This research analyzes 4 million dynamic malware reports and finds that 45.32% of malware samples exhibiting command-and-control activity establish direct-to-IP (D2IP) connections, completely bypassing DNS resolution. This evasion technique undermines traditional DNS-based security controls. D2IP traffic constitutes 23.17% of all C2 connection attempts. The behavior is present across multiple malware types such as Phorpiex ransomware droppers with hard-coded IPs, persistent data exfiltration campaigns using obfuscated HTTP GET requests, SectopRAT targeting educational institutions with in-browser proxy capabilities, and IoT botnets like Mozi and Boatnet propagating via peer-to-peer networks. The study introduces zero trust IP (ZT-IP), a network-level enforcement mechanism that validates outbound connection destinations against previously authorized DNS responses to block malicious D2IP communications.

Malware using direct-to-IP connections can evade DNS-based detection and blocking mechanisms, increasing the difficulty of identifying and mitigating command-and-control communications. This technique enables persistent and stealthy malware operations including ransomware deployment, data exfiltration, and botnet propagation. The widespread use of D2IP across diverse malware families and attack vectors highlights a significant gap in traditional network security defenses relying on DNS monitoring.

No official patch or vendor advisory is available for this behavior as it is a malware communication technique rather than a software vulnerability. The research proposes implementing zero trust IP (ZT-IP) network enforcement, which restricts outbound connections to IP addresses previously authorized by DNS responses. Organizations should consider deploying network-level controls that verify IP destinations against DNS resolutions to detect and block unauthorized direct-to-IP communications. This approach complements existing DNS-based security controls and addresses the evasion technique described.