Law Firm Cyberattacks: Why Impostors Are Getting In
Learn how attackers are targeting law firms with fake IT support, in-person intrusions and software exploits—and how firms can reduce the risk.
Law Firm Cyberattacks Are Moving Beyond the Keyboard
A convincing phone call from "IT" can already put a law firm at risk. What CrowdStrike describes goes further: in November 2025, an alleged cybercrime group member reportedly walked into a US law firm in person, posed as internal IT, and accessed an onsite workstation. He was detained the next day after he returned, the report says.
This isn't a brand-new problem - it's a familiar one with a more human entry point. Attackers go after the people and access paths firms depend on to serve clients: remote support tools, email accounts, billing software, and confidential case files. When a firm is breached, the damage often extends beyond downtime. It can expose privileged information, strain client relationships, and force painful choices under extortion pressure.
CrowdStrike says the group it calls CHATTY SPIDER has increased its activity against law firms. The report also describes ransomware and extortion, China-linked activity, and weaknesses in legal-sector software. Here's what those tactics mean in practice, what the evidence supports (and what it doesn't), and how firms can reduce exposure without turning daily work into a bureaucratic obstacle course.
How did the in-person law firm attack work?
CrowdStrike's account of the November 2025 incident describes a physical visit as part of a bigger intrusion, not a replacement for digital methods. The alleged intruder posed as internal IT, reached an onsite workstation, and helped install remote-access tools. The attackers then tried to move data to cloud storage, according to the report. Law enforcement detained the man when he came back the next day.
The FBI has also warned about a similar tactic. In a May advisory on the Silent Ransom Group, it identified CHATTY SPIDER as another name for the same group and said it targeted US law firms starting in spring 2023. The advisory says that if remote access attempts fail, the group may send someone to a victim's location to connect a storage device. CrowdStrike also points to CNN reporting involving US-based individuals connected to physical intrusions in 2026.
Taken together, these accounts suggest a straightforward shift in how firms should think about risk: security controls need to cover office entry as well as remote logins. If a visitor can fit a credible story, they can exploit the assumptions people make in a workplace - especially when staff are used to getting IT help quickly, with minimal friction.
The digital approach still starts with trust
In the incidents CrowdStrike describes, attackers called and posed as IT staff, persuading attorneys (or their assistants) to open remote support sessions. The report names tools such as Quick Assist, AnyDesk, Zoom, and Cisco Webex. These products have legitimate uses. The problem isn't that the software is "bad" - it's that an unexpected caller can get access without anyone confirming who they are and why they need it.
Once a session is established, the attacker may have a very short window to act. CrowdStrike says that in one 2025 intrusion, the group tried to take data about four minutes after gaining access. It also describes extortion as part of the goal: the group threatens to publish stolen files if negotiations fail.
What the evidence establishes - and what it doesn't
CrowdStrike's incident details are based on its telemetry and intelligence teams. The FBI advisory also covers physical visits, but the broader set of cases referenced in CrowdStrike's report includes items that aren't independently verified by the outlet that originally covered them. That distinction matters: CrowdStrike's report is useful threat intelligence, not a complete headcount of everything happening to law firms.
Even so, the practical lesson is hard to miss. Treat an unsolicited support request as an identity problem - whether it arrives by phone, video, or in person. A familiar tool, or a professional tone, isn't proof that the person is authorized.
Why are law firms attractive targets?
Law firms manage information that clients value and protect: contracts, deal details, litigation strategy, personal data, and commercial plans. One firm may work across multiple clients and industries, which can concentrate a lot of sensitive material in a single place. That creates a clear reason for attackers to pursue both direct payoff and leverage - either against a client or against a legal matter.
CrowdStrike's Adam Meyers described law firms as "the new ATM for cybercriminals," pointing to the value of privileged client information. The phrasing is blunt, but the incentive is simple: stolen information can fuel extortion, and disruption can pressure a firm to restore systems quickly. Payment doesn't guarantee the problem goes away, either - firms shouldn't assume paying will stop publication or further misuse.
