> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Almost Half of Malware Samples Communicate Direct to IP - URL: https://f4n6.co.uk/security-feed/almost-half-of-malware-samples-communicate-direct-to-ip/ - Published: 2026-08-04T15:21:48.000Z - Updated: 2026-08-04T15:21:48.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Unit 42 analysis of over 4 million dynamic analysis reports reveals that 45.32% of malware samples with C2 activity make at least one direct-to-IP (D2IP) connection, bypassing DNS entirely and rendering DNS-based security controls — protective DNS, DNS sinkholing, DNS anomaly detection — ineffective against nearly half of C2 traffic. The dataset covers a 30-day window and spans ransomware droppers (Phorpiex), P2P botnets (Mozi targeting IoT), and a persistent data-exfiltration campaign using custom obfuscated HTTP GET requests. For EMEA financial services, the bottom-line risk is that egress filtering and DNS monitoring alone leave a visibility gap that active malware campaigns are already exploiting at scale. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. The advisory describes a systemic defensive visibility gap and threat-landscape trend, not a specific incident at a regulated entity. General ICT risk management and testing obligations (e.g. DORA Art. 17, Art. 24) are always in scope for financial entities, but no distinctive fact in this item changes what a client must *do* under a specific article beyond routine security posture maintenance. ## 3\. Technical analysis & attack chain **Dataset and methodology.** Unit 42 analysed over 4 million Palo Alto Networks Advanced WildFire dynamic analysis reports across a 30-day period. After filtering out connections to common legitimate services, internal addresses, and DNS resolvers, 20.11% of malware samples exhibited C2 activity. By contrast, only 1% of benign samples established connections to untrusted IP addresses under the same filtering criteria, averaging 1.6 such connections per sample. **D2IP prevalence.** Of malware samples with any C2 activity, 45.32% made at least one direct-to-IP connection — a raw IP contact with no preceding DNS query. Even after excluding bulk port-scanning behaviour, the figure remains 41.97%. As a fraction of all C2 connection attempts, D2IP traffic accounts for 23.17%. **Protocol breakdown.** TCP dominates at 94.43% prevalence, averaging 4.17 unique C2 IP addresses per sample. UDP is present in 17.50% of cases but contacts far more IPs per sample (average 13.79), consistent with scanning and P2P mesh behaviour. **How D2IP bypasses DNS-based defences.** Malware with hard-coded IP addresses skips DNS resolution entirely. Unit 42 demonstrated this with a backdoor sample that made no DNS query before initiating a WebSocket connection directly to `wss://154.92.19[.]71:39989`. Ghidra disassembly confirmed the destination was a hard-coded Unicode string in the binary. Without a DNS resolution step, the connection is invisible to DNS-based security controls, protective DNS sinkholing, and DNS anomaly detection — it appears as raw IP traffic with no prior context. **Threats surfaced through ZT-IP analysis.** Unit 42 identified three campaign types by searching for D2IP connections: 1. **Phorpiex ransomware dropper** — connected directly to C2 IP addresses with no DNS preceding the connection. Phorpiex is a well-known botnet/family with established public reporting; no MITRE ATT&CK profile was resolved in the verified reference data for this item, so campaign-level attribution beyond the family name is unconfirmed. 2. **Persistent data exfiltration campaign** — used a custom obfuscated HTTP GET request over a direct IP connection. No further technical detail on the obfuscation method, encoding, or exfiltrated data type was provided in the source. 3. **Mozi P2P botnet** — payloads delivered to IoT devices without DNS. Mozi is a known P2P botnet; attribution is consistent with established public reporting but no MITRE profile was resolved in the verified reference data. **Zero Trust IP (ZT-IP) concept.** Unit 42 introduces ZT-IP as a network-level enforcement approach applying zero trust principles to IP-based traffic. The method verifies whether outbound connection destinations were ever sanctioned by a DNS response — i.e., if an outbound IP connection has no corresponding DNS resolution in recent history, it is flagged. This is a detection/enforcement methodology, not a product feature set. *Confidence caveat:* All statistics and threat observations in this advisory are single-sourced (Unit 42 / Palo Alto Networks). The 4-million-sample dataset is proprietary to Advanced WildFire. Verify against your own telemetry before enforcement decisions. ## 4\. Mitigation & containment ### P1 — Within 24 hours: Assess D2IP exposure - Query egress firewall, proxy, and network telemetry for outbound connections to IP addresses (not FQDNs) on non-standard ports. Baseline the volume and identify outliers. - If DNS logging is in place, cross-reference outbound IP connections against DNS resolver logs to identify connections with no preceding DNS resolution for the destination IP. This is the core ZT-IP detection logic. - Block the single hard-coded IOC identified in the source: `154.92.19[.]71` (associated with backdoor WebSocket C2 on port 39989). ### P2 — Within 72 hours: Implement ZT-IP enforcement - Deploy or configure egress filtering that denies outbound connections to IP addresses that have no corresponding DNS resolution record within a defined time window. This enforces the ZT-IP principle operationally. - Ensure EDR or network detection covers raw TCP/UDP outbound to non-sanctioned IPs, not just domain-based indicators. TCP C2 averages 4.17 unique IPs per sample; UDP C2 averages 13.79 — rules must account for multi-IP fan-out. - Review IoT device egress paths. Mozi payloads target IoT devices via D2IP; ensure IoT segments are isolated and have no direct internet egress. ### P3 — Within 7 days: Architectural hardening - Implement default-deny egress with explicit allow-listing of sanctioned IP ranges and domains. Only 1% of benign samples contact untrusted IPs (averaging 1.6 connections) — the false-positive surface for IP-based egress enforcement is low. - Integrate DNS response logging with SIEM/network flow records to build an automated ZT-IP detection pipeline: alert on any outbound IP connection lacking a correlated DNS sanction event. - Validate that protective DNS and DNS sinkholing are not the sole C2 disruption control — supplement with IP-based threat intelligence feeds and network-level behavioural detection. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | ---- | ------------------------- | ------------------------------------- | ------- | | ipv4 | 154.92.19\[.\]71 | Medium — single sample, single source | Unit 42 | | port | 39989 (WebSocket C2, TCP) | Medium — associated with above IP | Unit 42 | ```iocs ipv4 154.92.19[.]71 port 39989 ``` ### Behavioural indicators | Behaviour | Where to observe | Confidence | | -------------------------------------------------------------------------------------- | --------------------------------------------------------- | ----------------------- | | Outbound TCP/UDP connection to raw IP with no preceding DNS query for that destination | Network flow logs cross-referenced with DNS resolver logs | High | | WebSocket connection initiated directly to IP:port without DNS resolution | EDR network telemetry, proxy logs, NGFW session logs | High | | Multiple unique C2 IP contacts per sample (TCP avg 4.17, UDP avg 13.79) | Network flow logs, sandbox dynamic analysis reports | Medium — single-sourced | | Obfuscated HTTP GET request to direct IP address | Network IDS/IPS, web proxy logs | Medium — single-sourced | ## 6\. Detection ```yara rule Backdoor_D2IP_WebSocket_C2 { meta: author = "Adverse Trace" date = "2026-08-04" reference = "https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/" description = "Detects backdoor with hard-coded WebSocket C2 IP address as Unicode string" strings: $ip_unicode = "1\x005\x004\x00.\x009\x002\x00.\x001\x009\x00.\x007\x001\x00" ascii wide $ws_scheme = "wss://" wide ascii $port = ":39989" wide ascii condition: $ip_unicode and $ws_scheme and $port } ``` ```yaml title: Outbound Connection to Raw IP Without Preceding DNS Resolution id: 7a3c1f2e-8b4d-4e6a-9c5f-1d2e3f4a5b6c status: experimental description: > Detects outbound TCP/UDP connections to IP addresses where no DNS query for that destination was observed in the preceding time window. Based on Unit 42 ZT-IP analysis showing 45.32% of malware C2 bypasses DNS. author: Adverse Trace date: 2026/08/04 references: - https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/ logsource: product: zeek service: conn detection: selection_direct_ip: dst_ip|cidr: - "0.0.0.0/0" filter_private: dst_ip|cidr: - "10.0.0.0/8" - "172.16.0.0/12" - "192.168.0.0/16" - "127.0.0.0/8" filter_dns_resolver: dst_port: 53 condition: selection_direct_ip and not filter_private and not filter_dns_resolver # Note: This rule requires correlation with DNS logs to confirm no # preceding DNS resolution for the destination IP. Deploy as a # correlation rule in SIEM combining Zeek conn + dns logs. falsepositives: - Legitimate applications with hard-coded IP endpoints - CDN direct connections - Internal infrastructure accessed by IP level: medium ``` ## 7\. Sources - Palo Alto Networks Unit 42, "Almost Half of Malware Samples Communicate Direct to IP," https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/, 2026-08-04 ## 8\. Adverse Trace position This is a **high-impact defensive visibility advisory**, not a zero-day or active-exploitation alert. The core finding — 45.32% of malware C2 bypasses DNS — is statistically significant and operationally actionable for EMEA financial services networks that rely heavily on DNS-based controls (protective DNS, DNS sinkholing, domain blocklists). The ZT-IP methodology is sound and implementable using existing network telemetry (DNS logs + flow records + egress filtering). The single hard-coded IOC (`154.92.19[.]71:39989`) is low-fidelity on its own; the value is in the behavioural detection pattern. All statistics are single-sourced from Unit 42's proprietary WildFire dataset — we assess the methodology as credible but recommend clients validate D2IP prevalence against their own network telemetry before committing to architectural changes. Adverse Trace will monitor for additional D2IP campaign reporting and update IOCs as corroborated data emerges. --- [Read the original source →](https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*