IT Impersonation Attacks: A Growing Cybersecurity Threat to Law Firms

Picture a call to an assistant or an associate. The person on the line says they’re from the firm’s IT provider, there’s a problem with the account or a suspicious email, and they need to connect to the computer to fix it. At a firm that relies on outside IT, a call like that sounds routine. If the employee agrees, the caller can gain remote access to that computer.

Both CrowdStrike and the FBI have flagged this pattern as a leading threat to U.S. law firms this year. It also sits inside a broader problem. Last week Baker McKenzie and Troutman Pepper Locke, two of the largest firms in the country, filed breach notices with California’s Attorney General that both describe staff being deceived through social engineering. Neither notice says the deception came through a fake IT call, but together they show how far a convincing request can get, even at firms with large security teams. A 10 or 30 person firm in Greater Sacramento needs a plan for the same kind of approach.

What These Attacks Look Like

CrowdStrike’s 2026 Legal Threat Landscape Report, released October 28, names a group it calls CHATTY SPIDER as the dominant threat to U.S. law firms. The FBI tracks the same group as the Silent Ransom Group. According to CrowdStrike, its activity grew 129% in the first eight months of 2026 compared with all of 2024, and law firms made up nearly 90% of its victims.

The group’s main tool is the phone. Callers pose as IT staff, sometimes following up on a phishing email that told the target to call “support,” and talk attorneys or assistants into opening a remote support session through tools such as Quick Assist, AnyDesk, and more recently Zoom and Webex. These are legitimate programs, which is why the FBI notes that antivirus is unlikely to flag the activity. In one intrusion, CrowdStrike says, the group tried to take data four minutes after getting in.

The same approach shows up in other channels. Microsoft Teams can also accept chats from people in other organizations, and Microsoft’s default setting allows that with any external domain unless an administrator limits it. That gives an impostor another way to appear as the help desk. And when remote access fails, the FBI warned in May, the group sends someone to the office claiming to be IT, to plug a storage device into a computer. CrowdStrike describes a November 2025 case in which the group hired a man to walk into a U.S. law firm posing as internal IT. He reached a workstation and was detained when he returned the next day.

Once data is out, the pressure starts. The FBI says the group threatens to publish what it took and calls the firm’s employees and clients to push for payment. Across all extortion groups, CrowdStrike counted 455 legal organizations named on leak sites during the report period, up 39% from the year before.

Why Social Engineering Works So Well on Law Firms

Law firms hold exactly what extortion groups want: privileged client communications, deal details, litigation strategy, and in many cases trust accounts. A threat to publish that material puts pressure on the firm and its clients at once.

The way law firms work also gives an impostor openings. Deadlines create pressure to fix a problem now, and a caller who says a filing or a client file is at risk is hard to put on hold. Confidentiality obligations make staff anxious about anything that sounds like a security issue, which a fake IT caller can use as the reason for the call. Assistants routinely work inside attorneys’ email and calendars, so a request to act on someone else’s account doesn’t seem unusual. And most small firms rely on an outside IT provider, so a call from “IT” is routine and hard to check in the moment.

How Small Law Firms Can Stop Social Engineering Attacks

A small firm can’t outspend this threat, but it can close the openings it depends on. The FBI’s own guidance covers much of the same ground: verify anyone claiming to be IT, restrict remote access tools, use MFA, and review how password resets are handled.

If Someone Already Said Yes

The most important thing a staff member can do after realizing a call wasn’t real is report it right away, without worrying about blame. Make sure everyone knows the first moves: end the remote session, disconnect the computer from the network, and call your IT provider on the number the firm already has. Don’t delete emails, chat messages, or call logs, since they may be needed later.

What happens next belongs to your IT provider and should follow a written incident response plan. Changing a password is rarely enough on its own; depending on what the attacker did, containment can involve ending active sign-in sessions, checking for new accounts or MFA devices, and reviewing other accounts the attacker may have reached.

A suspected incident usually starts with an investigation to establish what the attacker reached and whether personal information was taken. Whether that becomes a legally reportable breach depends on what information was involved, whose it was, and which laws apply. If it does, notice may be owed to affected people and to regulators, including California’s Attorney General in some cases involving residents here. For a law firm there is one more consideration: the professional duty to protect client confidences, which counsel can help weigh alongside any notification requirements.

This article is general guidance, not legal advice. Breach notification obligations vary by state and circumstance, so confirm yours with counsel.

These attacks target people, and the defenses are rules, settings, and habits a small firm can put in place quickly. As our look at Black October showed, attackers move fast once they have a way in. The goal is to make sure a convincing caller never gets one.