CrowdStrike reports that CHATTY SPIDER's activity rose 129% in the first eight months of 2026 compared with all of 2024, and that law firms made up nearly 90% of its victims. Those are CrowdStrike's figures, based on its own intelligence, not independently audited industry-wide statistics. The report also says 455 legal entities appeared on ransomware and extortion leak sites during September 2025-August 2026, up from 327 in the previous year.
The attack surface is wider than the law firm's network
A legal practice depends on more than laptops and servers. Staff use cloud document storage, video meetings, remote support tools, identity platforms, billing systems, and third-party services. If an attacker can impersonate support staff, they can target the human step that connects those systems, rather than trying to break every technical control on its own.
That's why security policies that only "work on paper" tend to fall apart under pressure. If lawyers can install remote tools or approve a login prompt to avoid delaying a client matter, an attacker can make the unsafe choice look reasonable. The workflow itself has to make the authorized path clear - and not unbearably slow.
CrowdStrike says profit-driven criminals accounted for 82% of the malicious activity it observed against the sector. The report also describes two other groups - SNARKY SPIDER and CORDIAL SPIDER - targeting the same firm a month apart. CrowdStrike says both reportedly used phone calls and fake single sign-on pages. So firms shouldn't build their response around one named group or one storyline. The durable risk is repeated use of familiar techniques - impersonation, credential theft, remote access, and data extortion - by different actors.
Confidentiality raises the cost of a breach
A breach can hurt in more ways than rebuilding systems. It can expose client information, throw off court or transaction deadlines, trigger notification obligations under contracts and law, and damage client trust. The exact requirements depend on the data involved, client agreements, and applicable legal rules - so firms should bring legal and privacy advisers into response planning early.
That doesn't mean every firm needs the same security setup. A small practice and a large international firm operate very differently, and budgets vary. Still, both need a clear view of what systems hold the most sensitive information, who can access them, and how to contain a suspected compromised account or device.
What does legal software have to do with the threat?
Not every attack described in the report depends on tricking an employee. CrowdStrike also reports state-linked activity, which it estimates at about 18% of the malicious activity it observed against the sector. Much of that activity is attributed to groups linked to China. CrowdStrike says the overall volume of China-linked activity has stayed fairly steady, while the number of groups involved has nearly doubled since 2023.
One reported incident shows why legal firms should look beyond general office tools. In April 2026, CrowdStrike says a group it calls TITAN PANDA allegedly exploited a hardcoded key in Intapp Time Server, a timekeeping and billing product used by many law firms. CrowdStrike describes this as the first time it had observed an attack targeting software specific to the legal sector.
A hardcoded key is a credential or secret embedded in software rather than managed securely for each customer or deployment. If attackers can obtain or exploit it, the issue may extend across multiple installations. The risk depends on the product's configuration, how broadly the vulnerability affects deployments, and how quickly the vendor responds. The report doesn't, by itself, prove that every Intapp customer was affected.
Third-party software changes the security boundary
When a firm relies on specialist billing or case-management software, the vendor's security becomes part of the firm's risk picture. That doesn't remove the firm's responsibility to manage access and monitor its own environment. But it does mean security reviews should cover things like updates, authentication design, secrets management, logging, incident notification, and how quickly the vendor can support investigations.
CrowdStrike also describes WARP PANDA exploiting a VMware ESXi flaw, CVE-2026-41709, before a fix was available. Separately, MURKY PANDA allegedly made nearly 500 failed login attempts against almost 500 accounts at one US law firm, using around 300 IP addresses over 30 days. These examples point to different weaknesses - a software bug, a product-specific key, and sustained credential attempts. They shouldn't be treated as one single problem with one fix.
Practical implications for procurement and IT
A product aimed at a narrow industry can still be a high-value target - especially if it's embedded in that sector's workflow. Before adopting or renewing critical software, firms can ask vendors how they handle security findings, whether strong authentication is enforceable by customers, what audit logs are available, and how access is separated between customers.
