CrowdStrike: Cybercriminals Blur Digital, Physical Lines in Attacks on Law Firms

CrowdStrike has released the CrowdStrike 2026 Legal Threat Landscape Report, revealing that financially motivated adversaries accounted for 82% of observed malicious activity against the legal sector, with CHATTY SPIDER emerging as a dominant threat to U.S. law firms. Cybercriminals are finding new ways to monetise the sector, escalating from social engineering to physical intrusions to steal sensitive client information and turn it into profit.

Adversaries are compressing the time from initial access to data theft, and as AI capabilities advance, that window will only shrink, leaving defenders with less time to stop attacks. With privileged access to client communications, intellectual property, and corporate transactions, law firms serve as gateways to sensitive intelligence that cybercriminals can exploit, putting the businesses and government organisations they represent at risk.

CrowdStrike Legal Threat Landscape Report Highlights

Based on frontline intelligence from CrowdStrike Counter Adversary Operations tracking more than 290 named adversaries, the report reveals:

• Cybercrime Group Targets Firms With Increasing Aggression: CHATTY SPIDER represented the dominant threat to legal entities, with malicious activity growing 129%. In one intrusion, the group recruited an individual to impersonate IT staff and physically infiltrate law firms to establish remote access. In another, the adversary attempted to exfiltrate sensitive data just four minutes after gaining initial access, highlighting the speed of its operations.
• Legal Entity Extortion Surges: Big Game Hunting adversaries named 455 legal entities on data leak sites, a 39% year-over-year increase. Financially motivated adversaries accounted for the majority of observed activity against the legal sector, exploiting the highly confidential nature of client information to maximise extortion pressure.
• SPIDERS Expand Identity-Based Attacks: SNARKY SPIDER and CORDIAL SPIDER targeted law firms through identity-based attacks, exploiting trusted access to SaaS applications for data theft and extortion. Both adversaries targeted the same law firm just one month apart, highlighting the convergence of criminal groups on high-value legal targets.
• China-Nexus Adversaries Intensify Espionage Operations: As China-nexus adversary diversity doubled in the legal sector, TITAN PANDA conducted the first observed exploitation of legal-sector-specific billing software. WARP PANDA leveraged an ESXi zero-day for covert access. MURKY PANDA conducted large-scale password spraying, targeting nearly 500 accounts at a single U.S. law firm from 300 IP addresses over 30 days, demonstrating the scale and persistence of China-nexus operations.

“Law firms are the new ATM for cybercriminals. Adversaries are exploiting the value of privileged client information, and they’re willing to go beyond the keyboard to get it,” said Adam Meyers, Head of Counter Adversary Operations, CrowdStrike. “We’re seeing criminals recruit individuals to physically infiltrate law firms, blurring the line between digital and physical attacks. Defenders need visibility across identities, endpoints, and cloud environments to detect and disrupt these operations before access turns into extortion.”

What This Means for Asia’s Law Firms

CrowdStrike’s report is built largely around US firms, and the named incidents (the physical intrusions, the 500-account password spray, the exploited billing software) all involve American targets. It would be lazy to copy those findings across to Asia. It would be just as lazy to assume the region is out of range. The business model that makes a law firm attractive to criminals does not stop at the Pacific.

Same Goldmine, Different Geography

The core of the CrowdStrike report is that law firms hold privileged client communications, intellectual property and deal information. Asian firms hold exactly the same. Many sit at the centre of cross-border M&A, regional disputes, regulatory investigations and IP filings, often for multinational clients and government-linked entities. For an attacker, one compromised firm can mean access to dozens of clients without having to breach any of them directly.

The extortion angle may bite harder in this region. Confidentiality is the product a law firm sells. A criminal threatening to leak client files is not only threatening embarrassment but also the firm’s reputation, its professional standing and its relationships with clients who may be headline names. The report notes that 455 legal entities were named on leak sites, up 39% year on year. Even if only a fraction are in Asia, that is the pressure point.

Three Things Worth Taking Seriously

1. Speed. The CrowdStrike report describes an adversary attempting to exfiltrate data just four minutes after initial access. Most firms, especially smaller ones, do not have 24/7 monitoring capable of responding in four minutes. Many would be lucky to notice in four days.
2. Identity-based attacks. SNARKY SPIDER and CORDIAL SPIDER targeted trusted access to SaaS applications, and both went after the same firm a month apart. Asian firms have moved quickly to cloud document management, email and collaboration tools. Stolen or abused credentials do not need malware, and a firewall will not stop them.
3. Physical intrusion. The most unusual finding is a group recruiting a person to pose as IT staff and walk into law firms to set up remote access. That is far from a typical cyber risk. Firms in shared office towers, with visitor-friendly receptions and outsourced facilities staff, should ask how easily someone in a polo shirt and a lanyard could reach a network port.

The Espionage Question

The CrowdStrike report notes that China-nexus adversary diversity doubled in the legal sector. For Asian firms advising on regional trade, infrastructure, technology transfer or sensitive disputes, state-linked espionage is a plausible concern. This is inference, not a finding from the report, but the logic holds: where the commercial and geopolitical stakes are highest, so is the interest in legal advice.

What Firms Should Do

In light of the findings of CrowdStrike, firms in the legal sector might want to do the following:

• Enforce multi-factor authentication, particularly for cloud and remote access.
• Review who has standing access to document and billing systems, and remove what is not needed.
• Treat visitor and contractor access as a security control, not a courtesy.
• Rehearse the extortion scenario: who decides, who calls clients, who calls the regulator.
• Ask vendors, including legal-specific software vendors, how quickly they patch.