--- title: Hackers hired a man to walk into a US law firm,... description: A cybercrime group called CHATTY SPIDER hired a Russian national to pose as IT staff and physically enter a US law firm, CrowdStrike reports. He gained access... canonical: https://daily.dev/posts/hackers-hired-a-man-to-walk-into-a-us-law-firm-crowdstrike-says-bf9wecnkq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers hired a man to walk into a US law firm, CrowdStrike says | daily.dev og:description: A cybercrime group called CHATTY SPIDER hired a Russian national to pose as IT staff and physically enter a US law firm, CrowdStrike reports. He gained access... og:url: https://daily.dev/posts/hackers-hired-a-man-to-walk-into-a-us-law-firm-crowdstrike-says-bf9wecnkq og:image: https://api.daily.dev/og/posts/bF9WecNKQ.png og:image:alt: Hackers hired a man to walk into a US law firm, CrowdStrike says og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers hired a man to walk into a US law firm, CrowdStrike says **[The Next Web](https://daily.dev/sources/tnw)** · 4 min read · 0 upvotes · 0 comments ## Summary A cybercrime group called CHATTY SPIDER hired a Russian national to pose as IT staff and physically enter a US law firm, CrowdStrike reports. He gained access to an onsite workstation, helped install remote access tools, and tried to move data to cloud storage before law enforcement detained him on a return visit. The group grew its activity 129% in the first eight months of 2026 versus all of 2024, and law firms made up nearly 90% of its victims. Other gangs are active too: ransomware and extortion groups named 455 legal entities on leak sites, up 39% year over year. China-linked group TITAN PANDA exploited a hardcoded key in Intapp Time Server, software CrowdStrike says is the first legal-sector-specific tool it has seen attacked. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the CHATTY SPIDER hacker group gain physical access to a US law firm? The group hired a Russian national who posed as an internal IT employee to gain access to an onsite workstation at a US law firm in November 2025. From there he helped install remote access tools and attempted to move data to cloud storage. Law enforcement detained him when he returned to the firm for a second visit the next day. _Security teams tracking physical social-engineering tactics like this follow incident reports on daily.dev._ ### Why are law firms being targeted so heavily by cybercriminals right now? CrowdStrike calls law firms 'the new ATM for cybercriminals' because of the privileged client information they hold. The group CHATTY SPIDER grew its activity 129% in the first eight months of 2026 compared with all of 2024, and law firms made up nearly 90% of its victims. Profit-driven criminals accounted for 82% of malicious activity seen against the legal sector. _Anyone assessing risk to client-data-heavy firms can track threat reports like this on daily.dev._ ### What vulnerability did China-linked hackers exploit in Intapp Time Server? A China-linked group CrowdStrike calls TITAN PANDA exploited a hardcoded key in Intapp Time Server in April 2026. Almost all users of that software are law firms, which rely on it for timekeeping and billing. CrowdStrike describes it as the first attack it has observed on software built specifically for the legal sector. _Teams patching legal-sector software for hardcoded credential flaws can follow coverage like this on daily.dev._ ## Similar posts on daily.dev - [Ongoing Targeted Campaign Against US Law Firms](https://daily.dev/posts/ongoing-targeted-campaign-against-us-law-firms-r3ufz8uzn) · Google Cloud · 0 upvotes · 0 comments - [Silent Ransom Group targets law firms with fake IT support calls](https://daily.dev/posts/silent-ransom-group-targets-law-firms-with-fake-it-support-calls-wtstzyoxe) · BleepingComputer · 0 upvotes · 0 comments - [Russians posing as Signal support to launch phishing raids](https://daily.dev/posts/russians-posing-as-signal-support-to-launch-phishing-raids-numtsppyp) · The Register · 0 upvotes · 0 comments - [China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services](https://daily.dev/posts/china-linked-apt31-launches-stealthy-cyberattacks-on-russian-it-using-cloud-services-wjwetdt1t) · The Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/hackers-hired-a-man-to-walk-into-a-us-law-firm-crowdstrike-says-bf9wecnkq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers hired a man to walk into a US law firm, CrowdStrike says","url":"https://daily.dev/posts/hackers-hired-a-man-to-walk-into-a-us-law-firm-crowdstrike-says-bf9wecnkq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-hired-a-man-to-walk-into-a-us-law-firm-crowdstrike-says-bf9wecnkq"},"datePublished":"2026-10-28T13:24:57.485Z","dateModified":"2026-10-28T15:00:43.103Z","description":"A cybercrime group called CHATTY SPIDER hired a Russian national to pose as IT staff and physically enter a US law firm, CrowdStrike reports. He gained access...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4791573f75b8fc62e9f78c6294d80f20?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4791573f75b8fc62e9f78c6294d80f20?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackers-hired-a-man-to-walk-into-a-us-law-firm-crowdstrike-says-bf9wecnkq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,ransomware","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"Hackers hired a man to walk into a US law firm, CrowdStrike says"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hackers-hired-a-man-to-walk-into-a-us-law-firm-crowdstrike-says-bf9wecnkq#faq","mainEntity":[{"@type":"Question","name":"How did the CHATTY SPIDER hacker group gain physical access to a US law firm?","acceptedAnswer":{"@type":"Answer","text":"The group hired a Russian national who posed as an internal IT employee to gain access to an onsite workstation at a US law firm in November 2025. From there he helped install remote access tools and attempted to move data to cloud storage. Law enforcement detained him when he returned to the firm for a second visit the next day. Security teams tracking physical social-engineering tactics like this follow incident reports on daily.dev."}},{"@type":"Question","name":"Why are law firms being targeted so heavily by cybercriminals right now?","acceptedAnswer":{"@type":"Answer","text":"CrowdStrike calls law firms 'the new ATM for cybercriminals' because of the privileged client information they hold. The group CHATTY SPIDER grew its activity 129% in the first eight months of 2026 compared with all of 2024, and law firms made up nearly 90% of its victims. Profit-driven criminals accounted for 82% of malicious activity seen against the legal sector. Anyone assessing risk to client-data-heavy firms can track threat reports like this on daily.dev."}},{"@type":"Question","name":"What vulnerability did China-linked hackers exploit in Intapp Time Server?","acceptedAnswer":{"@type":"Answer","text":"A China-linked group CrowdStrike calls TITAN PANDA exploited a hardcoded key in Intapp Time Server in April 2026. Almost all users of that software are law firms, which rely on it for timekeeping and billing. CrowdStrike describes it as the first attack it has observed on software built specifically for the legal sector. Teams patching legal-sector software for hardcoded credential flaws can follow coverage like this on daily.dev."}}]} ```