eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address: Targeting Belgian Bank Clients

Campaign or TTP Overview

In September 2023, a sophisticated phishing campaign targeted the clients of Belfius Bank, a prominent Belgian financial institution. This operation was particularly notable for its innovative use of an IPv4-mapped IPv6 address, a tactic that effectively masked the origin of the attack and added a layer of complexity to the phishing effort. The campaign aimed to deceive recipients into divulging sensitive banking credentials by exploiting a unique network addressing technique.

Initially observed through traffic analysis and suspicious activity reports, the phishing emails were distributed over several weeks. Although the actor behind the attack remains unidentified, the emails displayed a high level of sophistication in spearphishing tactics, suggesting involvement of individuals or groups with considerable technical proficiency. The emails, cloaked to look like legitimate bank communications, lured recipients into clicking on links leading to counterfeit bank login pages.

The campaign successfully flew under the radar of standard filtering and security systems, exploiting gaps in IPv6 handling that many organizations are still working to bridge. It served as a stark reminder of the evolving ingenuity behind phishing attacks and the ongoing challenge of securing digital communications.

How It Was Built

The attackers constructed their phishing infrastructure with precision, employing a two-pronged strategy: disguising phishing links using an IPv4-mapped IPv6 address format and creating meticulously crafted email lures. The email’s “From” field used a lookalike domain name closely resembling the legitimate Belfius Bank domain, increasing the likelihood of targets being deceived.


From: Belfius Bank &lt;support@belfius-security.com&gt;

Subject: Important Security Update for Your Account

To: [Recipient's Name]

Date: Wed, 20 Sep 2023 09:35:00 +0200

Reply-To: no-reply@belfius-security.com

The phishing emails contained a “security update” theme, urging recipients to click a link purportedly leading to the official Belfius Bank website. The link, disguised with an IPv4-mapped IPv6 address, looked like this:


http://[::ffff:192.0.2.128]/belfiusaccount-update

The payload was hosted on a compromised server running a phishing kit designed to mimic the bank’s login page. Victims were prompted to enter their usernames and passwords, which were then captured by the attacker’s server.

Why It Worked

The success of this campaign lay in several critical factors, each cleverly executed to maximize deceit and minimize detection. The leveraging of an IPv4-mapped IPv6 address allowed the phishing email to bypass some IPv4 protection measures, exploiting a less scrutinized domain range.

Additionally, the lure’s design adhered to common phishing paradigms while incorporating real-world security language. The urgent appeal of a “security update” creates an immediate call to action, exploiting common user behavior where anxiety leads to impulsive interactions.

The use of lookalike domains also played a significant role. By presenting a familiar interface and sender identity, the attackers capitalized on the “trust but verify” principle, knowing that most recipients would be inclined to trust communications from perceived recognized contacts.

Operator Takeaways

For red teamers and penetration testers, mimicking the structure and scale of this phishing campaign can yield insightful data during engagement tests. Experimenting with IPv4-mapped IPv6 technique can enhance the realism of phishing simulations, uncovering vulnerabilities in organizational handling of network traffic.

Crafting specific, tailored spearphishing lures that echo the target organization’s communication style can significantly increase engagement. Moreover, focusing on authenticity in appearance and language will improve click-through rates and capture potential blind spots in user awareness.

Do’s and Don’ts

Do leverage innovative network techniques such as IPv4-mapped IPv6 addressing to bypass common filtering systems.
Do conduct thorough research to ensure email lures use language and triggers that resonate with the target audience.
Don’t rely on generic templates. Tailor each campaign to mirror specific communication habits of the target organization to increase credibility.
Don’t overlook the reputation of your sending domains. Secure convincing domains and protect them using SPF and DKIM to pass authentication checks where applicable.

References

IPv4-Mapped IPv6 Address Use in Phishing

Advanced Phishing Techniques