Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Almost Half of Malware Samples Communicate Direct to IP

Summary: Unit 42's analysis of over 4 million Advanced WildFire dynamic analysis reports found that 45.32% of malware samples with any command-and-control activity made at least one direct-to-IP connection with no preceding DNS query, and that D2IP traffic accounts for 23.17% of all C2 connection attempts. The report cites hard-coded IP backdoors, the Phorpiex dropper, an obfuscated \GET exfiltration campaign hosted on cloud infrastructure in Brazil, SectopRAT campaigns against educational institutions, and the Mozi and Boatnet IoT botnets as threats that bypass DNS-based defenses entirely.

What's compelling: Nearly half of C2-active malware never touches DNS, so the DNS filtering and sinkholing that anchor enterprise threat defense see none of it - and only 1% of benign samples show comparable untrusted-IP behavior, meaning the signal is there if you enforce on it.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026