CrowdStrike Report Details Rising eCrime and China-Linked Threats to Legal Sector
Summary
CrowdStrike’s report on activity observed from Sept. 1, 2025, to Aug. 31, 2026, says eCrime accounted for 82% of threats to legal entities and details rising China-linked espionage, including reported zero-day exploitation.
Key points
- The report says intrusions targeting the legal sector nearly doubled between 2023 and 2026.
- Financially motivated actors accounted for 82% of observed activity; big game hunting actors named 455 legal entities on leak sites, up 39% year over year.
- CHATTY SPIDER activity rose 129% in the first eight months of 2026 compared with all of 2024; law firms made up nearly 90% of its victims during the reporting period.
- The report describes CHATTY SPIDER impersonating IT staff to establish remote access and steal data, and recounts a physical-access attempt involving a U.S. law firm.
- SNARKY SPIDER and CORDIAL SPIDER used similar tactics, including vishing that impersonated IT staff and SSO-themed phishing pages.
- The report says WARP PANDA exploited CVE-2026-41709 as a zero-day in some VMware ESXi environments, while TITAN PANDA exploited a hardcoded IIS machine key vulnerability in Intapp Time Server.
Article Details
- Publisher
- CrowdStrike
- Report Period
- 2025-09-01 to 2026-08-31
- Scope
- Threat activity targeting the legal sector
- Key Statistics
- Cyber intrusions targeting the legal sector nearly doubled between 2023 and 2026.
- Financially motivated adversaries accounted for 82% of observed activity against the legal sector.
- Big game hunting adversaries named 455 legal entities on dedicated leak sites, a 39% year-over-year increase.
- CHATTY SPIDER activity increased 129% in the first eight months of 2026 compared with all of 2024.
- Law firms made up nearly 90% of CHATTY SPIDER's victims during the reporting period.
- Recommendations
- Maintain continuous intelligence-driven defense to detect and stop threats.
MITRE ATT&CK
T1110.003 · Password SprayingMURKY PANDA's ORB28 campaign used password spraying against accounts.T1219 · Remote Access ToolsCHATTY SPIDER enabled deployment of remote monitoring and management tools during a physical intrusion.T1566.002 · Spearphishing LinkSNARKY SPIDER and CORDIAL SPIDER directed employees to SSO-themed phishing pages.T1566.004 · Spearphishing VoiceSNARKY SPIDER and CORDIAL SPIDER used vishing calls impersonating IT personnel.T1567.002 · Exfiltration to Cloud StorageDuring the reported physical intrusion, CHATTY SPIDER attempted to exfiltrate data via cloud storage services.
CVE
Threat Actors
ARMORY CASTLEReportedly conducted intrusions at U.S.-based entities, including legal-sector targets, and deployed malware in victims' VMware vCenter environments. In several cases, including as late as early 2026, it exploited CVE-2026-41709 as a zero-day.Cordial SpiderIdentified as an eCrime threat that targeted legal entities in data theft and extortion campaigns, including vishing calls impersonating IT personnel and directing employees to SSO-themed phishing pages.MURKY PANDAThe report attributes the ORB28 password-spraying campaign to MURKY PANDA. Although slightly outside the reporting period, the campaign affected more than 340 primarily U.S.-based entities, with the legal sector most affected.OVERCAST PANDAReportedly targeted executive-level employees at a U.K.-based legal firm in September and October 2025; the report characterizes this as consistent with Chinese intelligence collection priorities.Silent Ransom GroupReportedly targeted legal entities, primarily U.S.-based law firms, using impersonation to establish remote access and steal data for extortion. The report also describes a Russian national hired by the group for a physical intrusion at a U.S.-based law firm in November 2025.SNARKY SPIDERIdentified as an eCrime threat that targeted legal entities in data theft and extortion campaigns, including vishing calls impersonating IT personnel and directing employees to SSO-themed phishing pages.TITAN PANDAReportedly exploited a hardcoded IIS machine key vulnerability in Intapp Time Server while targeting legal-sector software in April 2026.
Products
ESXiIn several of these cases, and as late as early 2026, the adversary exploited ESXi command logging bypass vulnerability CVE-2026-41709 as a zero-day.Intapp Time ServerThe adversary exploited a hardcoded IIS machine key vulnerability in Intapp Time Server, software almost exclusively used by law firms for timekeeping and billing.VMware vCenterWARP PANDA deployed several forms of malware in victims’ VMware vCenter environments.