--- id: 10388 title: "CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies" cve: null cvss: null severity: "unknown" vendor: null product: null affected_versions: null source_domain: "crowdstrike.com" source_url: "https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/" published_at: "2026-10-28T00:00:00Z" snapshot_at: "2026-10-28T23:50:07Z" archived_by: "Phying News (https://phying.com/item/10388)" lang: en --- # CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies *Published on: 2026-10-28 · Source: [crowdstrike.com](https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/)* * * [ ](https://www.twitter.com/CrowdStrike) * * [ ](https://www.linkedin.com/company/crowdstrike) * [ ](https://www.youtube.com/user/CrowdStrike) * [ ](mailto:info@crowdstrike.com) [ ![Crowdstrike](https://assets.crowdstrike.com/is/content/crowdstrikeinc/RedLogoCS) ](https://www.crowdstrike.com/en-us/) [Blog](https://www.crowdstrike.com/en-us/blog/ "Blog") * [Featured](https://www.crowdstrike.com/en-us/blog/featured-articles/) * [ ![CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-LegalThreatReport-1?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies Oct 28, 2026 ](https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/) * [ ![When AI Guardrails Expose Vulnerabilities](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-DeepSeek?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) When AI Guardrails Expose Vulnerabilities Oct 28, 2026 ](https://www.crowdstrike.com/en-us/blog/when-ai-guardrails-expose-vulnerabilities/) * [ ![Why Organizations Secure AI Agents with Falcon Guardian](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-AIDR-Protection?wid=2048&hei=1349&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Why Organizations Secure AI Agents with Falcon Guardian Oct 23, 2026 ](https://www.crowdstrike.com/en-us/blog/why-organizations-secure-ai-agents-with-falcon-guardian/) * [ ![Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation ](https://assets.crowdstrike.com/is/image/crowdstrikeinc/CS_Blog-Update_02-1?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation Oct 23, 2026 ](https://www.crowdstrike.com/en-us/blog/obstacles-to-weaponizing-php2shell-likely-constrain-exploitation/) * [Recent](https://www.crowdstrike.com/en-us/blog/recent-articles/) * [ ![CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-LegalThreatReport-1?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies Oct 28, 2026 ](https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/) * [ ![When AI Guardrails Expose Vulnerabilities](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-DeepSeek?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) When AI Guardrails Expose Vulnerabilities Oct 28, 2026 ](https://www.crowdstrike.com/en-us/blog/when-ai-guardrails-expose-vulnerabilities/) * [ ![Why Organizations Secure AI Agents with Falcon Guardian](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-AIDR-Protection?wid=2048&hei=1349&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Why Organizations Secure AI Agents with Falcon Guardian Oct 23, 2026 ](https://www.crowdstrike.com/en-us/blog/why-organizations-secure-ai-agents-with-falcon-guardian/) * [ ![Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation ](https://assets.crowdstrike.com/is/image/crowdstrikeinc/CS_Blog-Update_02-1?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation Oct 23, 2026 ](https://www.crowdstrike.com/en-us/blog/obstacles-to-weaponizing-php2shell-likely-constrain-exploitation/) * [Video](https://www.crowdstrike.com/en-us/blog/videos/) * [ ![Video Highlights the 4 Key Steps to Successful Incident Response](https://assets.crowdstrike.com/is/image/crowdstrikeinc/IR-Video-Blog-1?wid=530&hei=349&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019 ](https://www.crowdstrike.com/en-us/blog/video-highlights-the-4-key-steps-to-successful-incident-response/) * [ ![Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less \[VIDEO\]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/video-ATTCK2-1?wid=530&hei=349&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO] Feb 21, 2019 ](https://www.crowdstrike.com/en-us/blog/helping-non-security-stakeholders-understand-attck-in-10-minutes-or-less/) * [ ![Analyzing Targeted Intrusions Through the ATT&CK Framework Lens \[VIDEO\]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/video-ATTCK2-1?wid=530&hei=349&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Analyzing Targeted Intrusions Through the ATT&CK Framework Lens [VIDEO] Jan 22, 2019 ](https://www.crowdstrike.com/en-us/blog/analyzing-targeted-intrusions-through-the-attck-framework-lens-video/) * [ ![Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust \[VIDEO\]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Edward-Gonam-Qatar-Blog2-1?wid=530&hei=349&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust [VIDEO] Aug 20, 2018 ](https://www.crowdstrike.com/en-us/blog/qatars-commercial-bank-chooses-crowdstrike-falcon-a-partnership-based-on-trust/) * [Category](https://www.crowdstrike.com/en-us/blog/categories-overview/) * [ Agentic SOC ](https://www.crowdstrike.com/en-us/blog/category.ai-machine-learning/) ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/Agentic-SOC-Blog-icon.svg) Agentic SOC [ ![CrowdStrike Delivers the Next Evolution of the Agentic SOC](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-FalCon-AgenticSOC?