Business Email Compromise in Legal Transactions: Why Lookalike Domains Are the Attack Surface

Business email compromise costs law firms money directly rather than indirectly, and the NCSC's June 2023 Cyber Threat Report on the UK legal sector explains why the sector is structurally exposed to it. The underlying problem is impersonation rather than malware, which shifts the defensive focus from endpoint detection toward domain and identity control.

The mechanics the report describes

The NCSC describes BEC as a form of phishing where a criminal tricks a senior executive or budget holder into transferring funds or revealing sensitive information. Unlike bulk phishing, BEC messages are crafted for specific individuals, and the report notes they can be harder to detect for that reason.

Two delivery methods are described. In the first, the attacker uses a legitimate email account they have already accessed, for example because the account lacked a strong password or multi-factor authentication. In the second, the attacker uses a lookalike address that appears to belong to a real member of a legitimate company but is controlled by the criminal. The report gives a concrete illustration: a message that appears to come from [e-mail] is actually sent from [e-mail].

The most effective technique described is timeline manipulation. Attackers fabricate an email chain, or duplicate a genuine exchange with clients or suppliers about an invoice or payment, then insert a doctored message with new bank details at the point where payment is expected. The report also notes that malicious emails from one firm are used as a platform to attack other firms, because it is normal for multiple firms to work on the same matter.

The Crimson Kingsnake campaign

The report documents a named campaign that demonstrates the pattern at scale. In late 2022, reports emerged of a threat group called Crimson Kingsnake conducting large-scale BEC campaigns targeted at business customers of major law firms.

The group aimed to intercept transactions and acquire funds fraudulently by registering a large number of domains similar to those of major multinational law firms, then sending emails purporting to chase payment for false invoices. The report characterises the campaign as indiscriminate and notes that it shows how the status of lawyers can be abused. The messages used legal language to increase the sense of threat and urgency and purported to come from roles such as a Debt Collection Litigation Counsel at a major international law firm. In some cases a follow-up reply impersonating a known senior individual at the victim organisation asked that the bill be paid.

Two technical details stand out. The attack depends on a large portfolio of lookalike domains, which is an infrastructure problem observable before any email is sent. And it depends on the credibility of an invoice workflow, which is a process problem.

Why law firms are the preferred target

The report gives three structural reasons. Law firms transfer significant sums of money and ask to view sensitive documents such as financial records, contracts and designs. They are generally perceived as trustworthy and authoritative, qualities an attacker can borrow. And transactions are time-pressured, with many suppliers, clients and complex payrolls, which the report describes as attractive conditions for phishing and business email compromise.

The sector's economics reinforce the exposure. The report records over 32,900 legal enterprises in the UK as of early 2023 with an estimated total revenue of £43.9 billion, and notes that the 2022 PriceWaterhouseCoopers Annual Law Firms Survey found the top 100 firms spending an average of 0.46% of fee income on cyber security in 2022. A single successful payment redirection can exceed a firm's entire annual security budget, which is why BEC economics differ from those of generalised intrusion.

Reading the domain-heavy estate

Because the attack depends on name resemblance, the useful external question is how much of a sector's visible estate is domain-based rather than address-based.

A ZoomEye observation collected on 2026-10-06 against the legal industry fingerprint returned 2,725 assets for industry="legal", split into 1,845 domain assets and 880 non-domain assets, with 879 matching an IPv4-only restriction. A domain-only query returned the same 1,845 figure. Adding a United Kingdom filter produced 65 assets, with a further domain-only filter producing 10.

The comparison that matters for BEC is the ratio: roughly two-thirds of the matching estate is domain-classified. Domains are the namespace an attacker has to imitate, and they are also the namespace a firm can defend cheaply, by registering defensive variants and by monitoring for new registrations that resemble its own. The report's recommended controls point the same way. It advises using a takedown service to monitor and assist with removal of impersonating domains, and deploying SPF, DKIM and DMARC on all domains, including those not used for email.

The small United Kingdom domain-only count deserves care. Ten matching domain assets under a combined geography, industry and asset-type filter is a narrow result that reflects labelling conventions rather than the true number of UK legal domains. It illustrates that impersonation monitoring cannot rely on a single industry filter; it has to start from a firm's own domains and their variants.

A workable control set

The report's BEC section lists six controls, and they divide cleanly into infrastructure, identity and process work. On infrastructure: use a takedown service for impersonating domains, and implement SPF, DKIM and DMARC for all domains even if unused for mail. On identity: ensure strong unique passwords on email accounts and enable multi-factor authentication for all critical business systems. On process: make it easy for staff and external parties to report or query suspicious emails, verify all important or unusual email requests through a second channel such as a call, a login, or in-person confirmation, and give staff regular awareness training.

The second-channel rule is the one that defeats a well-crafted thread hijack, because it does not depend on spotting a typo in a domain name. It depends on a payment process that cannot be completed from email alone.

Limitations

Lookalike domain registration and credential compromise are not directly observable through internet exposure scanning. Asset counts describe records matching a fingerprint at a point in time and do not identify ownership, intent or compromise. The Crimson Kingsnake details and the sector statistics above are as reported by the NCSC; this article adds no independent verification of the campaign and makes no claim about which domains or firms were involved.

References

[1] NCSC, Cyber Threat Report: UK Legal Sector, June 2023. https://www.ncsc.gov.uk/report/cyber-threat-report-uk-legal-sector

[2] NCSC, Cyber Threat Report: UK Legal Sector (PDF). https://www.ncsc.gov.uk/sites/default/files/documents/Cyber-Threat-Report_UK-Legal-Sector.pdf

[3] ZoomEye exposure observations collected 2026-10-06. https://www.zoomeye.ai/