Malware Bypasses DNS via Direct-to-IP C2

Executive Summary

Research from Palo Alto Networks' Unit 42 reveals a prevalent and dangerous evasion technique used by modern malware. An analysis of over 4 million malware samples from Advanced WildFire found that nearly half (45.32%) of samples with command-and-control (C2) activity communicate directly with hard-coded IP addresses. This direct-to-IP (D2IP) method completely bypasses DNS resolution, rendering a wide array of common security tools—including DNS filtering, protective sinkholing, and anomaly detection—blind to the malicious traffic. This behavior was observed across various threat types, from ransomware droppers to botnets like Phorpiex and RATs like SectopRAT. To counter this, Unit 42 proposes a "Zero Trust IP" (ZT-IP) approach, which treats any outbound IP connection not preceded by a valid internal DNS query as untrusted and subject to blocking.

Threat Overview

DNS security is a cornerstone of modern network defense. However, its effectiveness hinges on the assumption that malware will use DNS to resolve C2 domains. The Unit 42 study demonstrates this assumption is dangerously flawed. By hard-coding IP addresses directly into the malware binary, attackers create a covert communication channel that is invisible to DNS-level monitoring.

The scale of this issue is significant. Key findings from the 30-day study include:

• 45.32% of malware samples with C2 activity made at least one D2IP connection.
• 23.17% of all observed C2 connection attempts were D2IP.
• Malware using D2IP includes prominent families like Phorpiex (a dropper and spam botnet) and SectopRAT (a tool for browser traffic interception).
• In contrast, only 1% of benign software samples exhibited similar behavior, making D2IP a high-fidelity indicator of malicious activity.

This technique is not theoretical; it is actively used in the wild to exfiltrate data, drop additional payloads, and maintain persistence while evading detection.

Technical Analysis

The core of the D2IP technique is simple: the malware developer embeds the C2 server's IP address as a string within the executable file. When the malware runs, it initiates a TCP or UDP connection directly to this IP, with no need to perform a DNS lookup. Analysis with tools like Ghidra confirmed hard-coded IP addresses in numerous samples.

Unit 42 researchers also identified more sophisticated variations:

• Obfuscated Protocols: One campaign used a non-standard \GET protocol. Instead of a standard GET /path HTTP/1.1, the malware sent requests starting with \GET, followed by a long encoded string. This was designed to evade pattern-matching intrusion detection systems.
• Infrastructure Rotation: To defeat static IP blocking, some malware families rotate both their C2 IP addresses and destination ports on a regular schedule, requiring a more dynamic defense.
• Browser Proxying: SectopRAT was observed using D2IP connections to establish a silent proxy, relaying all of the victim's browser traffic to an attacker-controlled server via endpoints like /churl. This allows for the theft of credentials, session cookies, and sensitive data in real-time.

MITRE ATT&CK Techniques

• T1071.001 - Application Layer Protocol: Web Protocols: Malware uses HTTP/S-like traffic for C2, but to a hard-coded IP address.
• T1571 - Non-Standard Port: The backdoor using wss://154.92.19[.]71:39989 communicates over a non-standard port to evade port-based firewall rules.
• T1105 - Ingress Tool Transfer: Phorpiex uses D2IP to connect to 178.16.54[.]109 and download additional malicious executables like st.exe.
• T1090.002 - Proxy: External Proxy: SectopRAT establishes an external proxy to exfiltrate all browser traffic.

Impact Assessment

The widespread use of D2IP has severe implications for enterprise security:

• Evasion of Core Defenses: Any security strategy that heavily relies on DNS logs for threat hunting or DNS filtering for blocking is rendered ineffective against these threats.
• Creation of a Network Blind Spot: D2IP traffic appears as generic IP-based connections, lacking the context of a domain name. This makes it difficult for security analysts to triage alerts or understand the nature of the communication without deeper packet inspection.
• Ineffectiveness of IP Blocklists: While blocking known-bad IPs is useful, attackers using D2IP often leverage public cloud infrastructure or rotate IPs frequently, making static blocklists a perpetually losing game.

This research forces a re-evaluation of network security monitoring, pushing beyond DNS to a more fundamental analysis of IP traffic flows.

IOCs — Directly from Articles

Cyber Observables — Hunting Hints

The following patterns may help identify D2IP activity:

Detection & Response

The most effective strategy is to adopt the Zero Trust IP (ZT-IP) model proposed in the article.

1. Implement ZT-IP: Configure network monitoring and firewall policies to correlate outbound IP connections with DNS logs. Any connection attempt from an endpoint to an external IP that was not first resolved via an approved internal DNS server should be flagged as suspicious and potentially blocked.
2. Network Flow Analysis: Collect and analyze network flow data (e.g., NetFlow, IPFIX, sFlow). Create baselines for normal traffic and write queries to hunt for connections that fit the D2IP profile (e.g., destination_ip NOT IN (dns_resolved_ips)).
3. Endpoint Detection and Response (EDR): Deploy EDR agents to monitor process execution and network connections at the source. An EDR can detect a process like word.exe making a direct connection to an IP in China, which is highly anomalous.

D3FEND Techniques

• D3-NTA: Network Traffic Analysis: This is the foundational technique for ZT-IP, involving the analysis of traffic flows to identify connections without DNS context.
• D3-OTF: Outbound Traffic Filtering: The enforcement component of ZT-IP, where egress firewalls are configured to block unauthorized D2IP connections.

Mitigation

Defending against D2IP requires moving beyond DNS and implementing controls at the network and endpoint layers.

1. Egress Traffic Filtering (ZT-IP Enforcement): The primary mitigation is to configure perimeter firewalls to enforce a ZT-IP policy. The default rule should be to deny all outbound traffic. Explicit rules should only allow traffic to destinations that have been vetted, such as through a recent DNS query. This is a powerful but advanced technique that requires careful implementation to avoid breaking legitimate applications.
2. Proxy All Outbound Traffic: Force all user and server traffic through an explicit forward proxy that inspects and logs all connections. This centralizes control and prevents applications from making arbitrary connections to the internet.
3. Endpoint Hardening: Use application control solutions to prevent unauthorized executables from running in the first place. This stops the malware before it can even attempt a C2 connection.
4. Network Segmentation: Segment networks to prevent compromised systems from connecting to the internet directly. Force traffic from critical server segments through more heavily monitored and restricted network choke points.