BEC Lawsuit Lure Score
The BEC Lawsuit Lure Score is a cybersecurity metric that quantifies an organization's susceptibility to a specific, high-stakes type of Business Email Compromise (BEC) scam known as Attorney Impersonation. This particular scam involves an attacker posing as a lawyer, a legal team member, or a high-ranking executive, requesting urgent, confidential action on a fictitious or real corporate legal matter, often involving a time-sensitive wire transfer.
Purpose and Context
BEC scams that use a legal pretext are particularly effective because they exploit the human element by leveraging the victim's sense of urgency and a tendency to comply with authority. The score focuses on this vulnerability because these scams, if successful, can lead to devastating financial losses.
Exploits Confidentiality: The attacker will often ask the recipient, typically a lower-level finance or administration employee, to keep the request confidential, thereby preventing them from following regular validation and verification procedures.
Leverages Real Events: To increase plausibility, these attacks often coincide with real, non-public corporate events, such as mergers, acquisitions, or ongoing legal proceedings, which are discovered through social engineering and research.
Focus on Lawsuit/M&A Lures: The score is highest when an organization shows poor defense against domains that are easily spoofed or when its external digital footprint provides excessive information that could be used to create a credible legal "pretext".
Hypothesized Calculation Components
While the precise proprietary formula for a "BEC Lawsuit Lure Score" is not publicly defined, its calculation would logically be derived from factors that enable this specific type of high-stakes social engineering:
1. Domain Impersonation Risk
This component assesses the technical ease with which an attacker can spoof a legal-themed domain.
Lookalike Domain Availability: The number of close domain permutations (e.g., typosquatting, substitution, or dictionary additions like 'mycompany-law.com' or 'mycompany-legal.com') that are either available for a scammer to register or already registered and pointing to an active mail server.
Email Authentication Failure: The lack of robust email authentication protocols, such as DMARC and SPF records, makes it easier for an attacker to spoof the sender's display name or email address (e.g., impersonating the CEO or General Counsel).
2. Employee/Target Susceptibility
This component measures the organization's transparency regarding employees who could be targeted.
Executive Visibility: The amount of public information (e.g., on social media or company websites) revealing the names and titles of high-authority figures (CEO, CFO, General Counsel) who are often impersonated.
Role Identification: The ease with which an attacker can identify lower-level employees in finance, HR, or administration who are likely to handle wire transfer requests but may lack the authority to question a legal request from an executive.
3. Operational Pretext Risk
This component assesses how easily an attacker can gather credible information to build a convincing "lure."
Public Filing Exposure: The number of publicly available legal documents or regulatory filings (e.g., court records, securities filings) that could provide a real pretext (such as a mention of a pending legal action or acquisition) to reference in the fraudulent email.
A high BEC Lawsuit Lure Score indicates that the organization has a poor defense against the specific vector of attorney impersonation, highlighting a critical area for employee training and domain defense.
ThreatNG is exceptionally effective at providing the specific, external intelligence needed to mitigate the risks that drive a high BEC Lawsuit Lure Score. By identifying technical weaknesses and information exposure that enable attorney impersonation and high-stakes fraud, ThreatNG helps organizations proactively defend against these attacks.
Mitigating the BEC Lawsuit Lure Risk with ThreatNG
External Discovery and Continuous Monitoring
ThreatNG’s foundation of purely external, unauthenticated discovery and continuous monitoring ensures constant vigilance over the unauthorized assets and lookalike domains that form the basis of a lawsuit-lure scam.
Example of ThreatNG Helping: ThreatNG's Continuous Monitoring tracks the organization's name across various TLDs. If an attacker registers a high-risk dictionary addition like mycompany-legal.com, ThreatNG immediately flags the creation of a key piece of fraud infrastructure before the scam emails are sent. This proactive alerting helps disrupt the scam at its earliest stages.
External Assessment (Security Ratings)
ThreatNG’s security ratings directly quantify the organizational weaknesses that a BEC-lure scam exploits.
