Law firms hold exactly what attackers want: privileged client communications, merger and acquisition details, intellectual property, litigation strategy and financial records. New research released on October 28, 2026 shows criminals and state-backed groups are acting on that value with increasing speed and aggression. CrowdStrike’s 2026 Legal Threat Landscape Report finds that intrusions targeting legal entities have nearly doubled from their 2023 baseline, and that extortion of the sector is still climbing.
This guide breaks down what the report found, how the most active group operates, and the specific controls the FBI and CrowdStrike recommend for firms that want to stay off the next leak-site list.
Key points
- Extortion groups named 455 legal entities on data leak sites between September 2025 and August 2026, up 39% from the prior year.
- Financially motivated attackers accounted for 82% of observed malicious activity against the legal sector.
- The dominant group impersonates IT support by phone, and in one case hired a person to walk into a U.S. law firm posing as an IT employee.
- The highest-value defenses are not exotic: phishing-resistant MFA, tight control of remote access tools, a published IT-contact policy and visitor verification.
Nearly 2×
intrusions targeting legal entities in 2026 versus the 2023 baseline
455
legal entities named on data leak sites, up 39% year over year
+129%
CHATTY SPIDER activity against legal entities, first eight months of 2026 versus all of 2024
82%
of observed malicious activity was financially motivated
Source: CrowdStrike 2026 Legal Threat Landscape Report overview and press release, October 28, 2026.
Extortion is the business model
Most of the pressure on law firms is about money. “Big game hunting” groups, which target large organizations for high-value extortion, named 455 legal entities on their dedicated leak sites from September 2025 through August 2026. That is 39% more than the prior reporting period; TNW reports the prior-year count as 327.
Financially motivated adversaries accounted for 82% of observed malicious activity against the sector. Their leverage is the confidentiality of client information itself. Some skip encryption entirely: the FBI says the Silent Ransom Group, which CrowdStrike tracks as CHATTY SPIDER, steals data and extorts victims “without relying on traditional ransomware encryption,” then pressures them by calling employees and clients.
The fake IT support playbook
CrowdStrike calls CHATTY SPIDER the dominant threat to U.S. law firms. Its activity grew 129% in the first eight months of 2026 compared with all of 2024, and its methods are deliberately low-tech. An FBI FLASH advisory dated May 26, 2026 says the group has consistently targeted U.S. law firms since spring 2023, using phone calls and phishing emails to pose as IT support and talk employees into opening a remote session.
The report shows how far the group will go. In one intrusion, it attempted to steal sensitive data just four minutes after gaining access, and in another it recruited a person to impersonate IT staff and physically enter a law firm. According to TNW’s account of the report, in November 2025 that person walked into a U.S. law firm posing as an internal IT employee, helped install remote access tools and was detained when he returned the next day. The FBI warns that when remote access fails, the group may send someone in person to copy data to a USB or external drive.
1Phishing lure
What happens: an email or call sets up the pretext. What breaks it: Train staff to report it.
2Fake IT call
What happens: a caller poses as the help desk. What breaks it: Verify every IT contact through a known channel.
3Remote access
What happens: the employee opens a remote session, or an on-site impostor arrives. What breaks it: Allow only approved remote tools and check visitor ID.
4Data out fast
What happens: theft can begin within minutes; in one case, four. What breaks it: Block external drives and limit access from untrusted networks.
5Extortion
What happens: leak threats and calls to the firm’s clients. What breaks it: Keep tested backups and a rehearsed response plan.
Also essential at every step: phishing-resistant multifactor authentication.
Reuters has reported breaches at several prominent law firms, and many major law firms that were targeted said they were victims of a “social engineering” event. The pattern is consistent: the attacker does not need to defeat your technology if someone inside the firm can be persuaded to let them in.
Identity, cloud and legal software are now targets
CHATTY SPIDER is not the only group focused on the sector. The report describes criminal and state-backed activity that reaches well beyond phishing:
| Adversary | Motive | What CrowdStrike observed | What it means for a firm |
|---|---|---|---|
| SNARKY SPIDER and CORDIAL SPIDER | Financial | Identity-based attacks abusing trusted access to SaaS applications; both targeted the same law firm one month apart | Cloud apps and the identities behind them are now a primary front door. |
| TITAN PANDA | China-nexus espionage | The first observed exploitation of legal-sector-specific billing software | Practice and billing platforms need the same patching and hardening as core systems. |
| WARP PANDA | China-nexus espionage | Used a VMware ESXi zero-day for covert access | Virtualization hosts need monitoring, not just the servers running on them. |
| MURKY PANDA | China-nexus espionage | Password spraying against nearly 500 accounts at one U.S. law firm, from 300 IP addresses over 30 days | Weak or reused passwords are found eventually; MFA has to cover every account. |
CrowdStrike also found that nearly twice as many China-nexus adversaries targeted the legal sector compared with 2023. For firms that handle government matters, cross-border transactions or sensitive litigation, that espionage interest sits alongside the extortion risk rather than replacing it.
