Financially motivated attackers accounted for 82% of observed malicious activity against the legal sector in the twelve months CrowdStrike tracked for its 2026 Legal Threat Landscape Report, released on 28 October. Big-game-hunting crews named 455 legal entities on data-leak sites over September 2025 to August 2026 — a 39% year-over-year increase — and the targets are chosen for the thing that makes a law firm a law firm: privileged client information.
"Law firms are the new ATM for cybercriminals," said Adam Meyers, who heads CrowdStrike's counter-adversary operations. "Adversaries are exploiting the value of privileged client information, and they're willing to go beyond the keyboard to get it."
CHATTY SPIDER is the clearest example of that escalation. Its activity against legal entities grew 129% in the first eight months of 2026 compared with all of 2024, and law firms made up nearly 90% of its targets. The group's opening move is a phone call: an attacker poses as internal IT, talks a lawyer or an assistant into granting remote-support access, and is inside. In one documented intrusion it tried to exfiltrate data four minutes after gaining access. In another it went further — recruiting a person to impersonate IT staff, enter the premises and establish remote access from a workstation on site.
Two other criminal groups, SNARKY SPIDER and CORDIAL SPIDER, worked the identity layer instead, abusing trusted access to SaaS applications. Both hit the same firm a month apart, which CrowdStrike reads as convergence on a small set of high-value targets rather than coincidence.
State-linked espionage made up roughly 18% of observed activity, most of it China-nexus, and that roster has also roughly doubled since 2023. TITAN PANDA was seen exploiting legal-sector billing software — Intapp Time Server — for the first time, a reminder that industry-specific back-office tools rarely get the security review that client-facing systems do. WARP PANDA used an ESXi zero-day for covert access. MURKY PANDA ran a password-spraying campaign against nearly 500 accounts at a single US firm from 300 IP addresses over 30 days.
The commercial logic of the sector explains the volume. A firm's duty of confidentiality is what makes a leak existential rather than embarrassing; merger documents, patent filings, financial records and litigation strategy are worth more to a buyer — or to the client's rival — than a mid-size company's customer database. And a firm that holds privileged material for a bank, a chipmaker or a government contractor is also a route into those networks, which is why state actors bother.
The report is a vendor's, and its numbers are its own telemetry, but the shape of the advice is unglamorous and cheap: enforce phishing-resistant multi-factor authentication, treat remote-support tools as privileged software with an owner and an allow-list, and patch the billing and practice-management servers that nobody thinks of as crown jewels. The four-minute exfiltration window is the argument for spending there before an incident, not after one.
