Bengaluru: CrowdStrike has released the CrowdStrike 2026 Legal Threat Landscape Report, which says financially motivated adversaries accounted for 82% of observed malicious activity against the legal sector.
The report identifies CHATTY SPIDER as a dominant threat to U.S. law firms, with malicious activity growing 129%.
In one intrusion, the group recruited an individual to impersonate IT staff and physically infiltrate law firms to establish remote access, CrowdStrike said.
In another, the adversary attempted to exfiltrate sensitive data just four minutes after gaining initial access.
The CrowdStrike 2026 Legal Threat Landscape Report draws on intelligence from CrowdStrike Counter Adversary Operations, which tracks more than 290 named adversaries.
The CrowdStrike 2026 Legal Threat Landscape Report said Big Game Hunting adversaries named 455 legal entities on data leak sites, a 39% year-over-year increase.
Financially motivated adversaries accounted for the majority of observed activity against the legal sector, the report said, exploiting the highly confidential nature of client information to maximize extortion pressure.
SNARKY SPIDER and CORDIAL SPIDER targeted law firms through identity-based attacks, exploiting trusted access to SaaS applications for data theft and extortion. Both adversaries targeted the same law firm one month apart.
The CrowdStrike 2026 Legal Threat Landscape Report also said China-nexus adversary diversity doubled in the legal sector.
TITAN PANDA conducted the first observed exploitation of legal-sector-specific billing software, while WARP PANDA leveraged an ESXi zero-day for covert access.
The CrowdStrike 2026 Legal Threat Landscape Report said MURKY PANDA conducted large-scale password spraying, targeting nearly 500 accounts at a single U.S. law firm from 300 IP addresses over 30 days.
Commenting on the CrowdStrike 2026 Legal Threat Landscape Report, Adam Meyers, head of counter adversary operations, CrowdStrike, said, “Law firms are the new ATM for cybercriminals. Adversaries are exploiting the value of privileged client information, and they’re willing to go beyond the keyboard to get it.”
He added, “We’re seeing criminals recruit individuals to physically infiltrate law firms, blurring the line between digital and physical attacks. Defenders need visibility across identities, endpoints, and cloud environments to detect and disrupt these operations before access turns into extortion.”
Also Read: CrowdStrike 2026 Technology Threat Landscape Report: China-Nexus Hackers Intensify AI Espionage
