|
29 October 2026 (New York, NY) - Law firms faced a 129% increase in malicious activity over the first 8 months of the year compared to all of 2024, according to a report today from cybersecurity company CrowdStrike - with the Russian hacker collective Silent Ransom Group, also known as Chatty Spider, leading the charge.
CrowdStrike's 2026 Legal Threat Landscape Report highlighted Chatty Spider as the dominant threat to legal sector entities. The group has been around since 2022 and has focused heavily on law firms over the past few years.
Tracked adversaries named 455 legal entities on dedicated leak sites during the reporting period, a 39% increase from the 327 named in the previous 12 months. And there are probably more since many law firms avoid disclosing hacks. The report notes:
"Chatty Spider has demonstrated a consistent pattern of surges and dormancy periods while continuously evolving their tactics, techniques, and procedures, escalating from callback phishing in 2024 to voice phishing, Quick Assist abuse, and, most recently, physical intrusion at law firm locations.
Our report covered activity observed from Sept. 1, 2025, through Aug. 31, 2026.
The analysis is based on CrowdStrike's tracking of more than 290 named hacking entities".
Chatty Spider manipulates victims in the legal sector - accounting for 90% of its victims - by impersonating information technology staff to establish remote access sessions and exfiltrate sensitive data. The group uses tools like Zoom, Google Drive and OneDrive to evade detection and has recently begun deploying physically present operatives, according to CrowdStrike's report.
Entities known as Snarky Spider and Cordial Spider also targeted the sector. Additionally, nation-state threat actors accounted for around 18% of all incidents observed targeting the legal sector during the reporting period.
Said Adam Meyers, head of counter adversary operations at CrowdStrike:
"Law firms are the new ATM for cybercriminals. We're seeing criminals recruit individuals to physically infiltrate law firms, blurring the line between digital and physical attacks. Defenders need visibility across identities, endpoints, and cloud environments to detect and disrupt these operations before access turns into extortion".
CrowdStrike is one of the most dominant pure-play cybersecurity companies in the world, particularly leading the Endpoint Detection and Response (EDR) and ransomware prevention sectors, and is widely considered a top-tier leader in cyber threat intelligence and breach reporting. It is considered the best in legal-sector threat intelligence.
CrowdStrike's stock price is up 132% since the start of the year, sitting at around $264.
| 
