eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address: A Current Campaign

The landscape of phishing evolves continuously as threat actors develop methods to bypass traditional security measures. A recent phishing campaign highlights the use of IPv4-mapped IPv6 addresses as a novel technique. This effort targeted a major Belgian bank, illustrating a sophisticated approach to deliver malicious content by circumventing email security protocols.

Campaign or TTP Overview

In September 2023, a series of phishing emails targeted customers of a prominent Belgian financial institution. These emails were part of a coordinated effort leveraging IPv4-mapped IPv6 addresses to obscure the source of the phishing attempts. The campaign has not been linked to a specific threat actor, but its sophisticated nature suggests involvement from highly skilled adversaries with a deep understanding of email security bypass techniques.

This campaign capitalized on the bank’s branding to convincingly masquerade the phishing emails as legitimate communications. By embedding phishing links in a realistic-looking online banking alert, the attackers aimed to trick victims into clicking through to a fraudulent website designed to steal their credentials.

How It Was Built

The infrastructure leveraged in this attack began with the crafting of emails that closely imitated those from the targeted bank. The attack utilized well-researched content and brand-specific logos to create a veneer of legitimacy. Each phishing email contained a carefully designed subject line such as “Important Update on Your Account Activity” or “Action Required: Verify Your Banking Information Immediately.”


Received: from unknown (HELO secure-banking.com)

    (0000:0000:0000:0000:0000:0000:192.0.2.128) 

    by victim-domain.com with SMTP; Wed, 6 Sep 2023 10:35:19 +0200

The most striking feature of this campaign was the use of IPv4-mapped IPv6 addresses. These addresses appeared formatted akin to IPv6 but were simply mapped to an original IPv4 address. This tactic aimed to confuse traditional email security systems that might not apply the same scrutiny to IPv6 addresses as they do their IPv4 counterparts. The attackers utilized open relay mail servers to dispatch these messages, further obscuring their origin.

The embedded phishing links redirected recipients to a meticulously fabricated website bearing a resemblance to the bank’s official online portal. The site featured a login prompt where victims were prompted to enter their personal banking credentials. Once entered, these details were sent to the attackers while presenting an error message that suggested the credentials were incorrect, prompting the users to try again with the correct info.

Why It Worked

An attack’s success often hinges on its ability to seamlessly mimic trusted communications and exploit overlooked technical vectors.

One key element was leveraging IPv4-mapped IPv6 addresses, a technical nuance that many email filters aren’t optimized to scrutinize. This allowed for an effective bypass of common email security measures, increasing the reach and effectiveness of the campaign.

The choice of subject lines and sender display names, such as “notifications@secure-banking.com”, was intended to inspire urgency and trust while borrowing legitimacy from the target’s branding. The illusion of authenticity was strengthened by using phishing sites that replicated the bank’s user interface down to the smallest detail, lowering the victims’ guard and increasing the likelihood of credential submissions.

Operator Takeaways

For red teamers looking to learn from this, consider how this campaign blended technical exploitation with social engineering finesse. By integrating legitimate branding with technically astute delivery methods, it evaded detection and prompted action from the targets. Emulating such precision in crafting and delivering phishing scenarios can enhance the realism of simulation exercises.

Good / Better / Best

Good: Employ basic phishing templates but adapt them with realistic branding.

Better: Use domain spoofing to add legitimacy but also explore advanced delivery techniques like IPv4-mapped IPv6 for bypassing security structures.

Best: Seamlessly combine advanced technical layers with persuasive, brand-integrated social engineering methods to ensure high success in phishing simulations.

References

SANS Internet Storm Center: Diary Archive

Phishing via IPv6: A New Threat Vector