---
title: CrowdStrike: intrusions at law firms nearly doubled since 2023; Warp Panda used the VMware ESX logging bypass CISA just added to KEV as a zero-day, and Titan Panda went after law-firm billing software | ctxsec
url: https://ctxsec.com/items/crowdstrike-legal-threat-landscape-2026-warp-panda-esx-zero-day
description: ""
status: "vendor threat report (CrowdStrike, Oct 28; covers Sep 2025 to Aug 2026)"
published: 2026-10-29
---

> 

[← Industry News](/industry) · [markdown](/items/crowdstrike-legal-threat-landscape-2026-warp-panda-esx-zero-day.md)

vendor threat report (CrowdStrike, Oct 28; covers Sep 2025 to Aug 2026)

2026-10-29

### CrowdStrike: intrusions at law firms nearly doubled since 2023; Warp Panda used the VMware ESX logging bypass CISA just added to KEV as a zero-day, and Titan Panda went after law-firm billing software

CrowdStrike's report covers Sep 1, 2025 to Aug 31, 2026. Financially motivated groups made up 82% of activity against the legal sector, and 455 legal entities were named on leak sites, up 39% year over year.

- **Chatty Spider:** activity up 129% in the first eight months of 2026 versus all of 2024, with law firms nearly 90% of its victims. It impersonates IT staff to get remote sessions and in Nov 2025 hired a Russian national to walk into a US law firm posing as an IT employee. Snarky Spider and Cordial Spider use near-identical help-desk vishing and SSO-themed phishing.
- **Warp Panda:** deployed malware in vCenter environments and, as late as early 2026, exploited ESXi command-logging bypass CVE-2026-41709 as a zero-day. CISA added it to KEV on Oct 28 (due Nov 11).
- **Titan Panda:** in Apr 2026 exploited a hardcoded IIS machine key in Intapp Time Server, the first observed targeting of legal-specific software. **Murky Panda's** ORB28 password spraying hit 340+ mostly US entities, legal the most.

**Take:** the vishing pattern matches this week's Canadian Cyber Centre alert. Law firms should lock down help-desk resets, patch ESX to the builds in Broadcom's advisory, and check Intapp Time Server exposure.

Sources: [CrowdStrike: 2026 Legal Threat Landscape Report, eCrime leads attacks, China activity intensifies (Oct 28)](https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/) · [CISA: Adds Two Known Exploited Vulnerabilities to Catalog (Oct 28)](https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog)