CrowdStrike report finds financially motivated hackers account for 82% of legal-sector threat activity
CRWD•CrowdStrike’s 2026 Legal Threat Landscape Report found financially motivated adversaries accounted for 82% of observed malicious activity against legal entities. Extortion groups named 455 legal entities on data leak sites, up 39% year over year.
1. Legal-sector threats
CrowdStrike’s report found financially motivated adversaries accounted for 82% of observed malicious activity against legal entities. Extortion groups named 455 legal entities on data leak sites, a 39% year-over-year increase.
2. Threat activity details
CHATTY SPIDER activity rose 129%, and one attempted data theft began four minutes after initial access. SNARKY SPIDER and CORDIAL SPIDER used trusted SaaS access for data theft and extortion, targeting the same law firm one month apart. China-linked adversary diversity doubled in the legal sector, and TITAN PANDA conducted the first observed exploitation of legal-sector-specific billing software.
