Australia among top targets in cyber attacks on law firms

CrowdStrike has published research showing Australian law firms are among the world's most targeted by cyber adversaries. The findings place Australia alongside several other countries identified as frequent legal-sector targets.

Its 2026 Legal Threat Landscape Report found the most targeted countries for malicious activity against law firms were Australia, Canada, Germany, Israel, Mexico, Singapore, the UK and the US. Australian law firms also ranked among the most targeted in Initial Access Broker advertisements, behind only the US and Brazil.

Initial Access Brokers, or IABs, sell access to compromised organisations to other criminal groups. In legal-sector cases tracked during the reporting period, asking prices ranged from USD $30 to USD $6,000, with an average of USD $1,573.89 and a median of USD $1,000.

Financially motivated adversaries accounted for 82% of observed malicious activity against the legal sector, according to the report. It also found 455 legal entities were named on data leak sites by Big Game Hunting adversaries, a 39% year-on-year increase.

Law firms have become recurring targets because they hold privileged client communications, intellectual property and information linked to corporate transactions. That makes them a pathway to sensitive commercial and government information held on behalf of clients.

Rising pressure

The research points to a shift in how attackers approach the sector. Some groups are moving beyond online deception and credential theft to tactics that also involve physical intrusion, while others are shortening the time between gaining access and attempting data theft.

One of the most active groups identified in the report was CHATTY SPIDER, which increased its malicious activity against legal entities by 129%, according to CrowdStrike. In one case cited in the research, an individual was recruited to impersonate IT staff and enter law firms in person to establish remote access. In another, the group attempted to exfiltrate sensitive data four minutes after gaining initial access.

The report also described increased identity-based attacks on law firms. It said SNARKY SPIDER and CORDIAL SPIDER targeted trusted access to software-as-a-service applications for data theft and extortion, and that both groups targeted the same law firm one month apart.

Espionage activity

Alongside criminal extortion, the report identified a rise in state-linked activity affecting the legal sector. It said the diversity of China-nexus adversaries targeting law firms doubled during the period covered by the research.

According to the findings, TITAN PANDA carried out what CrowdStrike described as the first observed exploitation of legal-sector-specific billing software. WARP PANDA used an ESXi zero-day for covert access, while MURKY PANDA conducted large-scale password spraying against nearly 500 accounts at a single US law firm from 300 IP addresses over 30 days.

The combination of financially motivated crime and espionage presents a broad threat profile for legal practices, especially those advising corporate clients, government agencies and high-value transactions. The report suggests legal entities are being targeted not only for direct extortion, but also for the intelligence contained in their systems and communications.

Australia's appearance in both the general targeting data and the market for brokered access underlines the attention the country's legal sector is drawing from attackers. The report did not break down how many Australian firms were affected, but its position near the top of both measures points to sustained interest from cybercriminal groups.

That interest is tied to the role law firms play in mergers, disputes, regulatory matters and intellectual property work. Attackers can use stolen information for extortion, insider intelligence, fraud or onward targeting of clients whose data passes through legal advisers.

Adam Meyers, Head of Counter Adversary Operations at CrowdStrike, described what the company sees as a shift in attacker behaviour. "Law firms are the new ATM for cybercriminals. Adversaries are exploiting the value of privileged client information, and they're willing to go beyond the keyboard to get it," he said.

He added: "We're seeing criminals recruit individuals to physically infiltrate law firms, blurring the line between digital and physical attacks. Defenders need visibility across identities, endpoints, and cloud environments to detect and disrupt these operations before access turns into extortion."