Malware Bypasses DNS Defenses by Communicating Directly With IP Addresses
Nearly half of malware samples with command-and-control activity bypass traditional DNS resolution, opting for direct IP communication to evade detection.
A significant portion of malicious software is circumventing standard cybersecurity defenses by communicating directly with IP addresses, bypassing the Domain Name System (DNS) altogether. Palo Alto Networks' Unit 42 researchers analyzed over 4 million dynamic analysis reports and found that 45.32% of malware samples exhibiting command-and-control (C2) activity made at least one direct-to-IP (D2IP) connection. This technique renders DNS-based security measures, such as query monitoring, filtering, and sinkholing, ineffective, as the traffic appears as raw IP communication without any DNS context.
The prevalence of D2IP communication is starkly contrasted with benign software. While only 1% of legitimate samples connect to untrusted IP addresses, malware samples frequently employ this method. Among malware with C2 connections, TCP is the dominant protocol, but UDP is also used, particularly in peer-to-peer (P2P) botnets and scanning activities. Critically, the 45.32% figure for D2IP connections among C2-active malware highlights a substantial blind spot in many network security architectures.
This direct communication method is employed by a diverse range of threats, including ransomware droppers, P2P botnets, and supply chain compromises. Malware authors hardcode IP addresses directly into their binaries, allowing for immediate connections without the need for DNS resolution. This bypasses critical security controls that rely on monitoring DNS queries to identify and block connections to known malicious domains or infrastructure.
Unit 42 researchers identified several specific threats leveraging D2IP communication. One notable example involves the Phorpiex ransomware dropper, which was observed making suspicious HTTP GET requests to a hardcoded IP address. This traffic, lacking preceding DNS queries, is designed to evade standard heuristic detection mechanisms. The IP address served as a distribution point for multiple malicious payloads, aligning with Phorpiex's staged delivery approach.
Another significant finding was a persistent data exfiltration campaign utilizing a custom, obfuscated HTTP request format dubbed the '\GET' protocol. This non-standard request begins with a backslash followed by 'GET' and includes long, encoded strings, further obscuring its malicious intent and evading detection. The campaign targeted a specific IP address, demonstrating a sophisticated method for data theft that bypasses typical security monitoring.
To combat this growing threat, Unit 42 proposes a Zero Trust IP (ZT-IP) enforcement approach. This network-level strategy applies Zero Trust principles to IP-based traffic by verifying if outbound connection destinations were ever sanctioned by a DNS response. By flagging connections to IP addresses that were never resolved via DNS, security teams can identify and block D2IP communications that would otherwise go unnoticed.
Palo Alto Networks customers are protected against these threats through products like Advanced WildFire, Advanced URL Filtering, Advanced DNS Security, and Cortex XDR. The research underscores the evolving tactics of threat actors and the necessity for adaptive security strategies that extend beyond traditional DNS monitoring to encompass direct IP traffic analysis.