Nearly Half of C2 Malware Bypasses DNS Using Direct-to-IP Connections, Unit 42 Finds

New cybersecurity research has highlighted a significant visibility gap in traditional network defenses, revealing that nearly half of malware exhibiting command-and-control (C2) behavior communicates directly with IP addresses instead of resolving domain names through DNS.

According to research from Palo Alto Networks Unit 42, 45.32% of malware samples showing C2 activity established at least one direct-to-IP (D2IP) connection, potentially allowing attackers to bypass security controls that rely heavily on DNS monitoring, domain reputation, and malicious-domain blocking.

Researchers reached the findings after analyzing more than four million dynamic malware-analysis reports over a 30-day period.

Nearly Half of C2 Malware Bypasses DNS

Even after removing activity associated with large-scale port scanning, approximately 41.97% of relevant malware samples continued to exhibit direct-to-IP behavior.

Researchers also found that D2IP communications accounted for 23.17% of all observed C2 connection attempts, indicating that the technique represents a substantial component of modern malicious network traffic rather than an isolated evasion method.

Traditional internet communications commonly begin with a DNS request. When software needs to contact a server, DNS translates a human-readable domain such as example.com into the corresponding IP address.

Enterprise security platforms can inspect these DNS requests, identify known malicious domains, enforce filtering policies, or redirect suspicious domains toward sinkholes.

Malware communicating directly with an embedded or dynamically obtained IP address can completely eliminate this DNS resolution stage.

The result creates an important monitoring blind spot. An infected endpoint can potentially establish an outbound connection with attacker-controlled C2 infrastructure without generating the DNS telemetry defenders expect to correlate with suspicious activity.

Organizations heavily dependent on DNS filtering, domain-based threat intelligence, or DNS logs may therefore fail to identify some malicious communications until other endpoint or network indicators appear.

Unit 42 researchers observed direct-IP techniques across multiple categories of malware, including ransomware-related payloads, remote-access malware, information-stealing tools and peer-to-peer IoT botnets.

The behavior demonstrates that D2IP communication is not tied to a single threat actor or malware family but represents a broader technique attackers can adopt when attempting to reduce their DNS footprint.

The Phorpiex malware family, for example, has been observed making direct HTTP requests to C2 IP addresses to retrieve configuration information and additional malicious payloads.

Researchers also identified data-exfiltration activity using unusual HTTP request structures to transmit encoded information directly toward attacker-controlled infrastructure. Such traffic may evade detection mechanisms designed primarily around domain reputation.

Direct-IP communication becomes particularly challenging when attackers frequently rotate destination addresses and network ports.

Static IP blocklists can rapidly become outdated, while newly deployed malicious infrastructure may remain unknown to reputation services during the early stages of an attack.

Peer-to-peer botnets such as Mozi further demonstrate the problem because infected IoT devices can communicate directly with other peers without depending on centralized DNS-based infrastructure.

Threat intelligence coverage also presents limitations. Malicious IP addresses may not immediately appear in open-source intelligence or commercial reputation feeds, creating a window in which attacker infrastructure can remain operational before being classified as dangerous. Infrastructure rotation can further reduce the effectiveness of purely reputation-based defenses.

Security teams should therefore consider outbound connections to public IP addresses without corresponding recent DNS resolutions as a valuable behavioral detection signal.

However, organizations should avoid automatically blocking every direct-IP connection because legitimate technologies, including VoIP services, IoT equipment, peer-to-peer software and certain infrastructure applications, can communicate directly with IP addresses.

A stronger defensive strategy combines DNS telemetry with endpoint detection and response (EDR), network detection and response (NDR), firewall telemetry, behavioral analytics and C2 traffic inspection.

Correlating endpoint processes with outbound IP connections can help defenders distinguish legitimate direct communications from suspicious malware activity.

The findings reinforce that DNS security remains valuable, but modern organizations cannot rely on DNS visibility alone when detecting increasingly evasive command-and-control infrastructure.