CrowdStrike‘s 2026 Legal Threat Landscape Report has named Singapore among the top targeted countries for cyberattacks against the legal sector, as extortion and espionage campaigns against law firms intensify worldwide.
Key Takeaways
- Singapore is named among the top targeted countries for legal-sector cyberattacks, with six Southeast Asian legal entities named on data leak sites.
- CHATTY SPIDER was the dominant threat to legal entities, with malicious activity up 129 per cent; extortion groups named 455 legal entities globally on data leak sites, up 39 per cent year-on-year.
- China-nexus group MURKY PANDA targeted nearly 500 accounts at a single US law firm from 300 IP addresses over 30 days.
Extortion against law firms keeps rising
CHATTY SPIDER represented the dominant threat to legal entities in the report, with its malicious activity growing 129 per cent. In one intrusion, the group recruited someone to impersonate IT staff and physically enter a law firm to set up remote access; in another, it attempted to exfiltrate sensitive data just four minutes after gaining initial access.
Big Game Hunting adversaries, financially motivated groups that dominate observed activity against the legal sector, named 455 legal entities on data leak sites, a 39 per cent year-on-year increase. CrowdStrike said the sector’s extortion appeal comes down to the highly confidential nature of client information, which raises the pressure to pay. In Southeast Asia specifically, six legal entities were named on data leak sites.
Identity-based attacks converge on the same targets
SNARKY SPIDER and CORDIAL SPIDER both targeted law firms through identity-based attacks, exploiting trusted access to SaaS applications for data theft and extortion. Notably, both adversaries targeted the same law firm just one month apart, a convergence CrowdStrike flags as a sign of how concentrated criminal interest in high-value legal targets has become.
China-nexus espionage deepens
China-nexus adversary diversity against the legal sector doubled over the period covered by the report. TITAN PANDA carried out the first observed exploitation of legal-sector-specific billing software, while WARP PANDA used an ESXi zero-day for covert access. MURKY PANDA ran a large-scale password-spraying campaign, targeting nearly 500 accounts at a single US law firm from 300 IP addresses over 30 days — a scale CrowdStrike points to as evidence of how persistent China-nexus operations against the sector have become.
CrowdStrike’s full report and an accompanying blog post set out the complete findings. For Singapore-based law firms and the enterprises that rely on them, the report’s headline point is less about any single technique than about the sector’s standing target profile: confidential, high-value, and increasingly contested by both financially motivated and state-linked actors.
