eBanking Phishing Campaign Using IPv4-Mapped IPv6: New Developments

In a recent phishing campaign targeting a well-known Belgian bank, threat actors leveraged a novel technique utilizing IPv4-mapped IPv6 addresses to bypass network defenses. This campaign, detected in late 2023, exhibits how attackers continually innovate in exploiting communication protocols to evade traditional security measures designed to detect and block deceptive emails.

This campaign specifically targeted online banking customers, aiming to harvest their credentials through a combination of cleverly crafted phishing emails and an unorthodox network address spoofing strategy. The attackers remain unidentified, but the observations noted by the SANS Internet Storm Center detail the sophistication of the approach, setting a new precedent for tactics in phishing operations.

How It Was Built

The infrastructure setup for this campaign involved the abuse of IPv4-mapped IPv6 addresses. These are a subset of IPv6 addresses (,e.g., ::ffff:192.0.2.128, designed to represent IPv4 nodes within an IPv6 network, providing a means to seamlessly continue using IPv4 devices and services within an IPv6-only network. This network configuration was a critical choice, allowing the attackers to obscure their IP addresses’ origins and complicate traditional blacklist measures that might block suspicious IPv4 patterns.


Received: from mail.belgianbank.com (::ffff:192.0.2.128) 

by mx.yourdomain.com with SMTP id abc123;

Mon, 25 Sep 2023 12:34:56 +0000

The attack delivery mechanism used spoofed emails appearing as internal communications from the targeted bank, complete with authentic branding and sender details like alerts@belgianbank.com. Subject lines such as “Security Update: Action Required” created an immediate sense of urgency.

The payload involved a credential-harvesting web page, meticulously designed to mimic the bank’s legitimate online banking portal. Once the target clicked the email link, they were redirected to a highly convincing site capturing their login details.


https://secure-banking.be/check-auth.zxc/login.html

Why It Worked

The success of this campaign can be attributed to several tactical choices:

Camouflaged Network Traffic: By using IPv4-mapped IPv6 addresses, the attackers circumvented IP filtering techniques commonly employed by banks to prevent phishing. This unexpected protocol use effectively concealed the malicious intent of incoming traffic.
Authentic Sender Details: The use of domain-specific sender identities and branded content lent a false legitimacy that facilitated higher trust and lower suspicion from the recipients.
Precise Imitation of the Banking Interface: Accurate visuals and usability alignment with the bank’s actual online portal increased the likelihood of victims entering their credentials.

Operator Takeaways

Red teamers can learn from this campaign by integrating similar innovative approaches into phishing simulations. Experiment with using lesser-known technical vectors, like protocol exploitation, to challenge organizational defensive postures. Additionally, focus on the quality of email replica content and closely imitate victim-facing interfaces for high-conviction authenticity.

Do’s and Don’ts

Do: Invest time in understanding the nuances of communication protocols. Innovate beyond common phishing techniques.
Don’t: Rely solely on simple IP or domain spoofing. Modern defenses are adept at detecting these tactics.
Do: Craft emails with genuine brand elements and personable language to enhance credibility.
Don’t: Cut corners on replica site design. Ensure that mimicked interfaces function like the real thing to avoid arousing suspicion.

References

SANS Internet Storm Center: New Phishing Campaign Analysis