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike Delivers the Next Evolution of the Agentic SOC ](https://www.crowdstrike.com/en-us/blog/crowdstrike-delivers-next-evolution-of-agentic-soc/) 09/02/26 [ ![Teaching AI to Reason Through Detection Triage](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-AI-Red-Team?wid=1061&hei=699&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Teaching AI to Reason Through Detection Triage ](https://www.crowdstrike.com/en-us/blog/teaching-ai-to-reason-through-detection-triage/) 08/17/26 [ ![How AI-leading Security Teams Are Building the Agentic SOC](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-SOC-AI?wid=1536&hei=1024&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) How AI-leading Security Teams Are Building the Agentic SOC ](https://www.crowdstrike.com/en-us/blog/how-ai-leading-security-teams-are-building-the-agentic-soc/) 07/06/26 [ ![New Claude Integration Brings Audit Data into the Falcon Platform](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-Integration?wid=1544&hei=1018&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) New Claude Integration Brings Audit Data into the Falcon Platform ](https://www.crowdstrike.com/en-us/blog/new-claude-integration-brings-audit-data-into-the-falcon-platform/) 05/21/26 * [ Cloud & Application Security ](https://www.crowdstrike.com/en-us/blog/category.cloud-security/) ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blog/Cloud-Application-Security.svg) Cloud & Application Security [ ![New in Falcon Cloud Security: Third-Party App Insights and AI-Enhanced Remediation](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-ForresterTEI-Cloud?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) New in Falcon Cloud Security: Third-Party App Insights and AI-Enhanced Remediation ](https://www.crowdstrike.com/en-us/blog/falcon-cloud-security-third-party-app-insights-ai-enhanced-remedation/) 10/05/26 [ ![CrowdStrike Named Strongest Overall Leader in 2026 Frost Radar™: Cloud Workload Protection Platforms](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-Frost-CWPP-2026?wid=1060&hei=689&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike Named Strongest Overall Leader in 2026 Frost Radar™: Cloud Workload Protection Platforms ](https://www.crowdstrike.com/en-us/blog/crowdstrike-named-strongest-overall-leader-2026-frost-radar-cwpp/) 08/20/26 [ ![Falcon Cloud Security July 2026 Release: Helping Security Teams Move Faster in the Cloud](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-FCS-July26?wid=2048&hei=1365&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Falcon Cloud Security July 2026 Release: Helping Security Teams Move Faster in the Cloud ](https://www.crowdstrike.com/en-us/blog/new-in-falcon-cloud-security-helping-security-teams-move-faster/) 07/29/26 [ ![Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-Cloud-Puzzle-Tech?wid=2048&hei=1349&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud ](https://www.crowdstrike.com/en-us/blog/new-in-falcon-cloud-security-expanding-multi-cloud-coverage/) 06/29/26 * [ Threat Hunting & Intel ](https://www.crowdstrike.com/en-us/blog/category.counter-adversary-operations/) ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blog/Counter-Adversary-Ops.svg) Threat Hunting & Intel [ ![CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-LegalThreatReport-1?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies ](https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/) 10/28/26 [ ![Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation ](https://assets.crowdstrike.com/is/image/crowdstrikeinc/CS_Blog-Update_02-1?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation ](https://www.crowdstrike.com/en-us/blog/obstacles-to-weaponizing-php2shell-likely-constrain-exploitation/) 10/23/26 [ ![CrowdStrike Uncovers New Agentic AI Campaigns](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-AgenticAI-Report?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike Uncovers New Agentic AI Campaigns ](https://www.crowdstrike.com/en-us/blog/crowdstrike-uncovers-new-agentic-ai-campaigns/) 10/21/26 [ ![U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-LABYRINTH-CHOLLIMA?