Legal services threat intelligence report — 27 June – 3 July 2026

• Reference: TI-2026-0703-003 (public edition)
• Sector: Legal services — solicitors, barristers and legal service providers
• Reporting period: 27 June – 3 July 2026
• Issued: 3 July 2026 · Lead analyst: Peter Bassill · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

This report provides an assessment of the threat landscape affecting the Legal sector - solicitors, barristers, chambers, legal support services and adjacent - during the period 27 Jun 2026 - 03 Jul 2026. It is intended to support operational defenders and risk owners in law firms and legal services organisations and is graded TLP:CLEAR. Coverage this period is dominated by the SharePoint deserialisation KEV entry (CVE-2026-45659) - operationally significant for the legal sector given the near-ubiquity of SharePoint and iManage for matter files, trust-account documentation, and client due-diligence packs - and by continued ransomware and data-extortion activity of the shape that has driven the 77% year-on-year increase in successful attacks on UK law firms reported by the SRA / Law Gazette.

The perimeter tail is dominated by IP Insights critical-scored Tor exits and bulletproof hosting. Two peer notifications received this period via the Solicitors Regulation Authority informal information-sharing channel concern conveyancing-fraud precursor activity; details TLP:CLEAR-restricted.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that CVE-2026-45659 will be exploited against unpatched SharePoint estates in law firms and legal services organisations within the next 14 days, given the CISA KEV three-day BOD timeline and the near-ubiquity of SharePoint / iManage / Microsoft 365 collaboration in the vertical (HIGH confidence).
2. It is highly likely that data-extortion attacks (encryption-optional, exfiltration-mandatory) will continue to grow at the pace suggested by Arctic Wolf's 11x YoY figure through Q3 2026, disproportionately affecting law firms because of the sensitivity and monetisable nature of client matter data (HIGH confidence).
3. It is likely that Qilin, Akira and DragonForce will continue to target mid-market law firms as opportunistic ransomware targets, consistent with the SRA 2024 Risk Outlook and sector-adjacent leak-site activity (MEDIUM-HIGH confidence).
4. It is a realistic possibility that a state-sponsored actor (particularly Chinese or Iranian) will conduct a targeted intrusion against a UK law firm handling sanctions, dual-use export licensing, or international arbitration matters during Q3 2026 (MEDIUM confidence).

2. Sector threat landscape

The legal sector remains one of the most targeted verticals in the UK, driven by the combination of high-value data (client matter files, board packs, transaction data, material non-public information), a payments environment (client trust accounts) that closely resembles financial services in fraud terms, and, historically, uneven cyber-maturity across the mid-market. NCSC's UK legal sector threat report, the SRA 2024 Risk Outlook and the Law Gazette's report of a 77% YoY increase in successful attacks on UK law firms all point to the same operational reality this period.

CVE-2026-45659 is operationally significant for the legal sector. SharePoint (and iManage which frequently sits alongside it) is the dominant document-management platform in mid-market and large law firms, and is the store of record for matter files, client onboarding documentation, KYC / AML packs, board packs, opinion drafts, and trust-account correspondence. The Site Member auth pre-requisite is a low bar in typical law-firm deployments where all fee earners and support staff carry at least Site Member on the matter intranet.

Data-extortion continues to dominate the operational threat picture. Arctic Wolf's 11x YoY growth figure for data-extortion incidents captures the operational reality that many actors have shifted away from encryption toward pure exfiltration-and-leak monetisation. The sensitivity of legal client data amplifies both the extortion leverage and the regulatory / reputational exposure of successful attacks. Conveyancing-fraud campaigns targeting property-transaction teams remain the leading fraud-adjacent vector, with the SRA continuing to name it in the top three impacts against firms.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

Qilin (a.k.a. Agenda)

• Aliases: Agenda, Qilin.B, Water Galura
• Suspected Origin: Russian-speaking (unattributed)
• Suspected Sponsor: Organised criminal RaaS
• Primary Motivation: Financial (double extortion)
• Sector Targeting: Legal, healthcare, financial services, professional services
• Geographic Focus: Global
• Signature TTPs: IAB-brokered credentials, RMM abuse, RDP; Rust payload; ESXi Linux variant
• Tooling / Malware Families: Qilin.B, Cobalt Strike, Rclone-to-Mega, Mimikatz
• Recent Activity: Sustained cadence into July 2026 per ransomware.live
• Assessed Threat to Vertical: HIGH
• Analytic Confidence: HIGH

