Cyber intrusions aimed at law firms and other legal entities nearly doubled between 2023 and 2026, according to CrowdStrike's Counter Adversary Operations team. The firm's 2026 Legal Threat Landscape Report, covering activity from 1 September 2025 to 31 August 2026, finds that financially motivated crews account for most of the pressure while China-nexus espionage groups quietly work the same targets for intelligence.
The reason is what law firms hold: privileged communications, merger and acquisition details, intellectual property, government matters and financial records.
Extortion crews make up 82% of the threat
CrowdStrike attributes 82% of the activity it observed against the legal sector to eCrime adversaries. Big game hunting groups named 455 legal entities on dedicated leak sites during the period, a 39% rise on the year before.
The standout is CHATTY SPIDER, the data theft and extortion crew IntelFusions tracks as Silent Ransom Group (also known as Luna Moth). CrowdStrike says its activity in the first eight months of 2026 was 129% higher than in all of 2024, and that law firms made up nearly 90% of its victims, almost all of them in the US. The crew impersonates IT staff to talk employees into granting remote access sessions, then pulls sensitive data out within minutes.
It has also gone physical. In November 2025, CrowdStrike says, CHATTY SPIDER hired a Russian national to walk into a US law firm posing as an internal IT employee. He was given access to an onsite workstation, where he helped deploy remote monitoring and management (RMM) tools and attempted to move data to cloud storage, and he was detained on a second visit. CrowdStrike adds that public reporting indicates the crew used US-based individuals for several more physical intrusions during 2026.
Two newer crews follow the same script. SNARKY SPIDER, which emerged in October 2025, and CORDIAL SPIDER, which emerged a month later, both run high-tempo data theft and extortion campaigns built on vishing calls that impersonate IT personnel and steer employees to single sign-on themed phishing pages. In one case, both hit the same law firm a month apart. We have previously detailed how a single vishing call can turn into a mass file theft.
China-nexus spies go after legal software
CrowdStrike names four China-nexus groups as the top espionage threats to the sector:
- WARP PANDA deployed malware in victims' VMware vCenter environments at US entities that included legal targets, and as late as early 2026 exploited CVE-2026-41709, an ESXi command logging bypass, as a zero-day.
- TITAN PANDA carried out what CrowdStrike calls the first observed targeting of legal sector software in April 2026, exploiting a hardcoded IIS machine key vulnerability in Intapp Time Server, a timekeeping and billing product used almost exclusively by law firms.
- MURKY PANDA (which IntelFusions profiles under HAFNIUM) ran its ORB28 password spraying campaign against more than 340 mainly US entities, with legal the most affected sector. One firm saw nearly 500 failed logins to as many accounts from about 300 IP addresses in 30 days.
- OVERCAST PANDA targeted executive-level staff at a UK legal firm in September and October 2025, consistent with Chinese intelligence collection priorities.
Verify the caller, then patch ESXi and Intapp
Based on the techniques CrowdStrike describes, treat any unsolicited call or visit from "IT" as suspect until it is verified through a known internal channel, including people who turn up in person. Restrict which RMM tools may run on endpoints and alert on new remote access sessions. Patch VMware ESXi and vCenter and any Intapp Time Server deployment, and watch for low-and-slow password spraying spread across hundreds of accounts and IP addresses.
The pattern across both halves of the report is the same: attackers are skipping the firewall and going for the people and the niche software that law firms rely on. For a sector whose product is confidentiality, the help desk phone line has become as important a control as any patch.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.