IPFS: The New Hotbed of Phishing

guest · Jul 29, 2022

Researchers Warns of Increase in Phishing Attacks Using Decentralized IPFS Network
July 29, 2022

The decentralized file system solution known as IPFS is becoming the new "hotbed" for hosting phishing sites, researchers have warned.

Cybersecurity firm Trustwave SpiderLabs, which disclosed specifics of the attack campaigns, said it identified no less than 3,000 emails containing IPFS phishing URLs as an attack vector in the last three months.
Click to expand...

IPFS, short for InterPlanetary File System, is a peer-to-peer (P2P) network to store and share files and data using cryptographic hashes, instead of URLs or filenames, as is observed in a traditional client-server approach. Each hash forms the basis for a unique content identifier (CID).
Click to expand...

The idea is to create a resilient distributed file system that allows data to be stored across multiple computers. This would allow information to be accessed without having to rely on third parties such as cloud storage providers, effectively making it resistant to censorship.

"Taking down phishing content stored on IPFS can be difficult because even if it is removed in one node, it may still be available on other nodes," Trustwave researchers Karla Agregado and Katrina Udquin said in a report.
Click to expand...

Viewed in that light, the use of IPFS marks another evolution in phishing, giving attackers another lucrative playground to experiment with.

"Phishing techniques have taken a leap by utilizing the concept of decentralized cloud services using IPFS," the researchers concluded.
"The spammers can easily camouflage their activities by hosting their content in legitimate web hosting services or use multiple URL redirection techniques to help thwart scanners using URL reputation or automated URL analysis."
Click to expand...

SpiderLabs: IPFS: The New Hotbed of Phishing

A few months ago, we reported on an interesting site called the Chameleon Phishing Page. These websites have the capability to change their background and logo depending on the user’s domain. The phishing site is stored in IPFS (InterPlanetary File System) and after reviewing the URLs used by the attacker, we noticed an increasing number of phishing emails containing IPFS URLs as their payload.

We have observed more than 3,000 emails containing phishing URLs that have utilized IPFS for the past 90 days and it is evident that IPFS is increasingly becoming a popular platform for phishing websites.
Click to expand...

guest · Nov 9, 2022

Several Cyber Attacks Observed Leveraging IPFS Decentralized Network
By Ravie Lakshmanan - November 9, 2022

A number of phishing campaigns are leveraging the decentralized Interplanetary Filesystem (IPFS) network to host malware, phishing kit infrastructure, and facilitate other attacks.

"Multiple malware families are currently being hosted within IPFS and retrieved during the initial stages of malware attacks," Cisco Talos researcher Edmund Brumaghin said in an analysis shared with The Hacker News.
The research mirrors similar findings from Trustwave SpiderLabs in July 2022, which found more than 3,000 emails containing IPFS phishing URLs as an attack vector, calling IPFS the new "hotbed" for hosting phishing sites.
Click to expand...

IPFS as a technology is both resilient to censorship and takedowns, making it a double-edged sword. Underlying it is a peer-to-peer (P2P) network which replicates content across all participating nodes so that even if content is removed from one machine, requests for the resources can still be served via other systems.
Click to expand...

Furthermore, IPFS has been put to use to serve rogue landing pages as part of phishing campaigns orchestrated to steal credentials and distribute a wide range of malware comprising Agent Tesla, reverse shells, data wiper, and an information stealer called Hannabi Grabber.

In one malspam delivery chain detailed by Talos, an email purporting to be from a Turkish financial institution urged the recipient to open a ZIP file attachment that, when launched, worked as a downloader to retrieve an obfuscated version of Agent Tesla hosted within the IPFS network.

"We expect this activity to continue to increase as more threat actors recognize that IPFS can be used to facilitate bulletproof hosting, is resilient against content moderation and law enforcement activities, and introduces problems for organizations attempting to detect and defend against attacks that may leverage the IPFS network," Brumaghin said.
Click to expand...

Cisco Talos: Threat Spotlight: Cyber Criminal Adoption of IPFS for Phishing, Malware Campaigns

By Edmund Brumaghin - November 9, 2022

The InterPlanetary File System (IPFS) is an emerging Web3 technology that is currently seeing widespread abuse by threat actors.

Cisco Talos has observed multiple ongoing campaigns that leverage the IPFS network to host their malware payloads and phishing kit infrastructure while facilitating other attacks.

IPFS is often used for legitimate purposes, which makes it more difficult for security teams to differentiate between benign and malicious IPFS activity in their networks.

Multiple malware families are currently being hosted within IPFS and retrieved during the initial stages of malware attacks.

Organizations should become familiar with these new technologies and how they are being leveraged by threat actors to defend against new techniques that use them.

Click to expand...

Log in or Sign up

IPFS: The New Hotbed of Phishing

guest Guest

guest Guest

Log in or Sign up

IPFS: The New Hotbed of Phishing

guest Guest

guest Guest

Useful Searches