CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies
Cyber intrusions targeting the legal sector nearly doubled between 2023 and 2026, with financially motivated criminals accounting for 82% of observed activity against legal entities.
The legal sector has become a prime target for cybercriminals and state-sponsored actors, with attacks increasing dramatically between 2023 and 2026. Legal entities hold valuable information including privileged communications, corporate transactions, intellectual property, government matters, and financial records, making them attractive targets for those seeking financial gain or strategic intelligence.
The CrowdStrike 2026 Legal Threat Landscape Report analyzes threat activity observed from September 1, 2025 through August 31, 2026. It identifies key themes, trends, and events shaping the legal sector threat landscape, providing anticipatory assessments and actionable recommendations to help the sector prepare for evolving threats.
As AI technology advances, adversaries are accelerating the scale and sophistication of their operations, putting greater pressure on defenders. This evolving environment demands continuous intelligence-driven defense to detect and stop threats effectively.
eCrime Dominates Threat Landscape
Financially motivated adversaries accounted for 82% of observed activity against the legal sector. They profit from attacks by deploying ransomware or monetizing stolen data through extortion or resale on criminal markets. Big game hunting adversaries named 455 legal entities on dedicated leak sites, marking a 39% year-over-year increase.
CHATTY SPIDER has emerged as a dominant threat, with their activity surging 129% in the first eight months of 2026 compared to all of 2024. Law firms made up nearly 90% of their victims during this period. The adversary typically resumes data theft and extortion campaigns following a mid-year hiatus but returned slightly earlier than usual in 2026.
They manipulate victims by impersonating IT staff to establish remote access sessions and exfiltrate sensitive data within minutes, and they increasingly use trusted enterprise tools to do it.
In November 2025, CHATTY SPIDER hired a Russian national to physically access a U.S.-based law firm. The individual posed as an internal IT employee and was granted access to an onsite workstation, enabling the adversary to deploy remote monitoring and management (RMM) tools and attempt data exfiltration.
Two other significant eCrime threats, SNARKY SPIDER (emerged October 2025) and CORDIAL SPIDER (emerged November 2025), have targeted legal entities with nearly identical tactics, including vishing calls impersonating IT personnel and directing employees to single sign-on (SSO)-themed phishing pages.
China-Nexus Adversaries Intensify Operations
Multiple China-nexus adversaries conducted sustained cyber espionage campaigns against the legal sector throughout the reporting period, demonstrating evolution in zero-day exploitation of enterprise infrastructure, sophisticated cloud environment compromise, and targeted exploitation of legal-specific software.
Top China-nexus adversaries targeting the legal sector include WARP PANDA, TITAN PANDA, MURKY PANDA, and OVERCAST PANDA. WARP PANDA deployed various malware in victims' VMware vCenter environments, exploiting ESXi command logging bypass vulnerability CVE-2026-41709 as a zero-day as late as early 2026.
TITAN PANDA conducted the first observed targeting of legal sector-specific software in April 2026, exploiting a hardcoded IIS machine key vulnerability in Intapp Time Server, software almost exclusively used by law firms for timekeeping and billing.
MURKY PANDA's ORB28 password spraying campaign affected more than 340 primarily U.S.-based entities across numerous sectors, with the legal sector being the most affected. One law firm experienced nearly 500 distinct failed login attempts to as many accounts from approximately 300 distinct IP addresses in a 30-day period.
OVERCAST PANDA targeted executive-level employees at a U.K.-based legal firm in September and October 2025, consistent with Chinese intelligence collection priorities targeting key personnel with access to sensitive information and decision-making authority.
Defense Strategies for Legal Sector
CrowdStrike Counter Adversary Operations, which tracks more than 290 named adversaries, combines threat intelligence, managed threat hunting, and trillions of telemetry events from the CrowdStrike Falcon® platform to detect and stop threat actors.
The Counter Adversary Operations team comprises two integrated units: the Intelligence team, which identifies new adversaries and tracks malicious activity, and the OverWatch team, which applies this intelligence through proactive threat hunting across customer telemetry to detect and disrupt malicious activity.
As adversaries continue to evolve their tactics, legal sector organizations must enhance their defenses to stay ahead of increasingly sophisticated cyber threats targeting their sensitive information and privileged communications.
Related