Inside the firm, keep an inventory of business-critical applications and their owners. Identify what's exposed to the internet, what stores client data, and what can affect billing or casework. That inventory helps prioritize patches and investigations based on real business impact, instead of treating every update as equally urgent.
How can a law firm reduce the risk?
The goal shouldn't be banning every remote support tool or forcing every office visitor to wait indefinitely. Those steps can slow legitimate work without stopping a determined attacker. A better approach is to make access conditional on verified identity, a clear approved purpose, and an auditable process. Then focus stronger controls on the systems and data where a compromise would do the most harm.
CrowdStrike recommends strengthening multi-factor authentication (MFA), tightly controlling remote-access tools, reviewing default and hardcoded settings, and watching for newly registered MFA devices. The FBI advises organizations to verify visitors and keep copies of identification. These recommendations work best when treated as one system: identity checks, access controls, monitoring, and a response path staff can follow under time pressure.
1. Give staff a verification route that works
Set a simple rule: staff shouldn't grant access just because someone claims to be from IT. They should end the unexpected call or meeting and contact the support team through a known, independently verified channel. For in-person requests, reception (or a designated host) should confirm the person's identity and their appointment with the relevant internal team before allowing access to offices or devices.
The process has to be usable. If verifying a support request reliably takes longer than honoring it, people will learn to skip the check. Set up a help desk number or an internal ticket route, define who can approve urgent exceptions, and tell staff exactly what to do when a requester pushes back or asks them to keep things quiet.
2. Restrict remote access and strengthen MFA
Maintain an approved list of remote-support tools and limit who can install or launch them. Where possible, require approval for support sessions, use named accounts instead of shared credentials, and log who connected, when, and to which device. Revisit the approved list regularly - tools approved for a project can sit around long after the project ends.
For MFA, prefer phishing-resistant methods where they're available, and alert on newly enrolled devices or changes to authentication settings. MFA isn't a magic shield. Attackers can still persuade someone to approve a prompt or register a device. The aim is to make account takeover harder and to make suspicious changes stand out quickly.
3. Protect sensitive data and prepare for extortion
Restrict access to client files based on role and matter. Separate administrative privileges from everyday accounts, and make sure important data has protected, tested backups. Backups help with recovery from disruption - but they don't erase the harm from stolen information. Firms also need a plan for assessing possible disclosure, preserving evidence, notifying the right parties, and making payment decisions with legal and incident-response guidance.
Run the plan before something goes wrong. A short tabletop exercise can test who can isolate a device, contact the insurer or external responders, communicate with clients, and keep business-critical deadlines moving. The goal isn't to predict every detail - it's to reduce confusion during the first hours, when incomplete information can drive bad decisions.
4. Manage vendors and monitor for the attack sequence
Ask critical software vendors about security updates, known exposure, customer notification practices, and what audit information they provide. Review default settings and secrets as part of deployment, and track which systems need urgent attention when a vendor reports a vulnerability. For on-prem infrastructure and cloud services, assign a clear owner for patching and configuration reviews.
Monitoring should connect the sequence of likely intrusion steps: unusual support sessions, new remote-access software, unexpected MFA enrollments, atypical sign-ins, and large or unusual data transfers. One event might be harmless. But several events close together - especially after an unsolicited support request - should trigger rapid investigation.
Conclusion
The signal in CrowdStrike's report isn't that every law firm is about to face an in-person intrusion. It's that attackers are mixing familiar digital tactics with impersonation - and, in some cases, physical access. Firms need controls that cover the full chain: who's asking for access, what they can reach, whether activity is visible, and how fast the organization can respond.
Start with the basics that reduce multiple risks at once: a verification process people can actually follow, tightly managed remote access, strong MFA, visibility into critical software, and a tested plan for both data theft and downtime. The right balance depends on firm size and systems - but trust should never be the only control protecting client information.