United States – October 31, 2026 -- Cyber intrusions targeting the legal sector nearly doubled between 2023 and 2026, according to the CrowdStrike 2026 Legal Threat Landscape Report, as eCrime and nation-state adversaries pursue privileged communications, corporate transactions, intellectual property and financial records.
The report covers activity observed from September 1, 2025 through August 31, 2026. CrowdStrike expects AI advances to let adversaries increase the scale and sophistication of their operations.
Financially motivated actors account for 82% of legal sector activity
Big game hunting adversaries named 455 legal entities on dedicated leak sites, a 39% year-over-year increase. Attackers profit by deploying ransomware or monetizing stolen data through extortion or resale on criminal markets.
CHATTY SPIDER activity jumps 129% and law firms make up nearly 90% of victims
CHATTY SPIDER's activity in the first eight months of 2026 was 129% above its level for all of 2024. The adversary almost exclusively targeted U.S.-based law firms and is highly likely to continue doing so. It impersonates IT staff to establish remote access sessions and exfiltrates data within minutes, increasingly using trusted enterprise tools.
In November 2025, CHATTY SPIDER hired a Russian national to enter a U.S.-based law firm in person. Posing as an internal IT employee, he was given access to an onsite workstation, where he enabled deployment of remote monitoring and management (RMM) tools and attempted to exfiltrate data via cloud storage. He was detained during a second attempted visit. Public reporting indicates the group used U.S.-based individuals for several physical intrusions during 2026.
SNARKY SPIDER (emerged October 2025) and CORDIAL SPIDER (emerged November 2025) run high-tempo data theft and extortion campaigns with nearly identical tactics. These include vishing calls impersonating IT personnel and redirection of employees to single sign-on (SSO)-themed phishing pages. Both targeted the same law firm one month apart.
Four China-nexus groups pursue zero-days, cloud compromise and legal software
WARP PANDA, TITAN PANDA, MURKY PANDA and OVERCAST PANDA led China-nexus espionage against the sector. Their campaigns advanced in zero-day exploitation of enterprise infrastructure, cloud environment compromise and exploitation of legal-specific software.
WARP PANDA deployed malware in victims' VMware vCenter environments at U.S.-based entities, including legal targets. As late as early 2026, it exploited the ESXi command logging bypass vulnerability CVE-2026-41709 as a zero-day.
In April 2026, TITAN PANDA made the first observed attack on legal sector-specific software. It exploited a hardcoded IIS machine key vulnerability in Intapp Time Server, a timekeeping and billing product used almost exclusively by law firms.
MURKY PANDA's ORB28 password spraying campaign, slightly outside the reporting period, was the largest by target count. It affected more than 340 primarily U.S.-based entities across sectors, and legal was the most affected. One law firm recorded nearly 500 failed login attempts against as many accounts from about 300 IP addresses in 30 days.
OVERCAST PANDA targeted executive-level employees at a U.K.-based legal firm in September and October 2025, consistent with Chinese intelligence priorities for personnel with sensitive access and decision-making authority.