MalwarePublished 4 Aug 2026

Almost Half of Malware Samples Communicate Direct to IP

Source Palo Alto Unit 42

malware

Description

Nearly half of C2 malware bypasses DNS by connecting directly to IP addresses. Zero trust IP enforcement secures networks against these threats. The post Almost Half of Malware Samples Communicate Direct to IP appeared first on Unit 42 .

Impact

Malware that communicates directly to IP addresses can evade DNS-based detection and filtering mechanisms, potentially increasing the success rate of command-and-control communications. This reduces the effectiveness of traditional network security controls that depend on DNS monitoring, potentially allowing malware to maintain persistence and control within compromised environments.

Defensive guidance

Implement zero trust network policies that enforce strict IP-level controls and monitoring. Do not rely solely on DNS-based detection and filtering for malware communication. Network defenders should consider IP reputation, behavioral analysis, and other network-layer controls to detect and block direct IP communications used by malware. There is no specific patch or fix since this is a behavioral technique rather than a software vulnerability.

References

unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 Aug 2026, 12:57 UTC

References

Community reviews

Related threats