Law Firms Are the New ATM for Hackers, CrowdStrike Warns

In brief

• CrowdStrike’s 2026 legal threat report: attacks on law firms nearly doubled since 2023, 455 firms named on leak sites, and one gang now walks in the front door.
• Intrusions targeting legal entities have nearly doubled since the 2023 baseline, according to CrowdStrike’s 2026 Legal Threat Landscape Report, which covers September 2025 to August 2026. Financially motivated attackers accounted for 82% of observed activity against the sector.
• Big Game Hunting extortion groups named 455 legal entities on data leak sites during the reporting period, up 39% year over year. One group, CHATTY SPIDER, increased its activity against legal targets by 129% and has moved from phishing calls to physically sending people into law offices.
• The report names no specific law firm. That restraint matters: the firms Reuters previously reported as breached — Quinn Emanuel, WilmerHale and Seyfarth — are not named in this report, and the two should not be conflated.

Last verified: October 29, 2026.

What the report found

CrowdStrike released its 2026 Legal Threat Landscape Report on October 28, 2026, based on threat intelligence from its Counter Adversary Operations team, which tracks more than 290 named adversaries. The headline finding is blunt: the legal sector is being hit harder, faster, and from more directions than it was three years ago.

Three numbers carry the story. First, intrusions targeting legal entities have nearly doubled since 2023. Second, financially motivated adversaries — eCrime groups, in CrowdStrike’s taxonomy — accounted for 82% of observed malicious activity against the legal sector. Third, Big Game Hunting adversaries named 455 legal entities on dedicated leak sites between September 2025 and August 2026, a 39% increase on the prior period. Leak-site naming is the extortion step: the victim’s name goes up whether or not a ransom is paid, and the pressure to pay rises with it.

CrowdStrike’s head of counter adversary operations, Adam Meyers, put it in a line built for headlines: “Law firms are the new ATM for cybercriminals.” He added that adversaries are “willing to go beyond the keyboard to get it” — and the report backs that up with cases, not just rhetoric.

Why law firms, and why now

A law firm is a concentration of other people’s secrets. Client communications are privileged. Merger and acquisition details move markets. Intellectual property, government matters and financial records sit in the same document systems, often with weaker controls than the clients themselves run. CrowdStrike’s point, repeated across the report, is that a firm is not only a target in its own right — it is a pivot point into client networks.

That is also why the sector’s threat mix skews financial. An attacker who steals a manufacturer’s designs gets one company’s secrets. An attacker who steals a firm’s files gets dozens of clients’ secrets, and every one of them is a separate extortion lever. The 82% eCrime share reflects that arithmetic: ransomware and extortion pay better here than almost anywhere else, because the data is both confidential and time-sensitive. A deal document is worth most before the deal closes.

The timing matters too. Reuters, reporting the same findings, noted that a growing number of firms have been hit in recent months, and that threat actors are increasingly using agentic AI to run more sophisticated and efficient attacks. Meyers told Reuters the trend will get worse before it gets better, because agentic tools are democratising hacking — lowering the skill needed to run a capable intrusion. That claim echoes CrowdStrike’s separate October reporting on AI agents carrying out substantial parts of real intrusions, which AuTechWire covered on October 28. The legal report is the sector-specific version of the same shift: faster intrusions, less human effort per target, more targets per campaign.

The gang that walks in the front door

CHATTY SPIDER is the report’s dominant eCrime actor against the legal sector. Its activity targeting legal entities grew 129% in the first eight months of 2026 compared with all of 2024, and law firms made up nearly 90% of its victims during the reporting period. It almost exclusively targets US-based firms.

Its tactics explain the growth. CHATTY SPIDER started with callback phishing, then added voice phishing, abuse of remote tools, and — most strikingly — physical intrusion. In November 2025, the group hired a Russian national to physically access a US-based law firm. The individual posed as an internal IT employee, was granted access to an onsite workstation, and enabled the group to deploy remote monitoring and management tools and attempt to exfiltrate data through cloud storage services. He was detained during a second attempted visit. Public reporting cited in CrowdStrike’s account indicates the group used US-based individuals for several physical intrusions during 2026.

