Cybercriminal activity targeting US law firms is becoming more aggressive, with attackers recruiting individuals to gain physical access to offices and attempting to steal confidential client data within minutes of breaching networks, according to cybersecurity firm CrowdStrike.
In its “2026 Legal Threat Landscape Report”, released on Oct. 28, CrowdStrike said financially motivated adversaries accounted for 82% of observed malicious activity against the legal sector. Chatty Spider emerged as a major threat, with its activity against legal entities increasing by 129%.
The group has used unconventional methods to gain access to law firms. In one incident, it recruited an individual to impersonate IT personnel and physically enter a law firm’s premises to establish remote access to its systems.
In another incident, the attackers attempted to steal sensitive data just four minutes after gaining initial access, highlighting how quickly an intrusion can escalate into data theft.
Law firms are attractive targets because they hold privileged client communications, intellectual property, and confidential information on corporate transactions.
Stolen information can be used for extortion or exploited to compromise the businesses and government organizations represented by the firms.
CrowdStrike also reported a 39% year-on-year increase in the number of legal entities named on data leak sites by Big Game Hunting adversaries. A total of 455 legal entities were listed.
Other cybercriminal groups are exploiting legitimate identities and access to software-as-a-service applications to steal information and extort victims.
Snarky Spider and Cordial Spider targeted law firms through identity-based attacks. Both groups targeted the same firm within a one-month period, indicating that multiple adversaries may pursue the same high-value victim.
The report also documented increased espionage activity by China-linked threat groups targeting the legal sector.
CrowdStrike said the diversity of China-linked adversaries targeting law firms doubled.
The groups used different techniques, including exploiting legal-sector billing software, taking advantage of a zero-day vulnerability in VMware ESXi, and conducting large-scale password attacks.
In one case, Murky Panda targeted nearly 500 accounts at a single US law firm using 300 IP addresses over 30 days.
The findings were based on intelligence gathered by CrowdStrike Counter Adversary Operations, which tracks more than 290 named adversaries.
“Law firms are the new ATM for cybercriminals. Adversaries are exploiting the value of privileged client information, and they’re willing to go beyond the keyboard to get it,” said Adam Meyers, head of counter adversary operations at CrowdStrike.
“We’re seeing criminals recruit individuals to physically infiltrate law firms, blurring the line between digital and physical attacks. Defenders need visibility across identities, endpoints, and cloud environments to detect and disrupt these operations before access turns into extortion.”
