The landscape of cybercrime targeting legal professionals is evolving from purely digital breaches to sophisticated physical intrusions. According to a new report released by CrowdStrike, the threat group known as Chatty Spider has increased its activity by 129 percent in the first eight months of 2026 compared to all of 2024. Nearly 90 percent of this group's victims are law firms, making the legal sector a primary target for profit-driven criminals.

One particularly alarming tactic involves hiring individuals to physically enter law firm premises. In November 2025, investigators discovered that Chatty Spider recruited a Russian national to infiltrate a US law firm. This individual posed as an internal IT employee and gained access to an on-site workstation. From there, he installed remote access tools and attempted to move data to cloud storage. When he returned for a second visit the following day, law enforcement detained him. This incident highlights how adversaries are willing to go beyond traditional keyboard-based attacks to obtain privileged client information.

Adam Meyers, head of counter adversary operations at CrowdStrike, emphasized the severity of the situation. He stated that law firms have become the new ATM for cybercriminals who are exploiting the high value of sensitive legal data. The group employs various social engineering techniques, including phone calls where attackers impersonate IT staff to convince attorneys or assistants to open remote support sessions on platforms like Quick Assist, AnyDesk, Zoom, and Cisco Webex. Once inside, they can quickly attempt to exfiltrate data, with one recorded intrusion occurring just four minutes after gaining access.

The Federal Bureau of Investigation issued a Private Industry Notification in May 2025 regarding the Silent Ransom Group, which is also known as Luna Moth, Chatty Spider, and UNC3753. The advisory notes that this group has targeted US law firms since spring 2023. When remote access attempts fail, the group sends individuals to victim locations to plug storage devices directly into computers. CNN reported in June 2026 that multiple incidents occurred across US law firms involving these physical infiltration attempts. One case involved an executive at a New Jersey law firm who received a call about a computer virus spreading. A visitor was sent to his desk, but when the receptionist called upon his arrival, the visitor fled when approached by the lawyer.

Financially motivated adversaries accounted for 82 percent of the malicious activity observed against the legal sector during the reporting period. Big Game Hunting groups named 455 legal entities on their leak sites, representing a 39 percent increase from the previous year. Extortion estimates suggest approximately $100 million was extorted from law firms in the last six months alone. At least two US law firms received extortion letters demanding cryptocurrency or cash, with return addresses linked to empty offices in Washington DC and Boston.

State-sponsored actors remain a concern, comprising about 18 percent of the activity. China-linked groups such as TITAN PANDA exploited a hardcoded key in Intapp Time Server in April 2026, marking the first attack seen on software specific to the legal sector. Another group, WARP PANDA, exploited a VMware ESXi flaw before a fix existed. MURKY PANDA conducted nearly 500 failed login attempts on accounts at one US law firm over 30 days.

Security experts recommend strengthening multi-factor authentication, tightly controlling remote access tools, reviewing default settings, and verifying the credentials of all visitors. The FBI advises companies to keep copies of ID cards for anyone accessing firm spaces. As cybercriminals continue to adapt their methods, law firms must remain vigilant against both digital and physical threats to protect their clients' confidential information.