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance ](https://www.crowdstrike.com/en-us/blog/fbi-disrupts-famous-chollima-operation-with-crowdstrike-assistance/) 10/13/26 * [ Endpoint Security & XDR ](https://www.crowdstrike.com/en-us/blog/category.endpoint-protection/) ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/Endpoint-Security-And-XDR.svg) Endpoint Security & XDR [ ![CrowdStrike Named a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises Vendor Assessment](https://assets.crowdstrike.com/is/image/crowdstrikeinc/IDC%20Endpoint%20MarketScape%202026%20Report_Blog_1060x689?wid=1060&hei=689&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike Named a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises Vendor Assessment ](https://www.crowdstrike.com/en-us/blog/crowdstrike-named-leader-2026-idc-marketscape-worldwide-modern-endpoint-security-for-enterprises/) 10/07/26 [ ![CrowdStrike Extends Endpoint Security to Stop Software Supply Chain Attacks](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-FalCon-SupplyChain?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike Extends Endpoint Security to Stop Software Supply Chain Attacks ](https://www.crowdstrike.com/en-us/blog/crowdstrike-extends-endpoint-security-to-stop-supply-chain-attacks/) 09/02/26 [ ![Browser Security: Zero-Days Are Only Part of the Problem ](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-Zero-Days?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Browser Security: Zero-Days Are Only Part of the Problem ](https://www.crowdstrike.com/en-us/blog/browser-security-zero-days-are-only-part-of-the-problem/) 06/30/26 [ ![New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Forever](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-ClickOnce-2?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) New Abuse of the ClickOnce Technology, Part 2: Stop Threat Actors from Clicking Once and Staying Forever ](https://www.crowdstrike.com/en-us/blog/new-abuse-of-the-clickonce-technology-part-two/) 06/18/26 * [ Engineering & Tech ](https://www.crowdstrike.com/en-us/blog/category.engineering-and-technology/) ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blog/Engineering-and-Tech.svg) Engineering & Tech [ ![EMBER2024: Advancing the Training of Cybersecurity ML Models Against Evasive Malware](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-EMBER2024?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) EMBER2024: Advancing the Training of Cybersecurity ML Models Against Evasive Malware ](https://www.crowdstrike.com/en-us/blog/ember-2024-advancing-cybersecurity-ml-training-on-evasive-malware/) 09/03/25 [ ![Falcon Platform Prevents COOKIE SPIDER’s SHAMOS Delivery on macOS](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-COOKIESPIDER?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Falcon Platform Prevents COOKIE SPIDER’s SHAMOS Delivery on macOS ](https://www.crowdstrike.com/en-us/blog/falcon-prevents-cookie-spider-shamos-delivery-macos/) 08/20/25 [ ![CrowdStrike’s Approach to Better Machine Learning Evaluation Using Strategic Data Splitting](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-DataSplitting-4?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike’s Approach to Better Machine Learning Evaluation Using Strategic Data Splitting ](https://www.crowdstrike.com/en-us/blog/machine-learning-evaluation-using-data-splitting/) 08/11/25 [ ![CrowdStrike Researchers Develop Custom XGBoost Objective to Improve ML Model Release Stability](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-XGBoost?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike Researchers Develop Custom XGBoost Objective to Improve ML Model Release Stability ](https://www.crowdstrike.com/en-us/blog/crowdstrike-researchers-develop-custom-xgboost-objective/) 03/20/25 * [ Executive Viewpoint ](https://www.crowdstrike.com/en-us/blog/category.executive-viewpoint/) ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blog/Exec-Viewpoint.svg) Executive Viewpoint [ ![Beyond the Model: Harnessing Frontier AI for Stronger Cyber Defense](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-DeepSeek?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Beyond the Model: Harnessing Frontier AI for Stronger Cyber Defense ](https://www.crowdstrike.com/en-us/blog/harnessing-frontier-ai-for-stronger-defense/) 07/20/26 [ ![Frontier AI Is Collapsing the Exploit Window. Here’s How Defenders Must Respond.](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-DeepSeek?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Frontier AI Is Collapsing the Exploit Window. Here’s How Defenders Must Respond. ](https://www.crowdstrike.com/en-us/blog/frontier-ai-collapses-exploit-window-how-defenders-must-respond/) 04/20/26 [ ![Frontier AI for Defenders: CrowdStrike and OpenAI TAC](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-Shield-AI?