It was only a matter of time, as apparently attackers are increasingly using IPv6 to scan and attack networks.

IPv6 is the next-generation IP addressing scheme that has been set to be the successor to the widely used IPv4. With IPv4 there is a 32-bit addressing space, providing 4.3 billion addresses, while IPv6 has a 128-bit space, providing 340 trillion trillion trillion IP addresses (3.4 x 1038 ).

According to security firm Crowdsec, there has been a significant spike in IPv6 activity so far in 2023. The firm detailed its findings in a session outside of the Black Hat USA conference this week with ESG Research analyst Melinda Marks, and in a recent report.

Crowdsec is taking an open-source community-based approach to threat detection and has members that contribute threat data from around the world, providing a broad view of the current attack landscape.

"I'm 48 years old, and my network teacher told me like 23 years back, ‘you guys should be ready for IPv6’ and we were like — where is it?" CrowdSec CEO Philippe Humeau said. "But I can tell you now it's coming to fruition and it's coming to reality, because cybercriminals are on the rampage on this one."

Humeau said that in October 2022 only 10% of the IP addresses reported by the Crowdsec network as being related to malicious activity were from IPv6 addresses. By June 2023, the volume of IPv6 addresses doubled to 20%.

"A 100% rise in eight months is tremendous, it's massive," Humeau said. "So we think that IPv6 is now really being scanned and exploited by cybercriminal groups."

The growth of IPv6 usage for malicious purposes is not occurring in a vacuum. Google statistics shows an overall pattern of IPv6 growth across its user base.

While IPv6 is on the rise, another trend is going the other way.

Humeau said that he had expected to find that 40%–50% of attack traffic is hidden behind some kind of virtual private network (VPN). The reality in 2023 is, however, somewhat different. Only a paltry 5% of attack traffic is hidden behind a VPN or a proxy service.

"If you want to run a VPN, you have to use a credit card," he said. "So the blunt reality is that most of the attacks are not carried through VPN; only 5% of them. They'd rather run on servers that are compromised, or IoT devices that are compromised on the black market, rather than use those VPNs.”