CrowdStrike warned on October 28, 2026 that cybercriminals are escalating attacks against U.S. law firms, sometimes recruiting people to impersonate IT staff and physically enter offices. Its new Legal Threat Landscape Report describes intrusions targeting confidential client communications, financial transactions and intellectual property.

The company’s threat-intelligence researchers attributed 82% of observed malicious activity against legal entities to financially motivated adversaries. CHATTY SPIDER, a group specializing in social engineering and data theft, increased its legal-sector activity by 129% in the first eight months of 2026 compared with all of 2024. The unequal comparison periods matter: this is not a year-over-year increase in all law-firm attacks.

In one investigated operation, CrowdStrike says criminals recruited someone to pose as an IT employee and establish remote access from inside law offices. In another, the attackers attempted to steal data just four minutes after initial access. The examples show how trusted identities and familiar support procedures can become security weaknesses.

Extortion is another concern. According to the report, criminal groups named 455 legal entities on dedicated data-leak sites between September 2025 and August 2026, a 39% increase from the preceding twelve-month period. A listing on a leak site is not, by itself, independent proof of every claimed compromise.

The findings also identify espionage activity. CrowdStrike reports that China-linked threat groups increasingly targeted law firms, including exploitation of billing software and a VMware ESXi zero-day. One group reportedly attempted passwords against nearly 500 accounts at a single U.S. law firm using hundreds of IP addresses.

The report underscores why virtualization security, identity controls and monitoring of remote-access tools matter beyond traditional technology companies. Firms that handle merger negotiations, government matters or sensitive client records may also expose the organizations they represent when compromised.

CrowdStrike recommends tighter identity and endpoint defenses, rapid investigation of suspicious remote sessions and greater visibility across cloud services. Those measures are particularly important when an attacker can move from first access to attempted theft in minutes. The findings are based on the vendor’s observed incidents, not a census of every law firm.

BitcoinVersus.Tech Editor’s Note:
We volunteer daily to ensure the credibility of the information on this platform is Verifiably True.

If you would like to support to help further secure the integrity of our research initiatives, please scan the QR code to donate (For the best results, scan the QR code on a Laptop or larger screen).