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Frontier AI for Defenders: CrowdStrike and OpenAI TAC ](https://www.crowdstrike.com/en-us/blog/frontier-ai-for-defenders-crowdstrike-and-openai-tac/) 04/16/26 [ ![Anthropic Claude Mythos Preview: The More Capable AI Becomes, the More Security It Needs](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-Architecture-of-Agentic-Defense?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Anthropic Claude Mythos Preview: The More Capable AI Becomes, the More Security It Needs ](https://www.crowdstrike.com/en-us/blog/crowdstrike-founding-member-anthropic-mythos-frontier-model-to-secure-ai/) 04/06/26 * [ From The Front Lines ](https://www.crowdstrike.com/en-us/blog/category.from-the-front-lines/) ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blog/Front-Lines.svg) From The Front Lines [ ![CrowdStrike Protects Customers from Threats Delivered via PHP2Shell](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-RR-SharePoint?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike Protects Customers from Threats Delivered via PHP2Shell ](https://www.crowdstrike.com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/) 10/21/26 [ ![CrowdStrike Achieves NCSC CIR Enhanced Level Assurance](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-CIR?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike Achieves NCSC CIR Enhanced Level Assurance ](https://www.crowdstrike.com/en-us/blog/crowdstrike-achieves-uk-ncsc-cir-enhanced-level-assurance/) 10/20/26 [ ![CrowdStrike Technical Risk Assessments Reveal Common Exposure Patterns ](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-Personalized-Threat-Intel%20\(1\)?wid=2048&hei=1350&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike Technical Risk Assessments Reveal Common Exposure Patterns ](https://www.crowdstrike.com/en-us/blog/crowdstrike-technical-risk-assessments-reveal-common-exposure-patterns/) 05/04/26 [ ![Introducing the CrowdStrike Shadow AI Visibility Service](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-ShadowAI?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Introducing the CrowdStrike Shadow AI Visibility Service ](https://www.crowdstrike.com/en-us/blog/crowdstrike-shadow-AI-visibility-service/) 04/21/26 * [ Next-Gen Identity Security ](https://www.crowdstrike.com/en-us/blog/category.identity-protection/) ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/Identity-Protection.svg) Next-Gen Identity Security [ ![Solving the Continuous Authorization Conundrum](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-Continuous-Identity?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Solving the Continuous Authorization Conundrum ](https://www.crowdstrike.com/en-us/blog/solving-the-continuous-authorization-conundrum/) 10/08/26 [ ![CrowdStrike Announces Agentic Identity Provider](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-FalCon-AgenticIdentity?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike Announces Agentic Identity Provider ](https://www.crowdstrike.com/en-us/blog/crowdstrike-announces-agentic-identity-provider/) 09/02/26 [ ![The Identity Problem Hiding in AI Agent Deployments ](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-Agentic-Identity?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) The Identity Problem Hiding in AI Agent Deployments ](https://www.crowdstrike.com/en-us/blog/the-identity-problem-hiding-in-ai-agent-deployments/) 06/24/26 [ ![CrowdStrike Announces Continuous Identity for AI Agents](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-Continuous-Identity?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike Announces Continuous Identity for AI Agents ](https://www.crowdstrike.com/en-us/blog/crowdstrike-announces-continuous-identity-for-ai-agents/) 06/15/26 * [ Next-Gen SIEM & Log Management ](https://www.crowdstrike.com/en-us/blog/category.observability-and-log-management/) ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blog/Next-Gen-SIEM-LOG-Management.svg) Next-Gen SIEM & Log Management [ ![CrowdStrike Threat Hunts for Shell Command Obfuscation on VMware ESX](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-EMBER2024?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike Threat Hunts for Shell Command Obfuscation on VMware ESX ](https://www.crowdstrike.com/en-us/blog/crowdstrike-hunts-for-shell-command-obfuscation-vmware-esx/) 08/07/26 [ ![Falcon Platform IOAs Arrive in Falcon Next-Gen SIEM to Identify New Threats](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-FalconPlatformIOA?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Falcon Platform IOAs Arrive in Falcon Next-Gen SIEM to Identify New Threats ](https://www.crowdstrike.com/en-us/blog/falcon-platform-ioas-arrive-in-falcon-next-gen-siem/) 07/29/26 [ ![5 High-Impact Use Cases for Falcon Onum](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-Onum-Lines?