Almost Half of Malware Samples Communicate Direct to IP

Analysis of 4 million dynamic malware reports reveals that 45.32% of malware samples with command-and-control activity establish direct-to-IP (D2IP) connections, bypassing DNS entirely and evading DNS-based security defenses. D2IP traffic accounts for 23.17% of all C2 connection attempts. This behavior is observed across diverse threats including Phorpiex ransomware droppers using hard-coded IP addresses, persistent data exfiltration campaigns employing obfuscated HTTP GET requests, SectopRAT targeting educational institutions with in-browser proxy capabilities, and IoT botnets like Mozi and Boatnet propagating through P2P networks. The research introduces zero trust IP (ZT-IP), a network-level enforcement approach that verifies whether outbound connection destinations were previously sanctioned by DNS responses, effectively blocking malicious D2IP communications that traditional DNS-based security controls cannot detect.

• Hackers Impersonate IT Help Desk on Microsoft Teams to Hijack Active Directory Accounts and Steal DataMalware2026-10-31
• n0n Ransomware: Inside an AI-Assisted Extortion OperationMalware2026-10-28
• PHP · PHP2Shell (CVE-2026-109618/9) Havoc: UNC actors leveraging Public Exploit Code Against Public, Business And Educational InfrastructureExploitedVulnerability2026-10-27
• Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress ExploitationCampaign2026-09-22
• Statistical Report on Malware Targeting Linux SSH Servers in the Third Quarter of 2026Malware2026-10-14