CrowdStrike reports 129% surge in cyberattacks on US law firms by CHATTY SPIDER
CrowdStrike has identified a 129% increase in cyberattacks targeting US law firms by the group CHATTY SPIDER, with nearly 90% of its victims being legal entities. The group also attempted physical infiltration of a US law firm, while state-backed hackers, primarily from China, exploited vulnerabilities in legal sector software.
Editor, Lazyfounder
TABLE OF CONTENTS
Surge in attacks on law firms
CrowdStrike reported a 129% increase in cyberattacks by the group CHATTY SPIDER against US law firms in the first eight months of 2026, compared to all of 2024. Nearly 90% of the group’s victims were law firms, according to the company.
The group, also known as the Silent Ransom Group, has targeted US law firms since spring 2023. CrowdStrike described law firms as "the new ATM for cybercriminals," citing a 39% year-over-year increase in legal entities named on ransomware and extortion leak sites between September 2025 and August 2026. A total of 455 legal entities were listed during this period.
Physical infiltration and remote access tools
In November 2025, CHATTY SPIDER hired a Russian national to physically infiltrate a US law firm. The individual posed as an internal IT employee to gain access to an onsite workstation, installed remote access tools and attempted to transfer data to cloud storage. The attacker was detained by law enforcement during a second visit.
CrowdStrike observed CHATTY SPIDER using US-based individuals for multiple physical intrusions in 2026. The group also exploited tools like Quick Assist, AnyDesk, Zoom and Cisco Webex to maintain remote access. The FBI and CrowdStrike recommend tightening controls on remote access tools and verifying all visitors.
State-backed hackers exploit legal sector software
State-backed hackers, primarily linked to China, accounted for 18% of malicious activity against the legal sector. CrowdStrike identified nearly double the number of China-linked groups targeting law firms since 2023, though the overall volume of attacks has remained steady.
The group TITAN PANDA exploited a hardcoded key in Intapp Time Server, a timekeeping and billing software used by law firms, in April 2026. This marks the first reported attack on software specific to the legal sector, according to CrowdStrike. Another group, WARP PANDA, exploited a vulnerability in VMware ESXi (CVE-2026-41709) before a fix was available.
MURKY PANDA, another China-linked group, attempted nearly 500 failed logins across as many accounts at a single US law firm over 30 days, using around 300 IP addresses.
Mitigation recommendations
CrowdStrike and the FBI advise law firms to strengthen multi-factor authentication (MFA), review default and hardcoded settings, and monitor accounts for new MFA devices. They also recommend tightly controlling remote access tools and verifying the identities of all visitors onsite.
In September 2026, CrowdStrike assisted the FBI in dismantling the Sality botnet, a network linked to widespread cyber threats.
Links to AI-driven cyber threats
This surge in cyberattacks on law firms coincides with broader concerns about AI-powered cyber threats, as highlighted by a recent breach of Anthropic’s systems by cybersecurity startup Cathedral. The incident, which exploited vulnerabilities in third-party business software, underscores the risks of external dependencies in an era of AI-driven cyber operations.
Anthropic, a key player in AI and cybersecurity, has been expanding its ecosystem, including integrations with financial and HR platforms like Invesco and Dayforce. These integrations, while enhancing functionality, also introduce new attack surfaces for threat actors targeting sensitive data.
What this means
Lazyfounder analysis — our interpretation, not reported fact.
The surge in attacks on law firms highlights a shift in cybercriminal priorities toward industries handling sensitive and valuable data. For founders and operators in legal, cybersecurity, and adjacent sectors, this trend signals an urgent need to reassess security protocols, particularly around physical access, remote tools, and third-party software. The exploitation of legal sector-specific software like Intapp Time Server also suggests that niche industries are increasingly in the crosshairs of both profit-driven and state-backed actors.
For cybersecurity startups, this report underscores an opportunity to develop targeted solutions for high-risk sectors, while law firms may need to prioritize security audits and employee training to mitigate risks from both digital and physical threats.
Related on Lazyfounder
Sources
- The Next Web · 2026-10-28
Hackers hired a man to walk into a US law firm, CrowdStrike says
This story is an original summary drafted with AI by Lazyfounder from the reporting listed above and checked by automated validation. Facts are attributed to their original publishers; sections marked as analysis are Lazyfounder's. Where a source is in another language, facts were machine-translated and quotations are reported, not reproduced. Read the original coverage via the links, and see our AI policy and corrections policy.
About the author
Editor, Lazyfounder
Tarun Mottlia edits LazyFounders, covering Indian startups, funding rounds, AI and product launches. Every story on the site is AI-assisted and checked against its cited sources before publication.
More stories by Tarun MottliaGet the LazyFounder Brief
Startup, funding and AI news in a five-minute read. Join the early-access list.