AI is shrinking the time to respond
CrowdStrike warns that adversaries are compressing the time from initial access to data theft, and that “as AI capabilities advance that window will only shrink.” Adam Meyers, who leads CrowdStrike’s counter adversary operations, told Reuters that more threat actors are using agentic technology “to democratize hacking,” adding: “It’s going to get a lot worse before it gets better.”
When data can leave within minutes of a successful phone call, a weekly log review or a next-morning ticket is too slow. Detection has to be continuous, and the people answering alerts need the authority to isolate a device or disable an account immediately.
What law firms should do now
The FBI advisory and CrowdStrike’s findings point to a short list of controls that directly break the playbook described above. Few require new categories of technology; most require policy, configuration and follow-through. For a broader baseline covering governance, email, endpoints, vendors and AI safeguards, see our law firm cybersecurity checklist.
| Control | Why it matters now | Source |
|---|---|---|
| Phishing-resistant MFA everywhere possible | Stops password spraying and limits what a stolen password or tricked user can unlock; watch for new MFA devices added to accounts | FBI; CrowdStrike |
| Tight control of remote access tools | The fake IT call depends on an employee opening a remote session; limit which tools can run and verify before any session | CrowdStrike; FBI |
| A published IT-contact policy | Staff should know exactly how real IT support contacts them and how to verify it before acting | FBI |
| Visitor verification | Verify the credentials of anyone accessing firm spaces, including keeping copies of identification | FBI |
| Restrict external drives and risky access | Disable external drives on computers with confidential data, and limit access to sensitive data from home or public networks | FBI |
| Harden legal and SaaS platforms | Patch practice and billing software and review default settings, now that attackers target legal-specific applications | CrowdStrike (via TNW); ITECS |
| Visibility across identities, endpoints and cloud | Lets defenders spot unusual access and stop it before it becomes extortion | CrowdStrike |
| Training, backups and a rehearsed response plan | Staff who report suspicious calls, tested backups and a plan for client notification reduce both the odds and the impact of extortion | FBI (training, backups); ITECS |
A five-minute test for this week
Ask three people in your firm, including one assistant and one partner, how they would know a call from “IT” is real. If the answers differ, your firm needs a written IT-contact policy before it needs any new tool.
Questions for firm leadership
Leadership checklist
- Is phishing-resistant MFA enforced on email, document management, billing and every remote access path?
- Which remote support tools can run on firm computers, and who approves a new one?
- Does every employee know how IT will contact them, and how to verify it?
- Would front-desk staff stop an unscheduled “technician” and verify their identity?
- Who watches for unusual sign-ins and data movement after hours, and can they act immediately?
- Have practice management, billing and virtualization platforms been patched and reviewed this quarter?
- Is there a tested plan for client notification and extortion demands?
Protect privileged client data
ITECS builds security into managed IT for law firms, with zero-trust security, MFA, endpoint protection and support for platforms such as iManage and NetDocuments.
Explore IT and security for law firmsWant to rehearse your response first? Plan a tabletop exercise.
Sources and methodology
- CrowdStrike — 2026 Legal Threat Landscape Report press release — October 28, 2026
- CrowdStrike — 2026 Legal Threat Landscape Report overview
- FBI — FLASH-20260526-01: Silent Ransom Group Impersonating IT Personnel through Social Engineering — May 26, 2026
- Reuters — Researchers warn of surging law firm cyber attacks fueled by AI — October 28, 2026
- TNW — reporting on the CrowdStrike legal report — October 28, 2026
Methodology: Figures come from CrowdStrike’s published release and report overview, the FBI advisory and the dated reporting above; charts were built directly from those figures. CrowdStrike’s full report was not independently reviewed. Prepared by the ITECS team with AI-assisted research on October 28, 2026.
continue reading
More ITECS blog articles
About ITECS Team
The ITECS team consists of experienced IT professionals dedicated to delivering enterprise-grade technology solutions and insights to businesses in Dallas and beyond.
View full profile and articles