Australian law firms were among the world’s most targeted by cyber adversaries over the past year, with cyber criminals increasingly exploiting confidential client information and selling access to legal networks.
CrowdStrike’s 2026 Legal Threat Landscape Report found Australia was among eight countries most targeted by malicious activity impacting the legal sector between 1 September 2025 and 31 August 2026.
The others were Canada, Germany, Israel, Mexico, Singapore, the UK, and the US.
Australian firms also ranked third globally for advertisements posted by initial access brokers, behind only the US and Brazil. These brokers sell network access to compromised organisations and are a vital part of the criminal ecosystem.
During the reporting period, advertised access to legal entities ranged in price from US$30 to US$6,000, with an average asking price of US$1,573.89 and a median of US$1,000.
The findings come as financially motivated adversaries account for 82 per cent of observed malicious activity against the legal sector globally. CrowdStrike also identified a 129 per cent increase in malicious activity attributed to the Silent Ransom Group – which the company tracks as Chatty Spider – targeting legal entities.
In one incident, the group recruited an individual to impersonate IT staff and physically infiltrate law firms to establish remote access. In another, it attempted to exfiltrate sensitive data just four minutes after gaining initial access.
“Law firms are the new ATM for cyber criminals. Adversaries are exploiting the value of privileged client information, and they’re willing to go beyond the keyboard to get it,” Adam Meyers, head of counter adversary operations at CrowdStrike, said in a statement.
“We’re seeing criminals recruit individuals to physically infiltrate law firms, blurring the line between digital and physical attacks. Defenders need visibility across identities, endpoints, and cloud environments to detect and disrupt these operations before access turns into extortion.”
The report found attackers named 455 legal entities on data leak sites, a 39 per cent year-on-year increase, as criminal groups sought to exploit the confidentiality of legal data to pressure victims and increase the likelihood of them paying a ransom.
Identity-based attacks are also emerging as a significant risk. Two groups, Snarky Spider and Cordial Spider, targeted law firms through trusted access to software-as-a-service applications, with both groups targeting the same firm within a month of each other.
CrowdStrike also reported that the diversity of China-linked adversaries targeting the legal sector doubled over the period. Tactics included exploiting specialised legal billing software, abusing an ESXi zero-day vulnerability, and conducting sustained password-spraying campaigns.
In one case, a Chinese threat actor targeted nearly 500 accounts at a single US law firm using 300 IP addresses over 30 days.
According to CrowdStrike, law firms’ privileged access to client communications, intellectual property, and corporate transactions makes them valuable gateways to sensitive commercial and government information.
A successful breach can therefore expose not only a legal practice but also the organisations relying on it.
You can read the full report here.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
