hunting adversaries named 455 legal entities on data leak sites, a 39% increase year on year.
Identity-based attacks spread as well. SNARKY SPIDER and CORDIAL SPIDER targeted law firms by exploiting trusted access to SaaS applications for data theft and extortion, and both went after the same firm just one month apart.
Meanwhile, espionage activity intensified as the diversity of China-nexus adversaries in the legal sector doubled. TITAN PANDA conducted the first observed exploitation of legal-sector-specific billing software, while WARP PANDA leveraged an ESXi zero-day for covert access.
MURKY PANDA, for its part, ran large-scale password spraying against nearly 500 accounts at a single US law firm. The attempts came from 300 IP addresses over 30 days.
The findings draw on frontline intelligence tracking more than 290 named adversaries. They also show attackers compressing the time between initial access and data theft, a window the report expects to shrink further as AI capabilities advance.
Privileged access to client communications, intellectual property and corporate transactions makes law firms gateways to sensitive intelligence. As a result, the businesses and government organisations they represent also face risk.
“Law firms are the new ATM for cybercriminals. Adversaries are exploiting the value of privileged client information, and they’re willing to go beyond the keyboard to get it,” said Adam Meyers, Head of Counter Adversary Operations, CrowdStrike.
“We’re seeing criminals recruit individuals to physically infiltrate law firms, blurring the line between digital and physical attacks. Defenders need visibility across identities, endpoints, and cloud environments to detect and disrupt these operations before access turns into extortion,” Meyers added.
