Direct-to-IP Malware Traffic Bypasses DNS Defenses at Scale

Palo Alto Networks Unit 42 reported that a large share of malware command-and-control traffic is avoiding DNS-based detection by connecting directly to IP addresses. In an analysis of more than 4 million dynamic malware reports collected over 30 days, 20.11% of samples showed C2 activity, and 45.32% of those samples made at least one direct-to-IP connection. Those direct connections accounted for 23.17% of all observed C2 attempts, indicating that DNS-focused controls can miss a substantial portion of malicious outbound traffic.

The research linked this technique to multiple active threats, including Phorpiex ransomware droppers using hard-coded IP infrastructure, an obfuscated \GET data-exfiltration campaign hosted on Brazilian public cloud infrastructure, SectopRAT activity targeting educational institutions, and IoT botnets such as Mozi and a Mirai variant known as Boatnet. Unit 42 said the findings support a Zero Trust IP enforcement model that permits outbound connections only to IP addresses previously validated through trusted DNS resolution, aiming to close a visibility gap exploited by malware that communicates outside normal domain-based controls.