CrowdStrike称，“话痨蜘蛛”（CHATTY SPIDER）是美国律师事务所面临的主要威胁。2026年前八个月，该网络犯罪组织的活动量较2024年全年增长了129%。根据CrowdStrike周三发布的关于法律行业的新报告，律师事务所占其受害者的近90%。
CrowdStrike calls CHATTY SPIDER the dominant threat to US law firms. The cybercrime group grew its activity 129% in the first eight months of 2026, compared with all of 2024. Law firms made up nearly 90% of its victims, according to CrowdStrike’s new report on the legal sector, published on Wednesday.
该报告涵盖2025年9月至2026年8月。报告称，2025年11月，该组织雇用了一名俄罗斯籍人员潜入一家美国律师事务所。他冒充内部IT员工，获得了现场工作站的访问权限。随后，他协助该组织安装远程访问工具，并试图将数据转移到云存储。次日他再次到访时被执法部门拘留。
The report covers September 2025 to August 2026. In November 2025, it says, the group hired a Russian national to enter a US law firm. He posed as an internal IT employee and got access to an onsite workstation. From there, he helped the group install remote access tools and tried to move data to cloud storage. Law enforcement detained him when he returned for a second visit the next day.
美国联邦调查局（FBI）在5月就同一手法发出警告。其关于“沉默勒索集团”（Silent Ransom Group）的公告将Chatty Spider列为该团伙的另一个名称。公告称，该组织自2023年春季以来一直针对美国律师事务所。FBI写道，当远程访问失败时，该组织会派人前往受害者所在地，将存储设备插入电脑。CrowdStrike还援引CNN的报道称，该组织在2026年利用美国境内人员实施了多起物理入侵。
The FBI warned about the same tactic in May. Its advisory on Silent Ransom Group lists Chatty Spider as another name for the gang. It says the group has targeted US law firms since spring 2023. When remote access fails, the FBI wrote, the group sends a person to the victim’s location to plug a storage device into a computer. CrowdStrike also cites CNN’s reporting that the group used US-based individuals for several physical intrusions in 2026.
“律师事务所已成为网络犯罪分子的新提款机。对手正在利用特权客户信息的价值，而且他们愿意超越键盘来获取这些信息，”CrowdStrike对抗对手行动负责人亚当·迈耶斯在一份声明中表示。
“Law firms are the new ATM for cybercriminals. Adversaries are exploiting the value of privileged client information, and they’re willing to go beyond the keyboard to get it,” Adam Meyers, head of counter adversary operations at CrowdStrike, said in a statement.
CrowdStrike的数据来自其自身的遥测和情报团队。FBI的公告涵盖了物理到访的情况，但TNW尚未独立核实报告中的其他案例。
CrowdStrike’s figures come from its own telemetry and intelligence teams. The FBI advisory covers the physical visits, but TNW has not independently verified the other cases in the report.
攻击如何运作 在整个期间，该组织的来电者冒充IT人员。他们说服律师或其助理在Quick Assist、AnyDesk以及最近的Zoom和Cisco Webex等工具中开启远程支持会话。在2025年的一起入侵中，该组织在进入四分钟后便试图窃取数据。如果谈判失败，它威胁在其网站上泄露窃取的数据。
How the attacks work Throughout the period, the group’s callers posed as IT staff. They talked attorneys or their assistants into opening remote support sessions in tools including Quick Assist, AnyDesk and, more recently, Zoom and Cisco Webex. In one 2025 intrusion, the group tried to take data four minutes after getting in. It threatens to leak stolen data on its site if negotiations fail.
其他团伙也会对律师事务所发动攻击。在此期间，勒索软件和敲诈勒索团伙在其泄露网站上点名了455家法律实体。这比一年前的327家增加了39%。两个较新的团伙SNARKY SPIDER和CORDIAL SPIDER相隔一个月针对同一家律师事务所。两者都使用电话和伪造的单点登录页面。总体而言，CrowdStrike表示，在其观察到的针对该行业的恶意活动中，以牟利为目的的犯罪分子占82%。
Other gangs also carry out attacks on law firms. Ransomware and extortion groups named 455 legal entities on their leak sites during the period. That is up 39% from 327 a year earlier. Two newer groups, SNARKY SPIDER and CORDIAL SPIDER, targeted the same law firm a month apart. Both use calls and fake single sign-on pages. Overall, CrowdStrike says profit-driven criminals made up 82% of the malicious activity it saw against the sector.
与中国有关联的团伙和计费软件 国家支持的黑客约占18%，其中大部分活动来自与中国有关联的团伙。2026年4月，一个被CrowdStrike称为TITAN PANDA的团伙利用了Intapp Time Server中的硬编码密钥。其几乎所有用户都是律师事务所，它们使用该软件进行工时记录和计费。CrowdStrike表示，这是其首次看到针对法律行业专用软件的攻击。本月早些时候，CrowdStrike还将韩国银行的入侵事件与一名中国嫌疑人联系起来。
China-linked groups and billing software State-backed hackers made up about 18%, and most of that activity came from groups linked to China. In April 2026, a group CrowdStrike calls TITAN PANDA exploited a hardcoded key in Intapp Time Server. Almost all of its users are law firms, which use it for timekeeping and billing. CrowdStrike says it is the first attack it has seen on software specific to the legal sector. Earlier this month, CrowdStrike also linked South Korean bank breaches to a suspect in China.
另一个团伙WARP PANDA在修复程序发布之前利用了VMware ESXi的一个漏洞CVE-2026-41709。第三个团伙MURKY PANDA对一家美国律师事务所的将近500个账户进行了近500次失败尝试。这些尝试在30天内来自约300个IP地址。根据该报告，多年来，与中国有关联的针对该行业的活动数量一直相当稳定。自2023年以来，涉及的团伙数量几乎翻了一番。
Another group, WARP PANDA, exploited a VMware ESXi flaw, CVE-2026-41709, before a fix existed. A third, MURKY PANDA, made nearly 500 failed attempts on as many accounts at one US law firm. The attempts came from about 300 IP addresses over 30 days. According to the report, the volume of China-linked activity against the sector has stayed fairly steady over the years. The number of groups involved has nearly doubled since 2023.
建议 报告建议律师事务所加强多因素认证（MFA），并严格控制远程访问工具。报告还建议它们审查默认设置和硬编码设置，并留意账户上出现的新MFA设备。CrowdStrike销售此类威胁情报和威胁狩猎服务。9月，它协助美国联邦调查局（FBI）拆除了Sality僵尸网络，并与Anthropic合作保护电力和供水设施。FBI建议公司核实访客身份并保留其身份证件的副本。
The advice The report tells law firms to strengthen MFA and tightly control remote access tools. It also tells them to review default and hardcoded settings and to watch for new MFA devices on accounts. CrowdStrike sells threat intelligence and hunting services of this kind. In September, it helped the FBI dismantle the Sality botnet, and it works with Anthropic to defend power and water. The FBI tells companies to verify visitors and keep copies of their ID cards.