Executive Summary
Analysis of 4 million dynamic reports reveals that nearly half of malware samples with command-and-control (C2) activity now utilize direct-to-IP (D2IP) connections, entirely bypassing the DNS resolution stage. By hard-coding IP addresses in binaries, threats such as Phorpiex ransomware droppers and SectopRAT evade traditional DNS-based defenses, sinkholing, and anomaly detection systems.
Technical findings highlight diverse attack chains, including Phorpiex's staged payload delivery from 178.16.54[.]109 and a persistent exfiltration campaign using an obfuscated '\\GET' protocol that rotates ports and IPs to evade static blocking. Additionally, P2P IoT botnets like Mozi and the Mirai variant 'Boatnet' leverage D2IP for self-propagation, with Boatnet specifically targeting legacy architectures like Motorola 68000.
For organizations, this trend represents a significant visibility gap. Relying solely on DNS security allows these threats to establish footholds undetected. Implementing a Zero Trust IP (ZT-IP) framework—where outbound connections are only permitted to IP addresses previously sanctioned by a DNS response—is recommended to mitigate these stealthy exfiltration and C2 behaviors.