Law Firm Cybersecurity in 2026: Fake IT Support Calls and Hidden Audit Logs

If someone called your front desk tomorrow, said they were from your IT company, and asked an associate to click a link so they could "fix a mailbox issue," what would happen? At a lot of small law firms, the honest answer is that the associate would click.

That is the main finding in the CrowdStrike 2026 Legal Threat Landscape Report, published October 28. The groups hitting law firms hardest are not breaking in with exotic code. They call staff, pretend to be IT, and get invited in. On the same day, CISA added a VMware flaw to its list of exploited vulnerabilities after CrowdStrike reported that a China-linked group used it to keep its commands out of the logs at U.S. organizations that included targets in the legal sector.

This post covers what the report found, why it matters for your duty to protect client information under ABA Model Rule 1.6(c), what to check this week, and what to ask your IT provider in writing.

Executive takeaway

• What happened: CrowdStrike says cyber intrusions against the legal sector nearly doubled between 2023 and 2026, and 82% of the activity came from financially motivated criminals. Ransomware and extortion groups named 455 legal organizations on their leak sites, up 39% from the year before. (CrowdStrike)
• The main tactic: The busiest group, which CrowdStrike calls CHATTY SPIDER, impersonates IT staff to set up remote access, then steals data within minutes. Law firms were nearly 90% of its victims.
• The log problem: A China-linked group called WARP PANDA used a VMware ESXi flaw, CVE-2026-41709, as a zero-day so some of its admin commands were never logged. CISA added it to the Known Exploited Vulnerabilities catalog on October 28. (CISA)
• The Defensible IT test: If a client asked you tomorrow what was accessed during an incident, could your IT provider hand you logs that an attacker could not have edited?

What did the CrowdStrike 2026 Legal Threat Landscape Report find?

The report covers activity from September 1, 2025 through August 31, 2026. Three findings matter most for a small or midsize firm.

Criminals, not spies, are most of the problem. Financially motivated groups made up 82% of observed activity. They make money by encrypting files, stealing them and threatening to publish, or both. The 455 legal organizations named on leak sites in the reporting period were a 39% jump over the prior year.

One group focuses almost entirely on U.S. law firms. CHATTY SPIDER's activity in the first eight months of 2026 was up 129% compared with all of 2024, and law firms made up nearly 90% of its victims. CrowdStrike says it "almost exclusively targeted U.S.-based law firms" and expects that to continue.

Password guessing at scale is still working. In a password-spraying campaign by a group CrowdStrike calls MURKY PANDA (just outside the report's window), one law firm saw nearly 500 failed logins against as many accounts, from about 300 different IP addresses, in 30 days.

How are attackers getting into law firms?

Mostly by pretending to be IT. CrowdStrike describes CHATTY SPIDER calling staff while posing as IT personnel, setting up a remote access session, and pulling data out within minutes, increasingly with ordinary business tools that security software trusts. Two newer groups, SNARKY SPIDER and CORDIAL SPIDER, use the same playbook: a phone call from "IT," followed by a fake single sign-on page. Both hit the same law firm one month apart.

In one case from November 2025, CHATTY SPIDER hired a person to walk into a U.S. law firm, introduce himself as an internal IT employee, and sit down at a workstation. From there he helped the group install remote monitoring and management (RMM) tools and tried to copy data to cloud storage. He was detained on a second visit. CrowdStrike notes public reporting of several similar in-person intrusions during 2026.

The report also found the first observed targeting of legal-specific software: in April 2026, a group CrowdStrike calls TITAN PANDA exploited a flaw in Intapp Time Server, the timekeeping and billing tool used almost exclusively by law firms.

What is CVE-2026-41709, and why does a low score matter?

CVE-2026-41709 is a flaw in VMware ESXi, the software many firms and their providers use to run virtual servers. Someone who already has administrator access can perform certain operations without them being recorded in the logs. Its severity score is only 2.7 out of 10, which is why it is easy to skip. (The Hacker News)

That low score misses the point. WARP PANDA used it as a zero-day, as late as early 2026, to reduce the audit trail in VMware environments at U.S. organizations, including some in the legal sector. CrowdStrike also says the group harvests cloud session tokens to get into Microsoft 365 without triggering password alerts, and in at least one case registered its own MFA device on a compromised account so its access survived a password change. Broadcom released fixes in July 2026, and CISA set a November 11 deadline for federal agencies.

If your firm has no on-premises servers, this specific flaw may not apply to you. Your IT provider should be able to tell you in one sentence whether it does. The broader lesson applies to everyone: logs that live on the system an attacker controls are not evidence you can rely on.

Why is this an ethics and compliance problem for law firms?

ABA Model Rule 1.6(c) requires lawyers to "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." Most states have adopted a version of it. The rule does not demand perfect security, but it does expect the steps you take to match the risks you know about. After this report, impersonation of IT staff is a known risk for law firms.

ABA Formal Opinion 483 goes further after a breach. It expects lawyers to monitor for intrusions, act to stop them, figure out what happened, and tell current clients when their material information was accessed or is reasonably suspected to have been. (ABA Formal Opinion 483)

"Figure out what happened" is where many firms get stuck. If the logs were never collected, expired after a few days, or sat on a server the attacker controlled, you cannot say with confidence what was taken. That uncertainty can turn a contained incident into a notice to every client.

Does this affect firms that also handle health or financial data?

