Insights | Objection! Law firms in the cyber crosshairs

Law firms can be attractive targets for malicious cyber actors. These firms often hold sensitive client information and handle accounts containing large sums of money. The people who conduct these attacks are frequently based offshore and can use sophisticated techniques to cover their tracks, so the chances of recovering stolen funds or data is often low. 

The NCSC has seen a spike in incidents of law firms being targeted by cyber criminals. These incidents can be devastating for those who are impacted. As well as serious losses of sensitive data or funds, the damage to a firm’s reputation and their clients’ confidence in them can be long-lasting. 

Law firms vary widely in size from sole practices through to corporates with hundreds of employees, but a common thread is that many of them use an external provider for their IT services. This can sometimes make it challenging to understand or remedy the weak points in their own cyber defences.

Business email compromise

Cyber-attacks on law firms come in many different forms, but one of the most common types is called business email compromise. This is a kind of targeted attack where a bad actor tries to gain access to a firm’s legitimate email account, or uses a lookalike email address that resembles a firm’s real address. 

Using these tactics, the attacker may use the email address to trick the firm’s staff, their clients, or other law firms into transferring money or information. For example, an attacker could fabricate an email to a client containing a fake invoice that lists a bank account controlled by the attacker. The attacker hopes the client will be fooled into paying money to the wrong account.

In the past, phishing emails were easier to spot because they often contained poor spelling and grammar or unprofessional language. With the rise of artificial intelligence-assisted writing tools, however, phishing emails have become more difficult to distinguish from genuine ones.

Social media profiling

Staff who use social networking sites such as LinkedIn may reveal a lot of information about their professional lives and interests to the public. Bad actors can use this information to construct detailed profiles of your staff, the organisational hierarchy at your firm, and your staff’s connections to other people and companies.

This kind of information can help attackers to create phishing emails or tailored messages that can look very convincing at first glance. Here’s a step-by-step example of how a criminal could use this information for malicious purposes:

1. Tim is a legal executive who reports to Cathy, a partner at a large law firm.
2. A criminal sees this connection on Tim’s LinkedIn profile and, using internet research techniques, discovers Tim’s personal cellphone number.
3. The criminal creates a fake instant message from Cathy to Tim, requesting that an attached invoice is paid urgently. Tim has not received an instant message from Cathy before, but thinks it is genuine because it has Cathy’s full name and mentions the name of a real client.
4. Tim feels under pressure to act and doesn’t take the time to call Cathy back on her work number to check if the message was genuine. He pays the invoice quickly and the money is lost to the attacker.