Loading story…
Palo Alto Networks Unit 42 reported that a large share of malware command-and-control traffic is avoiding DNS-based detection by connecting directly to IP addresses. In an analysis of more than 4 million dynamic malware reports collected over 30 days, 20.11% of samples showed C2 activity, and 45.32% of those samples made at least one direct-to-IP connection. Those direct connections accounted for 23.17% of all observed C2 attempts, indicating that DNS-focused controls can miss a substantial portion of malicious outbound traffic.
The research linked this technique to multiple active threats, including Phorpiex ransomware droppers using hard-coded IP infrastructure, an obfuscated \GET data-exfiltration campaign hosted on Brazilian public cloud infrastructure, SectopRAT activity targeting educational institutions, and IoT botnets such as Mozi and a Mirai variant known as Boatnet. Unit 42 said the findings support a Zero Trust IP enforcement model that permits outbound connections only to IP addresses previously validated through trusted DNS resolution, aiming to close a visibility gap exploited by malware that communicates outside normal domain-based controls.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
The report described two separate attackers operating SectopRAT infrastructure at 87.120.107[.]33 and 194.76.227[.]94 against educational institutions. SectopRAT mirrored victim browser traffic in real time and used the /churl and /fsave endpoints to exfiltrate visited URLs, session content, usernames, and plaintext passwords.
Unit 42 identified a persistent data exfiltration campaign using a non-standard obfuscated HTTP request format beginning with "\GET" and carrying encoded payloads. The infrastructure was hosted on public cloud infrastructure in Brazil, rotated ports and IPs regularly, and samples were found affecting government, airline, and university sectors.
The analysis identified suspicious HTTP GET requests to 178.16.54[.]109 tied to Phorpiex/Trik activity, including retrieval of a malware binary from hxxp://178.16.54[.]109/st.exe. Unit 42 said the IP hosted multiple malicious samples used in staged payload delivery, including configuration fetching and later ransomware-related components.
Unit 42 published analysis of more than 4 million Advanced WildFire dynamic analysis reports collected over a 30-day period, finding that 20.11% of malware samples showed C2 activity and that 45.32% of those made at least one direct-to-IP connection without a preceding DNS query. The report concluded that DNS-focused defenses miss a substantial share of malicious outbound traffic and proposed Zero Trust IP enforcement to block unsanctioned IP destinations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Malware operators are increasingly using **TLS/HTTPS** to conceal command-and-control, payload delivery, and data exfiltration traffic, with one report finding TLS-backed malware rising from **23%** of Internet-communicating malware in 2020 to nearly **46%** in early 2021. Researchers said attackers are blending into normal encrypted traffic by abusing trusted platforms and services including **Google**, **Discord**, **Pastebin**, **GitHub**, and **Telegram**, while loaders, droppers, ransomware affiliates, and offensive tools such as **Cobalt Strike** and **Metasploit** increasingly rely on encrypted channels. Malware also frequently uses TLS on non-standard ports, reducing the value of simple port-based detection. A separate analysis of **264 malware families** found most SSL/TLS-protected malware communications used **HTTPS**, while others used **SMTP** and custom TCP protocols, and that many families relied on **self-signed certificates** or reused anomalous X.509 attributes that can expose malicious infrastructure. Researchers identified unusual subject names, abnormal serial-number lengths, invalid version fields, and suspicious validity periods as useful detection signals, while noting that some families such as **IcedID**, **AsyncRAT**, **DcRAT**, **Vawtrak**, and **PhantomNet** use certificate pinning to resist interception. The findings also show that attackers often deploy valid certificates from trusted authorities, especially **Let’s Encrypt**, underscoring that certificate metadata and anomaly-based inspection remain important for detecting encrypted malware traffic.
Aug 15, 2026
Security researchers reported that residential proxy networks are increasingly being used to route malicious traffic through legitimate home internet connections, helping attackers evade IP reputation controls while making abuse appear to come from ordinary consumers and organizations. Infoblox said more than **65%** of its cloud customers queried domains tied to residential proxy services in 2026, with monthly DNS traffic rising from roughly **300–400 billion** queries in early 2025 to more than **500 billion** by April 2026, affecting every industry vertical examined, including healthcare, pharmaceuticals, banking, government, electronics, food and beverage, and industrial sectors. The company also observed no meaningful drop after disruption efforts against **IPIDEA**, and recorded a **265%** single-day spike in queries to `ipinfo[.]ipidea[.]io` on January 23. Separate telemetry from Gen Digital linked residential proxy traffic to **7.4 million** malicious incidents affecting **572,000** users since January 2026, with notable concentration in India, Vietnam, and Brazil. Researchers said devices are often enrolled through pay-for-bandwidth apps, free VPNs, browser extensions, bundled SDKs, preinstalled Android TV software, IoT devices, malware, and potentially unwanted applications, sometimes without clear user consent. The reports warn that these networks are being used for phishing, credential stuffing, account takeover, ad fraud, scams, scraping, and reconnaissance, while shifting legal, reputational, and performance risks onto households and enterprises whose IP addresses become exit nodes. Recommended mitigations include **Protective DNS**, DNS log reviews, auditing apps and browser extensions for embedded proxy components, inspecting connected devices, and removing unknown or suspicious software.
Jul 9, 2026
Multiple malware campaigns delivered remote access trojans including **NanoCore**, **NetWire**, **AsyncRAT**, **Quasar RAT**, and **PlugX** through phishing lures and staged payloads behind legitimate-looking files. Cisco Talos reported a campaign that used malicious ZIP archives containing ISO images and heavily obfuscated JavaScript, batch, or VBScript loaders to fetch additional malware from **Microsoft Azure** and **Amazon Web Services**, while **DuckDNS** domains supported delivery and command-and-control. Fortinet separately documented travel-themed lures such as itinerary and booking files that pushed **AsyncRAT** and **NetWire**, often requiring victims to manually launch executables hidden inside ZIP or ISO containers; the use of ISO files helped bypass **Mark-of-the-Web** protections and reduced security scrutiny. Fortinet also linked a separate espionage operation attributed to **APT10** to DLL side-loading with the legitimate Java component `jjs.exe`, loading a malicious `jli.dll`, decrypting `svchost.bin`, and injecting shellcode into `svchost.exe` to deploy **PlugX** and a modified **Quasar RAT**. That activity used persistence via a service or a Run key named **"Windows Updata"**, and relied on typosquatted infrastructure such as `update.microsofts.org`, `update.kaspresksy.com`, and `cahe.microsofts.org`. CISA has also tracked **Quasar** as an open-source remote administration tool, underscoring how both commodity and state-linked actors continue to rely on RAT malware, cloud-hosted staging, dynamic DNS, and deceptive attachment formats to gain and maintain access.
Aug 15, 2026