45% of Malware C2 Traffic Bypasses DNS by Connecting Directly to IP Addresses
Many defensive systems monitor domain name queries as their primary window into outbound malicious activity – but malware families are increasingly circumventing this approach by communicating with command-and-control servers directly over raw IP addresses, leaving DNS filters with nothing to intercept.
As detailed in Unit 42’s analysis of malware bypassing DNS through direct-to-IP C2 connections, 45% of malware samples that communicated with command-and-control infrastructure did so through at least one direct IP connection that bypassed DNS resolution entirely.
Scale of the Finding
Unit 42 analysts examined more than four million dynamic analysis reports collected over a 30-day window. Approximately 20% of the malware samples in that dataset exhibited active command-and-control communication. Of those, nearly half contacted at least one IP address without issuing a preceding DNS query. These direct-to-IP connections accounted for roughly 23% of all observed C2 communication attempts.
Why Direct-to-IP Connections Evade Detection
In a conventional outbound connection, a program first queries a DNS resolver to translate a domain name into an IP address. Security services can intercept that query, cross-reference the domain against threat intelligence feeds, and block the connection before it is ever established. The domain name itself provides context – a recognizable artifact that detection systems can evaluate.
When malware hardcodes a server’s IP address directly into its binary, no DNS query is ever generated. DNS-based filters receive no signal. There is no domain to evaluate, no lookup to log, and no opportunity to block based on domain reputation.
Real-World Examples: Phorpiex and Mozi
The Phorpiex loader exemplifies this technique cleanly. The malware contacted its C2 server directly by IP to retrieve configuration data and fetch additional payloads – including ransomware – without ever touching the DNS layer. Devices compromised by the Mozi botnet operated similarly, downloading malicious files from hardcoded IP addresses and propagating throughout the botnet without generating a single domain resolution request.
The Trade-Off: Domains vs. Raw IPs
Domain-based infrastructure generally offers operational advantages over raw IP addresses. Domain names allow operators to migrate servers between hosting providers, distribute load, and replace blacklisted nodes without modifying the malware’s configuration – the domain simply resolves to a new address. They also provide better cover, as threat actors can register domains designed to superficially resemble legitimate services.
However, domain-based C2 infrastructure carries a meaningful risk: blocking a single domain can simultaneously cut off a large fraction of an active infection’s command channel. Direct-to-IP connections trade the flexibility of domains for a different resilience property – they are simply invisible to any defensive layer that operates exclusively at the DNS level.
Active Campaigns: Data Theft and SectopRAT
Unit 42 also identified a data exfiltration campaign exploiting non-standard GET requests. The malware transmitted encoded victim data to cloud infrastructure hosted in Brazil, rotating destination addresses and ports on a regular cadence. The campaign affected government agencies, airlines, and universities.
Two separate threat actors deployed SectopRAT against educational institutions during the same observation period. The RAT exfiltrated visited URLs, single sign-on redirect tokens, and credentials harvested from web forms. All communication traveled directly to IP addresses, entirely outside the visibility of DNS-based detection.
The ZT-IP Detection Approach
To surface these connections, Unit 42 evaluated the Zero-Trust IP (ZT-IP) methodology. Under this framework, a firewall permits an outbound connection only if a trusted DNS service has recently resolved and confirmed the destination address. Direct connections to IP addresses with no corresponding recent DNS resolution are flagged as anomalous and blocked by default, with explicit carve-outs for trusted protocols and internal network segments.
Recommendations for Defenders
Organizations should expand their monitoring posture beyond DNS query logs to include direct outbound connections. Outbound access to unconfirmed IP addresses should be restricted by policy, with documented exceptions for legitimate services that operate without DNS by design.
This control is particularly valuable in environments containing IoT devices and operational technology equipment, where installing a traditional endpoint security agent is often impractical or impossible. In those networks, network-level enforcement is frequently the only viable detection layer.
Security architectures built around a single expected traffic pattern will inevitably carry blind spots. A resilient network must evaluate the trustworthiness of every outbound connection individually – not assume that traffic is safe simply because it failed to violate a familiar pattern.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