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) 5 High-Impact Use Cases for Falcon Onum ](https://www.crowdstrike.com/en-us/blog/five-high-impact-use-cases-for-falcon-onum/) 07/27/26 [ ![Falcon Next-Gen SIEM Supports Third-Party EDR Tools, Starting with Microsoft Defender](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-NGS-Exponential?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Falcon Next-Gen SIEM Supports Third-Party EDR Tools, Starting with Microsoft Defender ](https://www.crowdstrike.com/en-us/blog/falcon-next-gen-siem-supports-third-party-edr-tools-starting-with-microsoft-defender/) 03/23/26 * [ Public Sector ](https://www.crowdstrike.com/en-us/blog/category.public-sector/) ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blogicon-test-4.png) Public Sector [ ![CrowdStrike Expands Federal SOC Modernization Through CISA-Funded SIEMaaS](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-FalConGov-Roundup?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike Expands Federal SOC Modernization Through CISA-Funded SIEMaaS ](https://www.crowdstrike.com/en-us/blog/crowdstrike-expands-federal-soc-modernization-via-cisa-siemaas/) 10/01/26 [ ![CrowdStrike Falcon Platform Helps Meet U.S. Government Mandates for CISA BOD-26-04 ](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-Gov-Scroll?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike Falcon Platform Helps Meet U.S. Government Mandates for CISA BOD-26-04 ](https://www.crowdstrike.com/en-us/blog/crowdstrike-falcon-platform-helps-meet-us-government-mandates-cisa-bod-26-04/) 07/22/26 [ ![Falcon Platform for Government Now Offers Falcon for XIoT to Secure Connected Assets ](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-FalConGov-XIoT?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Falcon Platform for Government Now Offers Falcon for XIoT to Secure Connected Assets ](https://www.crowdstrike.com/en-us/blog/falcon-platform-for-government-now-offers-falcon-for-xiot-to-secure-connected-assets/) 03/18/26 [ ![CrowdStrike Innovates to Modernize National Security and Protect Critical Systems ](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-FalConGov-Roundup?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike Innovates to Modernize National Security and Protect Critical Systems ](https://www.crowdstrike.com/en-us/blog/crowdstrike-innovates-to-modernize-national-security-and-protect-critical-systems/) 03/18/26 * [ Exposure Management ](https://www.crowdstrike.com/en-us/blog/category.exposure-management/) ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/BlogIcon-test-image-2.svg) Exposure Management [ ![October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-PT-2025?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities ](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-october-2026/) 10/13/26 [ ![CrowdStrike Named a Leader in The Forrester Wave™: Proactive Security Platforms, Q3 2026](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Forrester%20Wave%20Proactive%20Security%20Platform%20Wave%202026-2-1060x698_Blog?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike Named a Leader in The Forrester Wave™: Proactive Security Platforms, Q3 2026 ](https://www.crowdstrike.com/en-us/blog/crowdstrike-named-leader-forrester-wave-proactive-security-platforms-q3-2026/) 09/24/26 [ ![September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-PT-2025?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs ](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-september-2026/) 09/08/26 [ ![August 2026 Patch Tuesday: One Exploited Zero-Day and 62 Critical Vulnerabilities Among 415 CVEs](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-PT-2025?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) August 2026 Patch Tuesday: One Exploited Zero-Day and 62 Critical Vulnerabilities Among 415 CVEs ](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-august-2026/) 08/11/26 * [ Securing AI ](https://www.crowdstrike.com/en-us/blog/category.securing-ai/) ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blogicon-test-3.svg) Securing AI [ ![When AI Guardrails Expose Vulnerabilities](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-DeepSeek?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) When AI Guardrails Expose Vulnerabilities ](https://www.crowdstrike.com/en-us/blog/when-ai-guardrails-expose-vulnerabilities/) 10/28/26 [ ![Why Organizations Secure AI Agents with Falcon Guardian](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-AIDR-Protection?wid=2048&hei=1349&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Why Organizations Secure AI Agents with Falcon Guardian ](https://www.crowdstrike.com/en-us/blog/why-organizations-secure-ai-agents-with-falcon-guardian/) 10/23/26 [ ![CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-Architecture-of-Agentic-Defense?