Pause on what that defeats. A firm can have multi-factor authentication, endpoint detection and a security operations centre, and still lose if a stranger in an IT polo shirt is walked to a workstation by a helpful employee. Physical intrusion bypasses digital controls entirely, because the controls assume the person at the keyboard is supposed to be there. CrowdStrike’s warning — that defenders need visibility across identities, endpoints and cloud environments — only works if the physical side is treated as part of the same problem: visitor controls, escort rules for IT visitors, and a culture where challenging an unfamiliar “colleague” is expected, not rude.

Speed is the other half of the CHATTY SPIDER story. In another incident described in the report, an adversary attempted to exfiltrate sensitive data just four minutes after gaining initial access. Four minutes is not a dwell time; it is a smash-and-grab. It means the window for detection is not hours or days but minutes, and it means the exfiltration path — remote tools, cloud storage — was prepared before access, not improvised after it. Firms that measure their response in hours are measuring the wrong thing.

The market for access

Not every attacker breaks in directly. Initial Access Brokers sell access to compromised organisations to other criminal groups, and the legal sector has its own price list. SecurityBrief’s coverage of the report puts the asking prices for legal-sector access in the reporting period at USD $30 to USD $6,000, with an average of USD $1,573.89 and a median of USD $1,000.

Those prices look small until you compare them with the payout. A thousand dollars for the front door, and the data behind it can support a six- or seven-figure extortion demand. That asymmetry is the business model: cheap access, expensive data. It also means a firm does not need to be specifically chosen to be attacked. If its access is listed, any buyer can pick it up, and the buyer may not be the group that eventually extorts it. Defence has to assume the intruder bought the keys rather than picking the lock.

The most targeted countries for malicious activity against law firms, per the report, were Australia, Canada, Germany, Israel, Mexico, Singapore, the UK and the US. Australian firms also ranked among the most targeted in Initial Access Broker advertisements, behind only the US and Brazil. This is a global pattern with a US centre of gravity — CHATTY SPIDER’s victims are overwhelmingly American, but the access market and the espionage actors are not.

The espionage side: China-nexus groups

Financial crime dominates the numbers, but nation-state activity is where the report’s technical detail sharpens. Nearly twice as many China-nexus adversaries targeted the legal sector compared with 2023, and CrowdStrike says they will likely remain the greatest intelligence-collection threat to the sector.

Three operations stand out. TITAN PANDA conducted the first observed exploitation of legal-sector-specific billing software, targeting Intapp Time Server through a hardcoded machine-key vulnerability. WARP PANDA leveraged a VMware ESXi zero-day for covert access. MURKY PANDA conducted large-scale password spraying against a single US law firm — nearly 500 accounts targeted from 300 IP addresses over 30 days. Password spraying at that scale is not a guess; it is a campaign, and it works against firms where password policies or lockout rules leave room for low-and-slow attempts.

Two other named groups, SNARKY SPIDER and CORDIAL SPIDER, targeted law firms through identity-based attacks, exploiting trusted access to software-as-a-service applications for data theft and extortion. Both targeted the same law firm just one month apart — a reminder that a firm that survives one intrusion is, if anything, more likely to be tried again, by a different group using the same weak point.

The espionage motive differs from the eCrime motive, and the defence differs with it. Extortionists want data they can threaten to publish. Intelligence collectors want data they can quietly keep: litigation strategy, regulatory positions, deal terms, government matters. A firm may never learn it was the victim of the second kind, because nothing is leaked and no ransom is demanded. That silence is the point.

What this means for clients, not just firms

Most coverage of this report is written for law firms. The more useful question is for their clients: what do you do when the firm holding your most sensitive documents is the target?

First, ask. Clients rarely ask outside counsel about security posture, and firms rarely volunteer it. The report gives clients specific questions worth asking: how does the firm control remote-tool access, what happens when an unfamiliar person claims to be IT support, how quickly can it detect exfiltration to cloud storage, and has it tested its response against a four-minute intrusion rather than a four-day one? A firm that cannot answer those questions has not internalised this report.

