Listen to this Post
Introduction: The New Era of Invisible Command-and-Control Communication
For years, defenders have relied on DNS visibility as one of the most powerful tools for detecting malicious activity. A suspicious domain lookup, a newly registered domain, or a known malicious hostname often provides the first warning that a system may be compromised. However, cybercriminals are increasingly changing their tactics.
New research from Unit 42 reveals a worrying trend: nearly half of malware samples that communicate with command-and-control (C2) infrastructure are now capable of connecting directly to IP addresses instead of using domain names. This approach allows attackers to bypass one of the most commonly monitored layers of network security and create a quieter path between infected machines and malicious servers.
The research analyzed more than four million dynamic malware-analysis reports collected over a 30-day period. The findings show that 45.32% of malware samples with C2 activity performed at least one direct-to-IP (D2IP) connection. Even after removing suspicious bulk scanning activity, the number remained extremely high at 41.97%.
This development represents a major challenge for organizations that depend heavily on DNS filtering, domain reputation services, and domain-based threat intelligence. Attackers are adapting, and defenders must expand their detection strategies beyond traditional indicators.
Direct-to-IP Malware: The Attack Method That Removes a Security Layer
How Traditional Malware Communication Works
Most malware families historically communicate with their operators through domains. A compromised computer contacts a malicious domain such as an attacker-controlled website, performs a DNS lookup, receives the corresponding IP address, and then establishes communication.
This process creates multiple opportunities for defenders:
DNS monitoring can detect suspicious requests.
Security tools can block known malicious domains.
Threat intelligence platforms can track domain registrations.
Organizations can redirect dangerous domains into sinkholes for investigation.
Because DNS creates a visible trail, it has become a central component of modern cybersecurity monitoring.
How Attackers Bypass DNS Detection
Direct IP Communication Removes the Warning Signal
Direct-to-IP malware eliminates the DNS step completely. Instead of requesting a domain name, the malware already knows the destination IP address or receives it through another communication channel.
The connection process becomes much simpler:
Infected device → Attacker IP address → Command-and-control server
No domain lookup.
No suspicious hostname.
No DNS event.
This creates a visibility gap that can allow malicious communication to blend into normal internet traffic.
A security team monitoring only DNS logs may see nothing unusual while an infected endpoint quietly exchanges commands with an attacker-controlled server.
Unit 42 Research Reveals the Scale of the Problem
Millions of Malware Reports Show a Growing Trend
Unit 42 researchers examined over four million dynamic malware-analysis reports within a single month. Their analysis focused on malware samples showing command-and-control behavior.
The results were significant:
45.32% of C2-active malware samples used direct IP communication.
41.97% continued using D2IP methods after removing scanning-related traffic.
Direct IP communication accounted for 23.17% of all observed C2 connection attempts.
These numbers demonstrate that direct IP communication is not an unusual technique used only by advanced attackers. It has become a common strategy across multiple malware categories.
Malware Families Using Direct IP Communication
Ransomware, Remote Access Tools, and Data Theft Campaigns Adapt
Direct IP communication is appearing across different threat categories, including ransomware loaders, remote-access malware, information stealers, and IoT botnets.
One example identified by researchers is the Phorpiex malware family. This malware has been observed using direct HTTP requests to retrieve configuration information and additional payloads from attacker-controlled IP addresses.
Other campaigns have used customized network requests designed to hide stolen information. Researchers observed attackers using unusual HTTP GET formats to transmit encoded data back to their infrastructure.
These campaigns targeted valuable organizations, including:
Government networks.
Airlines.
Universities.
Large enterprises.
Attackers also continuously changed IP addresses and communication ports, making traditional IP blocklists less effective.
IoT Botnets Make DNS-Only Defense Even Weaker
Peer-to-Peer Malware Creates New Visibility Problems
IoT botnets represent another major challenge because many operate without depending on traditional domain infrastructure.
The Mozi botnet, derived from the Mirai family, demonstrates how peer-to-peer malware can communicate directly between infected devices using IP addresses.
Instead of relying on a centralized domain, infected devices can discover and communicate with other compromised machines directly.
This approach is especially dangerous in environments containing:
Unmanaged IoT devices.
Industrial control systems.
Legacy infrastructure.
Smart devices with weak security controls.
Organizations protecting these environments cannot rely only on DNS monitoring because malicious traffic may never generate a DNS request.
Why IP Reputation Alone Is Not Enough
Attackers Exploit the Delay in Threat Intelligence
Many security teams depend on IP reputation databases to identify malicious infrastructure. However, research shows that these systems may not detect threats quickly enough.
According to additional research cited by Help Net Security, around 52% of IP addresses involved in direct-to-IP attacks were not present in open-source intelligence feeds.
Researchers also found an average delay of approximately 20 days before malicious IP addresses appeared in some intelligence databases.
This delay creates a valuable opportunity for attackers.
During this window, threat actors can:
Launch attacks.
Steal information.
Move infrastructure.
Rotate IP addresses.
Avoid reputation-based detection.
Cybercriminal groups increasingly use short-lived infrastructure designed to disappear before security systems can categorize it.
Deep Analysis: Detecting Direct IP Malware Communication
Why Security Teams Must Expand Their Monitoring Strategy
Traditional cybersecurity models often depend on domain reputation, DNS monitoring, and known malicious indicators. Direct-to-IP malware challenges this assumption.
