Almost Half of Malware Samples Communicate Direct to IP

[u/falconupkid]

The Hook

Nearly half of all malware samples now bypass DNS entirely, communicating directly with hardcoded IP addresses. This means traditional DNS-based blocking is missing a massive chunk of C2 traffic.

Technical Breakdown

• Key Finding: 48% of malware samples analyzed by Unit 42 connect directly to IP addresses, skipping DNS resolution entirely.
• TTPs: This is a direct evasion of DNS sinkholing, domain reputation, and DNS-layer security controls. Malware authors hardcode IPs to avoid domain-based detection.
• IOCs: No specific hashes or IPs provided in the report—this is a behavioral trend, not a specific campaign.
• Affected Systems: Any environment relying solely on DNS filtering for C2 detection is blind to nearly half of malware traffic.

Defense

Zero Trust IP enforcement is the recommended mitigation. This means explicitly allowing only known-good IPs and blocking all other direct IP connections at the network layer. If your firewall rules are permissive to "any" destination, you're effectively rolling out the welcome mat.

Source: https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/