Second, limit what the firm holds. Not every document in a matter needs to live in the firm’s systems indefinitely. Retention limits, matter-by-matter access controls and data-return clauses at the end of an engagement all reduce the value of a breach that does happen. Clients who treat their law firm as an infinite archive are subsidising the attacker’s payout.

Third, treat a firm’s breach as your breach. If a firm holding your deal documents is extorted, your data is on the leak site whether or not your name appears in the headline. Incident-response plans should name outside counsel as a third-party risk, with notification obligations and joint-response expectations agreed before an incident, not negotiated during one.

What firms should actually change

The report’s recommendations centre on continuous, intelligence-driven defence across identities, endpoints and cloud environments. Translated into concrete changes, five stand out:

• Lock down remote monitoring and management tools. CHATTY SPIDER’s playbook depends on them. If any employee can install or approve a remote session, the tool is the intrusion path.
• Treat physical access as a security control. Escort unknown IT visitors, verify them through a known channel (not the number they give you), and train staff that challenging a stranger is a duty, not a discourtesy.
• Hunt for fast exfiltration, not just malware. A four-minute access-to-exfiltration window means detection must trigger on data movement to cloud storage and unusual remote sessions, not only on malicious files.
• Fix identity basics under scale. Password spraying across 500 accounts from 300 addresses defeats weak lockout and monitoring. Phishing-resistant authentication for SaaS applications — the SNARKY and CORDIAL SPIDER target — matters more than another endpoint agent.
• Assume repeat targeting. A firm hit once, or even probed once, should expect a second attempt within weeks, possibly by a different group. Post-incident hardening that only closes the exact path used last time will miss the next one.

None of this is exotic. That is the uncomfortable part of the report: the attacks succeeding against law firms are not, for the most part, novel zero-days. They are phishing, credential abuse, trusted-tool abuse and a person walking through the door. The firms losing are not losing to superior technology. They are losing to attackers who understand that a law firm’s weakest control is often the human one.

What to watch next

Three questions will decide how this story develops. First, whether physical intrusion spreads beyond the US firms CHATTY SPIDER has focused on, or whether it stays an American tactic. Second, whether the group’s return from its usual mid-year hiatus earlier than usual in 2026 signals a permanently higher tempo, or a one-year surge. Third, whether any firm breaks the report’s anonymity and discloses its own incident in detail — the kind of disclosure that would turn CrowdStrike’s aggregate numbers into a case study other firms can actually learn from.

Until then, the report’s own summary stands as the warning: intrusions nearly doubled since 2023, extortion naming rose 39%, and the adversaries are no longer only on the keyboard. Some of them are in the building.

Sources

• CrowdStrike, 2026 Legal Threat Landscape Report (report page): https://www.crowdstrike.com/en-us/resources/reports/2026-legal-threat-landscape-report/
• CrowdStrike, press release: CrowdStrike 2026 Legal Threat Landscape Report: https://www.crowdstrike.com/en-us/press-releases/crowdstrike-2026-legal-threat-landscape-report/
• CrowdStrike, Inside the CrowdStrike 2026 Legal Threat Landscape Report (blog): https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/
• Reuters, Researchers warn of surging law firm cyber attacks fueled by AI (October 28, 2026): https://www.reuters.com/legal/government/researchers-warn-surging-law-firm-cyber-attacks-fueled-by-ai-2026-10-28/
• InfotechLead, CrowdStrike 2026 Report: Cyberattacks on Law Firms Surge 129% (October 28, 2026): https://infotechlead.com/security/crowdstrike-2026-report-law-firm-cyberattacks-extortion-99261
• SecurityBrief, Australia among top targets in cyber attacks on law firms (October 29, 2026): https://securitybrief.com.au/story/australia-among-top-targets-in-cyber-attacks-on-law-firms

Related reading

• CrowdStrike: AI Agents Behind Autonomous Intrusions
• Sony So-net Breach: 2.58 Million Records Exposed
• Capcom ID Breach: 11.7 Million Accounts Affected