INFO Threat Intel #C2 #Malware

Direct-to-IP Malware C2 Bypass: Threat Landscape and ZT‑IP Mitigation

2026-08-06 01:58 UTC 3 min read Runtime Rebel Intel

Primary source: unit42.paloaltonetworks.com

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Malware using direct-to-IP (D2IP) communications bypasses DNS defenses, exposing organizations to unseen C2 traffic.
Any networked host capable of outbound TCP/UDP connections, especially those targeted by families such as Phorpiex, can be compromised.
Implement zero trust IP (ZT‑IP) controls to validate outbound IP connections against prior DNS resolutions.

Overview

Recent research from Palo Alto Networks Unit 42 shows that 45.32% of malware samples with command‑and‑control (C2) activity connect directly to hard‑coded IP addresses, completely bypassing DNS resolution. This behavior, termed direct‑to‑IP (D2IP), accounts for 23.17% of all observed C2 connection attempts. Because the traffic contains no DNS query, traditional DNS‑based defenses—sinkholing, anomaly detection, and domain reputation—are ineffective.

How to Detect Direct-to-IP Malware Communications

The Unit 42 study analyzed over 4 million WildFire dynamic analysis reports in a 30‑day window. After filtering out legitimate services and internal addresses, the researchers found that:

20.11% of malware samples exhibited any C2 activity.
94.43% of those C2 connections used TCP, averaging 4.17 unique IPs per sample.
41.97% of samples still made at least one D2IP connection even when port‑scanning traffic was removed.
By contrast, only 1% of benign samples reached untrusted IPs, with an average of 1.6 such connections.

A notable example is the Phorpiex (aka Trik) family, which retrieves payloads from IP 178.16.54.109 without any DNS lookup. Another campaign uses a custom “\GET” protocol to exfiltrate data to IP 18.228.188.56, encoding payloads in 250‑666‑character strings.

Technical Analysis

Malware Engineering

Disassembly of samples (e.g., a binary containing the Unicode string wss://154.92.19[.]71:39989) reveals hard‑coded IP literals embedded directly in the executable. The lack of DNS resolution eliminates a key telemetry point for defenders. In the “\GET” protocol, the back‑slash prefix prevents standard HTTP parsers from flagging the request, allowing the payload to blend with benign traffic.

Infrastructure

The C2 servers are hosted on public cloud resources in Brazil, serving multiple threat actors and sectors—including government, airlines, and universities. Shared cloud infrastructure means that simple IP blocklists are quickly evaded as attackers spin up new instances.

Zero Trust IP (ZT‑IP) Enforcement

Unit 42 proposes zero trust IP (ZT‑IP): a network‑level policy that only permits outbound IP connections that have previously been authorized by a DNS response. In practice, ZT‑IP:

Correlates each outbound IP flow with a prior DNS query.
Flags any IP contact lacking such a query as suspicious.
Generates alerts that can be enriched with threat intelligence (e.g., known Phorpiex IPs).

Testing against real‑world traffic demonstrated that ZT‑IP surfaces D2IP activity that would otherwise slip past DNS‑centric controls.

Actionable Recommendations

Deploy ZT‑IP controls on perimeter and internal firewalls to enforce DNS‑validated outbound traffic.
Monitor for anomalous HTTP GET patterns, especially non‑standard prefixes like “\GET” and unusually long encoded strings.
Enrich IP blocklists with threat‑intel feeds that include known D2IP infrastructure (e.g., IPs associated with Phorpiex).
Implement host‑based outbound connection logging to capture raw IP contacts for retrospective analysis.
Educate SOC analysts on the limitations of DNS‑only detection and the importance of IP‑level telemetry.

By integrating ZT‑IP with existing DNS security stacks, organizations can close the blind spot exploited by direct‑to‑IP malware and reduce the risk of covert C2 channels.

Source: according to Unit 42.

#C2 #Malware

X/Twitter LinkedIn Reddit HN

← Back to Articles