Obfuscating IP Addresses in Phishing Attacks: Recent Campaign Trends

The evolving landscape of security threats saw a notable uptick in phishing campaigns where attackers obfuscate IP addresses as hostnames. This technique is gaining traction for its effectiveness in exploiting Server Side Request Forgery (SSRF) vulnerabilities, allowing attackers to bypass security filters and elude detection mechanisms. Recent intelligence highlights how sophisticated threat actors have incorporated this tactic into their arsenal, particularly targeting organizations with vulnerable web applications.

A particular campaign making waves was documented by the SANS Internet Storm Center, where attackers leveraged obfuscated IP addresses to conduct phishing attacks that infiltrated corporate networks. The campaign specifically targeted enterprises known for using legacy systems without robust SSRF protections. Although attribution remains elusive, the campaign reflects a growing trend among financially motivated groups and hacktivists exploitating such vulnerabilities for data exfiltration and potential network breaches.

How It Was Built

The malicious actors behind this recent campaign structured their attacks meticulously, beginning with the meticulous crafting of obfuscated IPs. By transforming numeric IP addresses into ostensibly benign hostnames, they easily circumvented conventional filter mechanisms.

The delivery mechanism entailed phishing emails with subject lines like “Critical: Immediate Action Required for Server Security”, aimed at IT personnel who manage web infrastructures. These emails were often sent from plausible-sounding domains, mimicking genuine tech service providers with addresses such as server-update[at]system-supports.com.

Subject: Critical: Immediate Action Required for Server Security

From: server-update@system-supports.com

To: [TARGET EMAIL]

Content: 

Dear [Recipient Name],

We have detected an urgent security vulnerability affecting your server. It is imperative that you verify server status using the following secure link:

http://[obfuscated IP]:8080/secure-check

Failure to act may result in severe disruption of services.

Best Regards,

Security Team

The links, when clicked, directed users to a spoofed login page capable of capturing credentials in real-time. The URL included obfuscated IP addresses cleverly hidden within an HTTP request to mitigate detection by proxy or domain reputation services. This approach ensured that user queries to the IP were direct and bypassed internal filtering mechanisms that commonly assess domain legitimacy rather than IP authenticity.

Why It Worked

The success of this campaign stemmed from several calculated decisions:

Obfuscated IPs effectively bypass filters: By transforming IP numerical values into hostnames, the attackers evaded regular expression filters and security tools that scrutinize known malicious IPs. The legitimate-like hostnames passed initial security inspections unnoticed.

Plausible sender identities and urgent language: Impersonating tech support personnel with a veneer of authority and urgency pushed recipients to act without hesitating critically. The compelling narrative invoked a sense of immediacy crucial for overcoming initial suspicion.

Targeted SSRF exploitation: The crafted requests and payloads specifically capitalized on SSRF vulnerabilities prevalent in older and poorly configured systems. This technical insight into exploiting specific vulnerabilities underscored the attackers’ thorough reconnaissance process.

Operator Takeaways

For red team operators looking to enhance their phishing engagements, this campaign offers several critical takeaways:

Develop advanced obfuscation techniques: Learn techniques for IP obfuscation using hexadecimal, octal, or DNS resolution trickery to see what evades detection most effectively.

Know your targets intimately: Detailed reconnaissance into target systems, especially one’s potential SSRF vulnerabilities, can inform how to best structure your payloads and obfuscations for maximum effect.

Craft authentic sender profiles: Construct sender personas aligning closely with the organization’s actual or perceived interdepartmental communications to improve trust in your delivery mechanism.

Good / Better / Best

In executing phishing campaigns, quality determines yield. Here’s how to approach using this technique:

Good: Employ basic IP obfuscation methods, such as hex encoding, to evade detection from simplistic filters. Use generic sender domains with some level of fictitious authority.

Better: Incorporate valid DNS entries that translate to IPs while mimicking the target organization’s vendor partners. Dig deeper with custom domain names that resonate with your target’s specific operational lexicon.

Best: Customize hostnames fully aligned with the organization’s operational context. Deploy spear-phishing techniques that leverage personal and professional information gleaned from open sources to tailor the attack on an individual level.

References

SANS Internet Storm Center

How SSRF Attacks Exploit Trusting Servers