BEC & Phishing Susceptibility Security Rating: This is the most critical metric for the Lawsuit Lure Score, as it's based on factors such as Domain Name Permutations (both available and taken) and Domain Permutations with Mail Record.
Detailed Example (Domain Impersonation Risk): A low rating (e.g., 'F') signals a high risk. This drop could be caused by ThreatNG finding that a specific typosquatting domain, such as mycompnay.com (transposition), is taken and has an active Mail Record. This objective finding confirms that the domain is set up to send fraudulent emails, providing the most significant technical input for a high BEC Lawsuit Lure Score.
Cyber Risk Exposure Security Rating: This rating assesses basic email authentication failures, a key technical enabler of these scams.
Detailed Example (Email Authentication Failure): The rating explicitly factors in Domain Name Record Analysis (missing DMARC and SPF records). The absence of these records makes it trivially easy for an attacker to spoof the "From" address of a high-authority executive, such as the General Counsel, making the lawsuit-lure email highly convincing and driving up the risk score.
Investigation Modules
The investigation modules provide the specific, non-public details an attacker might use to build a credible "pretext," allowing the organization to mitigate its Operational Pretext Risk.
Domain Intelligence (Domain Name Permutations): This module identifies the specific domain names used to create the fraudulent email address (e.g., an executive's name at a lookalike domain) and confirms the activity associated with it.
Detailed Example (Lookalike Domain Availability): The module lists domain permutations that include Targeted Keywords related to access management, business, and finance, such as pay, payment, access, and auth. The existence of mycompany-pay.com that an attacker could use to solicit fraudulent payments, is a direct driver of the Lawsuit Lure Score, as it enables the final financial transaction of the scam.
Sentiment and Financials: This module helps identify the Operational Pretext Risk by monitoring publicly available documents.
Detailed Example (Public Filing Exposure): The module specifically monitors SEC Filings of Publicly Traded US Companies, including 8K Filings and Filing Information. An attacker can use a recently filed 8-K that mentions a pending acquisition or legal restructuring to make a scam email particularly and credible. ThreatNG's monitoring of these filings allows the organization to anticipate which pretext an attacker is most likely to use.
LinkedIn Discovery: This module helps manage the Employee/Target Susceptibility component by identifying key targets.
Detailed Example (Role Identification): This module identifies employees most susceptible to social engineering attacks. By flagging individuals in departments like Finance or Administration with high visibility, security teams can proactively provide enhanced training to those employees, lowering overall susceptibility to the lure.
Intelligence Repositories
The DarCache repositories provide real-world threat context necessary to prioritize defensive actions and validate the urgency of the findings.
DarCache Dark Web: This repository tracks organizational mentions and associated Compromised Credentials.
Example of ThreatNG Helping: The discovery of an executive's compromised login credentials in the DarCache Dark Web repository, combined with the lack of DMARC protection, confirms that an attacker has both the means (the exposed credentials) and the easy delivery channel (lack of email authentication) to execute the high-confidence BEC Lawsuit Lure scam.
Complementary Solutions
ThreatNG's intelligence on lookalike domains and exposed pretext data is crucial for working cooperatively with internal systems responsible for mitigating the human and technical risks of BEC.
Security Awareness Training Platforms: ThreatNG identifies the exact nature of the brand impersonation being used externally.
Example of ThreatNG and Complementary Solutions: ThreatNG finds that attackers are setting up fake domains related to security or confirm keywords, such as mycompany-verify.com. This specific threat intelligence is fed into the organization's security awareness training platform, which then customizes phishing simulations and training modules to feature these high-confidence lure domains, directly addressing the "Lawsuit Lure" problem through targeted employee education.
Email Security Gateway (ESG) Solutions: ThreatNG provides the intelligence to block malicious senders preemptively.
Example of ThreatNG and Complementary Solutions: ThreatNG identifies a specific permutation domain with an active Mail Record that is rated highly for BEC susceptibility. This malicious domain is immediately sent to the ESG solution, which then automatically adds the domain to its sender blacklist. This action proactively blocks any fraudulent "lawsuit lure" emails originating from that domain before they ever reach an employee's inbox.