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage ](https://www.crowdstrike.com/en-us/blog/crowdstrike-anthropic-critical-infrastructure-defense-program/) 10/08/26 [ ![Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-NPM-SupplyChain?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers ](https://www.crowdstrike.com/en-us/blog/how-attackers-can-bypass-llm-safety-classifiers/) 10/06/26 * [ Data Security ](https://www.crowdstrike.com/en-us/blog/category.data-security/) ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blog/data-protection-red.svg) Data Security [ ![Falcon Data Security for SaaS Secures Sensitive Data in Microsoft 365](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-Strengthen-Data-Security?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Falcon Data Security for SaaS Secures Sensitive Data in Microsoft 365 ](https://www.crowdstrike.com/en-us/blog/falcon-data-security-for-saas-secures-sensitive-data/) 10/05/26 [ ![CrowdStrike Accelerates Real-Time Data Classification with On-Device AI](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-On-Device-AI-Main?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) CrowdStrike Accelerates Real-Time Data Classification with On-Device AI ](https://www.crowdstrike.com/en-us/blog/crowdstrike-accelerates-real-time-data-classification-with-on-device-ai/) 09/16/26 [ ![ISO 42001:2023 and the New Reality of Cloud AI Data Risk](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-Data-Protection-Day-2026?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) ISO 42001:2023 and the New Reality of Cloud AI Data Risk ](https://www.crowdstrike.com/en-us/blog/iso-42001-2023-and-new-reality-of-cloud-ai-data-risk/) 06/04/26 [ ![Falcon Data Security Secures Data Wherever It Lives and Moves](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-Strengthen-Data-Security?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Falcon Data Security Secures Data Wherever It Lives and Moves ](https://www.crowdstrike.com/en-us/blog/falcon-data-security-secures-data-wherever-it-lives-and-moves/) 03/24/26 * [Start Free Trial](https://www.crowdstrike.com/products/trials/try-falcon-prevent) * [Featured](https://www.crowdstrike.com/en-us/blog/featured-articles/) * [Recent](https://www.crowdstrike.com/en-us/blog/recent-articles/) * [Video](https://www.crowdstrike.com/en-us/blog/videos/) * [Category](https://www.crowdstrike.com/en-us/blog/categories-overview/) * [Start Free Trial](https://www.crowdstrike.com/products/trials/try-falcon-prevent) __ # CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies ## Law firms hold privileged communications, M&A details, intellectual property, and financial data, making them attractive targets to eCrime and nation-state adversaries. October 28, 2026 • [ Counter Adversary Operations](https://www.crowdstrike.com/en-us/blog/author.counter-adversary-operations/ "Posts by Counter Adversary Operations") • [Threat Hunting & Intel](https://www.crowdstrike.com/en-us/blog/category.counter-adversary-operations/ "Threat Hunting & Intel") ![](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-LegalThreatReport-1?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Cyber intrusions targeting the legal sector nearly doubled between 2023 and 2026, reflecting the value of legal entities to both eCrime and nation-state adversaries. Legal entities hold privileged communications, corporate transactions, intellectual property, government matters, and financial records that make them valuable targets for threat actors seeking financial gain or long-term strategic intelligence. The [CrowdStrike 2026 Legal Threat Landscape Report](https://www.crowdstrike.com/en-us/resources/reports/2026-legal-threat-landscape-report/) analyzes threat activity observed from September 1, 2025 through August 31, 2026. It includes the key themes, trends, and events shaping the legal sector threat landscape, as well as anticipatory assessments and actionable recommendations to help the sector prepare for the continued evolution of modern threats. The breadth and complexity of threats targeting the legal sector are evident in this analysis. As AI technology advances, adversaries are likely to accelerate the scale and sophistication of their operations, putting greater pressure on defenders. This evolving environment demands continuous intelligence-driven defense to detect and stop threats. ## eCrime Makes Up 82% of Threats to Legal Entities Financially motivated adversaries accounted for 82% of observed activity against the legal sector. They can profit from attacks on legal entities by deploying ransomware or monetizing stolen data through extortion or resale on criminal markets. Big game hunting adversaries named 455 legal entities on dedicated leak sites, a 39% year-over-year increase. CHATTY SPIDER is a dominant threat: Their activity surged 129% in the first eight months of 2026 compared to all of 2024, and law firms made up nearly 90% of their victims during the reporting period. The adversary typically resumes data theft and extortion campaigns following a mid-year hiatus; however, they returned from this break slightly earlier than usual in 2026. This adversary almost exclusively targeted U.S.