Yes. Personal injury, workers' compensation, and medical malpractice firms often hold medical records from clients and providers, and firms that serve health care clients may sign business associate agreements under HIPAA. Firms handling financial records for clients may also face state data security laws and contractual requirements from corporate clients and insurers. The same evidence, which is who accessed what and when, answers all of those questions.

What will our cyber insurer ask?

Expect questions about MFA on email and remote access, how remote access tools are controlled, how long logs are kept, and how staff verify requests that arrive by phone. "Our IT company handles that" is not an answer most underwriters accept anymore. They want a description of the control and proof it is running.

What should a law firm check this week?

1. Write down how staff verify IT. Anyone who calls or walks in claiming to be IT gets a callback to a number you already have on file, or a code phrase your provider gives you. No exceptions for partners.
2. List every remote access tool on your computers. Ask your provider to confirm which RMM and remote support tools are approved, and to block and alert on anything else.
3. Find out where your logs live and how long they last. Microsoft 365 sign-in logs, firewall logs, and server logs should be sent to a separate system the attacker cannot reach and kept for at least a year.
4. Turn on alerts for new MFA devices. A new phone or authenticator added to a partner's account at 2 AM should wake someone up.
5. Ask whether VMware ESXi or vCenter runs anywhere for your firm. If it does, confirm it is on a fixed build and that admin access is restricted.
6. Check your practice software. Confirm timekeeping, billing, and document management systems are patched and are not reachable from the open internet unless they need to be.

What should we ask our IT provider in writing?

• How does our staff verify that a caller is really from your team, and when did you last test it?
• Which remote access tools are allowed on our devices, and what happens if someone installs a different one?
• Where are our Microsoft 365, firewall, and server logs stored, who can change them, and how long are they kept?
• Do you alert on new MFA device registrations and risky sign-ins 24 hours a day?
• Are we running VMware ESXi or vCenter, and is it on a fixed build?

If the answers come back vague, that tells you something.

Standard IT vs. Defensible IT: what is the difference when the attacker says they are IT?

Standard IT keeps the systems running and answers the phone. Defensible IT assumes someone will eventually call pretending to be the help desk, and makes sure that call fails and that the firm can prove what happened if it does not.

Standard IT says "we have MFA and antivirus." Defensible IT can show you who verified the last IT call, which remote tools are allowed, and a year of logs nobody could have edited.

Standard IT looks like this:

• Staff help anyone who sounds like IT.
• Any remote tool can be installed if a user clicks yes.
• Logs stay on the device that was attacked, with default retention.
• MFA turned on, and nothing watching for new MFA devices.
• Low-severity patches wait until there is time.

Defensible IT looks like this:

• A written caller verification process, tested with staff.
• Only approved remote tools can run, with alerts on everything else.
• Logs sent off the device and retained for a year, ready for counsel or an insurer.
• 24x7 managed detection and response that flags new MFA devices, stolen sessions, and unusual admin activity.
• Exploited flaws on CISA's list patched on a written deadline, with dated proof, as part of compliance-first managed IT services.

We wrote more about the gap between "working" and "defensible" in our post on whether your IT provider is leaving you exposed.

How does Emry Networks help law firms in Jacksonville FL, Manchester NH, and nationwide?

Emry Networks provides managed IT, cybersecurity, and IT compliance for law firms and other regulated industries across the United States, with hubs in the Jacksonville, FL area and the Manchester, NH area. Our work follows a 90-day onboarding blueprint:

• Phase 1 (Days 1-30): Scoping, baseline gap assessment, and software deployment. We inventory every user, device, remote access tool, and cloud app, find out where your logs go, and compare your written policies to what is actually running.
• Phase 2 (Days 31-60): Tool implementation and policy authoring. We put the controls in place, including caller verification, remote tool allowlisting, off-device log retention, and MFA device alerts, and we write the policies that match them.
• Phase 3 (Days 61-90): Verification and a second gap assessment. We test the controls, run the gap assessment again, and show you the before and after side by side.

Want to know whether a fake IT call would work at your firm? Book a 30-Minute Risk Assessment. We will review your remote access tools, your log retention, and your MFA setup, and tell you plainly what an insurer or ethics counsel would find.

Next Steps for Your Legal Organization

• Take the free Compliance Readiness Assessment to see where your firm stands on the controls insurers and clients ask about.
• Use the Breach Cost and Penalty Calculator to estimate what a reportable incident could cost your firm.
• Book a 30-Minute Risk Assessment with our team.

Frequently asked questions

What is the CrowdStrike 2026 Legal Threat Landscape Report?

It is CrowdStrike's review of attacks on law firms and other legal organizations from September 2025 through August 2026. It found intrusions nearly doubled between 2023 and 2026, and that 82% of activity came from financially motivated criminals.

How are hackers getting into law firms in 2026?

The most common method in the report is impersonating IT staff by phone, then getting an employee to allow remote access or enter credentials on a fake sign-in page. In at least one case, a person posed as an IT employee in person.

What is CVE-2026-41709?

It is a VMware ESXi flaw that lets someone with administrator access perform certain operations without them being logged. CrowdStrike says the China-linked group WARP PANDA used it as a zero-day, and CISA added it to its exploited vulnerabilities catalog on October 28, 2026.

Does ABA Model Rule 1.6(c) require specific security tools?

No. It requires reasonable efforts to prevent unauthorized access to client information. What counts as reasonable depends on the risks you know about, and impersonation of IT staff is now a documented risk for law firms.

How long should a law firm keep security logs?

There is no single rule. We recommend keeping at least 12 months; many cyber insurers ask about log retention. The logs should be stored somewhere separate from the systems they describe so an attacker cannot change them.