The situation
The assistant company secretary of a listed industrial manufacturer received an email that appeared to come from a paralegal at the company's outside corporate counsel. It said the annual filing for one of the company's subsidiaries had been rejected by the registry, attached the filing itself with the chief financial officer's signature, and asked for a correction fee to be paid urgently through the law firm's "client account". On the same morning, accounts payable received a matching invoice. A payment of $486,000 was queued and stopped only when a finance manager called the law firm on a known number.
The sending domain differed from the law firm's by one character. Everything else was accurate. The company wanted to know how.
The question
Where did the attacker get each element of the lure? Is this a single attempt or part of a wider campaign? And what else about the company could be used the same way next time?
What we did
An exposure lead, an infrastructure analyst, a records researcher and an investigator worked the case, with an independent red-team reviewer. All collection was passive. We did not interact with the attacker's infrastructure beyond what any visitor to a public web page would.
1. Rebuilt the attacker's research
We took the lure apart and traced every element to a public source. The attached filing was a genuine document downloaded from the subsidiary's registry entry, where scanned filings are published with signatures intact. The paralegal's name and the law firm's role came from a covering letter filed with the same document. The assistant company secretary's name and role were on a professional profile and in the company's governance report. The timing coincided with a trade show at which the chief financial officer was speaking, announced on the company's own social media two weeks earlier.
2. Pivoted on the infrastructure
The lookalike domain had been registered nine days before the email. Its registration pattern, name servers and mail configuration were shared with 37 other recently registered domains. Each imitated a law firm or a registered agent: 11 firms and 4 agents in total, across three countries. Lure documents recovered from public malware analysis repositories, where other recipients had submitted them, carried the same authoring software build and the same reused template identifier as the documents sent to our client.
3. Assessed the client's wider exposure
With the attack path understood, we assessed the rest of the company the same way an attacker would. The assessment found 214 exposure items, including signed documents in seven registries, 63 documents on the company's websites carrying internal usernames in their metadata, an email address format that could be inferred from public sources, 1,140 staff identifiable by role from professional profiles, and nine further lookalike domains imitating the company itself.
4. Challenged the conclusions
The reviewer argued that the shared template could come from a commercially sold phishing kit used by many unrelated actors. We agreed that the template alone could not carry the link. The shared registration pattern, name servers and mail configuration, together with the consistent targeting of legal service providers, could. The single-operation finding was reported at moderate confidence. We did not identify the individuals behind it, and said so.
| Element of the lure | Public source | Action taken |
|---|---|---|
| Signed subsidiary filing | Registry document images | Future filings made electronically by the agent |
| Paralegal and law firm names | Covering letter filed with the registry | Filing practice changed with counsel |
| Recipient's name and role | Professional profile, governance report | Callback rule for all filing-related payments |
| Timing | Company announcement of executive travel | Travel announced after events, not before |
| Sending domain | Registered nine days earlier | Suspended with 30 related domains |
What we found
- High confidence: every element of the lure was taken from sources the company or its advisers had published.
- Moderate confidence: the 38 lookalike domains are very likely operated by a single group targeting companies through their legal service providers.
- High confidence: the company's public footprint would support at least three further lure types, which we described step by step in the report.
The company's security controls were looking for intrusions and malware. There was neither. The attacker read public registries, a governance report and a social media post, registered a domain and wrote an email. Defending against that requires knowing what your public record says about you.
The outcome
- Evidence packages went to the registrars and hosting providers of all 38 domains. 31 were suspended within ten days.
- The eleven impersonated law firms and four agents were notified through the client's counsel. Two found that lures had been sent to their other clients and warned them.
- The findings were referred to law enforcement and shared with an industry information-sharing group.
- The company cleaned the metadata from 63 documents, changed how subsidiary filings are made, adopted a callback rule for all filing-related payments and stopped announcing executive travel in advance.
- A re-check 90 days later found 152 of the 214 exposure items closed or controlled. The company reported no successful impersonation in the nine months that followed.
What made the difference
Treating the lure as evidence of research. Once each element was traced to its source, the client could see which doors were open, close most of them and put controls on the ones the law required to stay open. The infrastructure work then turned one near miss into a warning for dozens of other companies. Priya Sandoval explains the wider pattern in Before the first email.