Security teams should monitor unusual outbound connections, especially when a device communicates with public IP addresses without a recent DNS resolution.
Useful detection areas include:
Endpoint behavior monitoring.
Network traffic analysis.
Firewall telemetry.
Authentication logs.
Process-level investigation.
Threat hunting.
Example Detection Commands for Security Analysts
Linux: Monitor Active Network Connections
ss -tunap
This command displays active TCP and UDP connections with associated processes.
Linux: Identify Suspicious External IP Connections
netstat -plant
Security teams can review unexpected outbound connections from unknown applications.
Windows PowerShell: Review Active Connections
Get-NetTCPConnection | Select-Object LocalAddress,RemoteAddress,State
This helps identify external communication paths from Windows systems.
Windows: Investigate Network Activity
netstat -ano
Security analysts can map suspicious connections back to running processes.
Packet Analysis With tcpdump
tcpdump -i eth0 host <IP_ADDRESS>
This allows defenders to inspect traffic going directly to suspicious addresses.
Building Stronger Defenses Against Direct-IP Malware
Moving Beyond DNS-Based Security
Organizations should not abandon DNS monitoring. DNS remains valuable. However, it should become only one layer in a broader defense strategy.
A stronger security model includes:
Network Behavior Analysis
Security systems should detect unusual outbound connections, regardless of whether they use domains or raw IP addresses.
Zero Trust Architecture
Every connection should be evaluated based on identity, behavior, and risk instead of being trusted automatically.
Endpoint Detection and Response
Modern EDR platforms can identify malware behavior even when attackers avoid traditional indicators.
Threat Hunting
Security teams should proactively search for:
Unknown external connections.
Suspicious processes.
Abnormal data transfers.
Rare communication patterns.
What Undercode Say:
Direct IP Communication Shows the Evolution of Modern Cyber Threats
The rise of direct-to-IP malware communication is another example of attackers adapting faster than traditional defenses.
Cybersecurity has historically been built around identifying known patterns.
A malicious domain appears.
Security tools block it.
Threat intelligence updates the database.
But attackers have learned that predictable infrastructure creates predictable defenses.
By removing DNS communication, criminals remove one of the easiest signals defenders can observe.
The most concerning part is not simply that malware can connect directly to IP addresses.
The real problem is that many organizations still measure threats using outdated visibility models.
A company may have excellent DNS filtering and still miss a compromised device communicating with an unknown IP address.
Modern malware is becoming less dependent on centralized infrastructure.
Attackers are moving toward:
Disposable servers.
Fast-changing IP addresses.
Peer-to-peer networks.
Encrypted communication.
Cloud-based infrastructure.
This makes reputation-based security increasingly fragile.
The cybersecurity industry is entering an era where behavior matters more than identity.
Knowing that an IP address is malicious is useful.
Understanding why a machine is connecting to that IP address is far more valuable.
A workstation suddenly contacting a foreign server at 3 AM is suspicious.
A printer communicating with an unknown external IP is suspicious.
A database server sending encrypted traffic to an unfamiliar address is suspicious.
The future of defense depends on context.
Security teams must combine:
Network analytics.
Artificial intelligence.
Endpoint monitoring.
User behavior analysis.
Automated response systems.
The attackers are no longer simply hiding malicious domains.
They are removing the evidence defenders traditionally search for.
Direct-IP malware is a warning that cybersecurity cannot depend on a single visibility layer.
Organizations that continue relying only on DNS protection will increasingly face blind spots.
The next generation of security must focus on communication behavior, not just destination reputation.
✅ Direct-IP Malware Communication Is a Real and Growing Technique
Unit 42 research confirms that a significant percentage of malware samples with C2 activity communicate directly with IP addresses instead of relying on domains.
The reported statistics show that this technique represents a meaningful portion of modern malware behavior.
The trend aligns with broader cybersecurity research showing attackers increasingly use infrastructure designed to avoid traditional detection methods.
✅ DNS-Based Detection Alone Has Limitations
DNS monitoring remains useful, but malware that skips domain resolution can bypass DNS-focused defenses.
Organizations need additional visibility from endpoint and network monitoring solutions.
✅ IoT Botnets Can Operate Without Traditional Domain Infrastructure
Peer-to-peer botnets such as Mirai-related malware families demonstrate how attackers can create decentralized communication systems.
This makes DNS-only security approaches insufficient for many IoT environments.
Prediction
(+1) Direct-IP Detection Will Become a Standard Security Capability
Security platforms will increasingly develop advanced behavioral detection systems that identify suspicious IP communication patterns without depending on DNS history.
Artificial intelligence-driven threat detection will likely improve the ability to identify malicious infrastructure faster than traditional reputation feeds.
Organizations that adopt network behavior analytics, stronger endpoint monitoring, and automated response systems will significantly reduce the impact of these attacks.
(-1) Organizations That Depend Only on DNS Security Will Face Increasing Blind Spots
Attackers will continue exploiting gaps created by DNS-independent communication.
Companies that fail to monitor direct outbound IP traffic may struggle to detect malware until after data theft, ransomware deployment, or network compromise has already occurred.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.facebook.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