Akira

• Aliases: Akira, Storm-1567
• Suspected Origin: Russian-speaking (unattributed)
• Suspected Sponsor: Organised criminal RaaS
• Primary Motivation: Financial (double extortion)
• Sector Targeting: Legal, manufacturing, professional services
• Geographic Focus: North America and Europe
• Signature TTPs: Cisco VPN unpatched initial access, IAB credentials, RDP lateral movement, ESXi targeting
• Tooling / Malware Families: Akira ransomware, Megazord ESXi variant, Rclone, AnyDesk
• Recent Activity: Cumulative $244m proceeds; sustained cadence into July
• Assessed Threat to Vertical: HIGH - direct threat to mid-market law firm ESXi back-office estates
• Analytic Confidence: HIGH

DragonForce / Scattered Spider cluster

• Aliases: Scattered Spider, UNC3944, Octo Tempest, Muddled Libra
• Suspected Origin: Anglophone (UK/US); four arrests 30 Jun 2026
• Suspected Sponsor: Organised criminal alliance
• Primary Motivation: Financial (ransomware + extortion)
• Sector Targeting: Retail, telecoms, professional services, technology; sector adjacency for legal
• Geographic Focus: Anglophone western targets
• Signature TTPs: Voice-phishing IT service desk to reset MFA, help-desk social engineering, EDR bypass via RMM, aggressive cloud-tenant pivot
• Tooling / Malware Families: DragonForce ransomware, AnyDesk, SplashTop, Ngrok, Impacket
• Recent Activity: NCA arrests 30 Jun 2026 reduce but do not eliminate operational threat under alliance-affiliate model
• Assessed Threat to Vertical: MEDIUM-HIGH - social-engineering methodology transfers to law-firm help desks
• Analytic Confidence: HIGH

[Repeat the profile block above for each additional threat actor. A typical monthly report will profile between two and four actors in detail; quarterly reports may profile more.]

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment and should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Detection engineering should treat CVE-2026-45659 as the principal hunting hypothesis for the next reporting cycle. Rules around w3wp.exe spawning cmd or PowerShell under the SharePoint app-pool identity, ULS log deserialisation exceptions, and Site Member-permission accounts accessing upload endpoints must be deployed. Deploy conveyancing-fraud-specific detections against partner / conveyancer mailboxes: New-InboxRule with keyword filters matching common purchase / completion / undertaking terminology, mailbox-forwarding rule creation, delegated-access grants outside expected sessions. Retain Qilin / Akira initial-access hunt playbook. Deploy help-desk social-engineering hunts: MFA reset events shortly followed by first-time sign-in from a non-corporate device or IP, particularly if the target is a partner-level or IT-admin account.

Defend

Preventive priorities follow Section 6 directly. SharePoint / iManage patching must be prioritised as CVE-2026-45659 remediation, with the CISA KEV 04 Jul deadline as the operational anchor. Complete NetScaler patching and session-invalidation. Deploy phishing-resistant MFA (FIDO2, Windows Hello for Business) to all partner-level and conveyancer accounts, and to any IT-admin / service-desk account with MFA-reset authority. Deploy Conditional Access rules blocking non-managed devices from initiating mailbox-rule creation and mailbox-forwarding actions. Where iManage or NetDocuments is the primary DMS, review third-party integration attack surface and disable unused connectors. Baseline data loss prevention on matter files and MNPI-tagged documents.

Disrupt

Disruption activity within client lawful authority should focus on: (i) participation in the SRA cyber-security peer group and the informal law-firm information-sharing channel, with this week's IP Insights critical / block tail contributed; (ii) NCSC CiSP membership for law-firm technical staff to enable indicator exchange under the professional services vertical; (iii) coordinated take-down requests to bulletproof providers for conveyancing-fraud infrastructure, submitted through the NCSC Takedown Service; (iv) participation in SRA / Law Society tabletop exercises for large-firm incident response, including data-extortion negotiation and regulatory notification workflows.

10. Forward outlook

Looking forward to the next reporting period (04 Jul - 10 Jul 2026), it is likely that at least one UK law firm will publicly disclose a SharePoint-borne incident attributable to CVE-2026-45659. It is likely that data-extortion attacks against mid-market law firms will continue at elevated volumes. Conveyancing-fraud attempts against partner mailboxes are expected to remain steady week-on-week. Ransomware leak-site cadence from Qilin and Akira is expected to remain steady, with a moderate probability of a directly-attributed UK law-firm victim posting during the period.

Trigger conditions that would prompt revision of this outlook include: (a) any publicly-disclosed UK law-firm SharePoint / iManage incident attributable to CVE-2026-45659; (b) any confirmed state-sponsored intrusion against a UK law firm handling sanctions or dual-use export licensing, which would warrant immediate out-of-cycle reporting; (c) any material change in the operational tempo of the DragonForce / Scattered Spider cluster following the NCA arrests.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.