-based law firms, a trend highly likely to continue. They manipulate victims by impersonating IT staff to establish remote access sessions and exfiltrate sensitive data within minutes, and they increasingly use trusted enterprise tools to do it. In November 2025, CHATTY SPIDER hired a Russian national to physically access a U.S.-based law firm. The individual posed as an internal IT employee and was granted access to an onsite workstation, where he enabled the adversary to deploy remote monitoring and management (RMM) tools and attempted to exfiltrate data via cloud storage services. While the individual was detained during a second attempted visit, public reporting indicates CHATTY SPIDER used U.S.-based individuals to conduct several physical intrusions during 2026. SNARKY SPIDER, which emerged in October 2025, and CORDIAL SPIDER, which emerged in November 2025, are both significant eCrime threats to the legal sector. Both have targeted legal entities in high-tempo data theft and extortion campaigns. They share nearly identical tactics, techniques, and procedures (TTPs), including vishing calls that impersonate IT personnel and directing employees to single sign-on (SSO)-themed phishing pages. In one case, both targeted the same law firm one month apart. ## China-Nexus Adversaries Intensify Espionage Operations Multiple China-nexus adversaries conducted sustained cyber espionage campaigns against the legal sector throughout the reporting period. They demonstrated evolution across three key areas: zero-day exploitation of enterprise infrastructure, sophisticated cloud environment compromise, and targeted exploitation of legal-specific software. The top China-nexus adversaries targeting the legal sector are WARP PANDA, TITAN PANDA, MURKY PANDA, and OVERCAST PANDA. Below is a snapshot of their activity: **WARP PANDA** : Multiple intrusions at U.S.-based entities included targets in the legal sector. WARP PANDA deployed several forms of malware in victims’ VMware vCenter environments. In several of these cases, and as late as early 2026, the adversary exploited ESXi command logging bypass vulnerability CVE-2026-41709 as a zero-day. **TITAN PANDA** : In April 2026, TITAN PANDA conducted the first observed targeting of legal sector-specific software. The adversary exploited a hardcoded IIS machine key vulnerability in Intapp Time Server, software almost exclusively used by law firms for timekeeping and billing. **MURKY PANDA** : This adversary’s ORB28 password spraying campaign, while slightly outside the reporting period, represented the largest-scale operation by target count. The campaign affected more than 340 primarily U.S.-based entities across numerous sectors; the legal sector was the most affected. One law firm experienced nearly 500 distinct failed login attempts to as many accounts from approximately 300 distinct IP addresses in a 30-day period. **OVERCAST PANDA** : In September and October 2025, OVERCAST PANDA targeted executive-level employees at a U.K.-based legal firm, which is consistent with Chinese intelligence collection priorities targeting key personnel with access to sensitive information and decision-making authority. ## Keeping Pace with the Adversary CrowdStrike Counter Adversary Operations, which tracks more than 290 named adversaries, combines threat intelligence, managed threat hunting, and trillions of telemetry events from the CrowdStrike Falcon® platform to detect and stop threat actors. Counter Adversary Operations comprises two integrated teams. The CrowdStrike Intelligence team provided the analysis for the [CrowdStrike 2026 Legal Threat Landscape Report](https://www.crowdstrike.com/en-us/resources/reports/2026-legal-threat-landscape-report/); this team identifies new adversaries, tracks malicious activity, and captures emerging cyber threat developments in real time. The CrowdStrike OverWatch team applies this intelligence through proactive threat hunting across customer telemetry to detect and disrupt malicious activity. Together, these teams deliver intelligence and hunting capabilities to help legal sector organizations stay ahead of advanced adversaries and stop their attacks. #### Additional Resources * _Learn more about[CrowdStrike Counter Adversary Operations](https://www.crowdstrike.com/en-us/platform/threat-intelligence/) threat intelligence and threat hunting, or [request a demo](https://www.crowdstrike.com/en-us/platform/threat-intelligence/counter-adversary-operations-demo-request/)._ * _Tune in to the[Adversary Universe podcast](https://www.crowdstrike.com/en-us/resources/adversary-universe-podcast/), where CrowdStrike reveals the threat actors behind the latest cyberattacks._ [ ](https://www.linkedin.com/shareArticle) [ ](https://twitter.com/share) * * * #### Related Content [ ![Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation ](https://assets.crowdstrike.com/is/image/crowdstrikeinc/CS_Blog-Update_02-1?