Some possibilities:
* if the police computer was itself infected and the malware was trying to propagate
* The data was copied from a drive or computer that was infected
There's really only 4 possibilities, and they're all significant.
1) PD is responsible, and intentionally infecting defense attorneys with malware. Major obstruction of justice.
2) PD is responsible, and has been hacked. At a minimum, all their computer evidence is tainted; who knows if someone has been using their access for ill as well. Access to police DBs is useful for all sorts of nefarious purposes.
3) Defense attorney has faked the whole thing. Noteworthy in its own right; defense attorneys are pretty used to losing as a matter of necessity so for one to go on some kind of intentional crusade against the local PD, especially in such a public and falsifiable way... No judge will sign off on criminal sanctions here without a thorough investigation, so this is extremely unlikely barring a psychotic break (which does happen now again, it's a high-stress job).
4) Defense attorney has been hacked. Who hacked him? Have any of his clients been affected? Is someone, perhaps a technically sophisticated someone, targeting defense attorneys?
Perhaps the proper move would have been to surveil the malware without revealing that you know of it. Could prove/falsify #4, or implicate PD conclusively if #1.
"Additionally, the placement of these trojans, all in the same sub-folder"
All in the same directory! Whoever it was, he certainly was even tidy.
Besides, we're talking about evidence here. Even if it was "just" the case of police computers infected with... three (three!) backdoors, that would be extremely serious.