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Threat Hunting & Intel | Oct 23, 2026 Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation ](https://www.crowdstrike.com/en-us/blog/obstacles-to-weaponizing-php2shell-likely-constrain-exploitation/) [ ![CrowdStrike Uncovers New Agentic AI Campaigns](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-AgenticAI-Report?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Threat Hunting & Intel | Oct 21, 2026 CrowdStrike Uncovers New Agentic AI Campaigns ](https://www.crowdstrike.com/en-us/blog/crowdstrike-uncovers-new-agentic-ai-campaigns/) [ ![U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Blog-LABYRINTH-CHOLLIMA?wid=1060&hei=698&fmt=png-alpha&qlt=95,0&resMode=sharp2&op_usm=3.0,0.3,2,0) Threat Hunting & Intel | Oct 13, 2026 U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance ](https://www.crowdstrike.com/en-us/blog/fbi-disrupts-famous-chollima-operation-with-crowdstrike-assistance/) __ Categories * [ ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/Agentic-SOC-Blog-icon.svg) Agentic SOC 55 ](https://www.crowdstrike.com/en-us/blog/category.ai-machine-learning/) * [ ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blog/Cloud-Application-Security.svg) Cloud & Application Security 150 ](https://www.crowdstrike.com/en-us/blog/category.cloud-security/) * [ ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blog/data-protection-red.svg) Data Security 27 ](https://www.crowdstrike.com/en-us/blog/category.data-security/) * [ ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/Endpoint-Security-And-XDR.svg) Endpoint Security & XDR 362 ](https://www.crowdstrike.com/en-us/blog/category.endpoint-protection/) * [ ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blog/Engineering-and-Tech.svg) Engineering & Tech 87 ](https://www.crowdstrike.com/en-us/blog/category.engineering-and-technology/) * [ ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blog/Exec-Viewpoint.svg) Executive Viewpoint 181 ](https://www.crowdstrike.com/en-us/blog/category.executive-viewpoint/) * [ ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/BlogIcon-test-image-2.svg) Exposure Management 127 ](https://www.crowdstrike.com/en-us/blog/category.exposure-management/) * [ ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blog/Front-Lines.svg) From The Front Lines 207 ](https://www.crowdstrike.com/en-us/blog/category.from-the-front-lines/) * [ ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/Identity-Protection.svg) Next-Gen Identity Security 76 ](https://www.crowdstrike.com/en-us/blog/category.identity-protection/) * [ ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blog/Next-Gen-SIEM-LOG-Management.svg) Next-Gen SIEM & Log Management 116 ](https://www.crowdstrike.com/en-us/blog/category.observability-and-log-management/) * [ ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blogicon-test-4.png) Public Sector 44 ](https://www.crowdstrike.com/en-us/blog/category.public-sector/) * [ ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blogicon-test-3.svg) Securing AI 57 ](https://www.crowdstrike.com/en-us/blog/category.securing-ai/) * [ ![](https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/icons/blog/Counter-Adversary-Ops.svg) Threat Hunting & Intel 230 ](https://www.crowdstrike.com/en-us/blog/category.counter-adversary-operations/) ###### CrowdStrike Falcon Platform ##### Ready to protect your business? Try CrowdStrike free today [Start free trial](https://www.crowdstrike.com/products/trials/try-falcon-prevent) ##### Subscribe Sign up now to receive the latest notifications and updates from CrowdStrike Subscribe ##### See CrowdStrike Falcon in action [Explore demos](https://www.crowdstrike.com/products/demos/) [ ![logo](https://assets.crowdstrike.com/is/content/crowdstrikeinc/black-crowdstrike-logo-footer) ](https://www.crowdstrike.com/en-us/) * [ __](https://x.com/CrowdStrike) * * [ __](https://www.linkedin.com/company/crowdstrike) * [ __](http://www.youtube.com/user/CrowdStrike) * Copyright © 2026 CrowdStrike * [ Privacy ](https://www.crowdstrike.com/privacy-notice/) * [ Request Info ](https://www.crowdstrike.com/services/request-information/) * [ Blog ](https://www.crowdstrike.com/blog/) * [ Contact Us ](https://www.crowdstrike.com/contact-us/) * 1.888.512.8906 * [ Accessibility ](https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/#) --- > 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/10388) · Original source: [crowdstrike.com](https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/)