Analysis from Palo Alto Unit 42 reveals that nearly half of command-and-control malware samples bypass DNS resolution by connecting directly to IP addresses. This behavior undermines security controls that rely on DNS monitoring and filtering to detect and block malicious traffic. The report emphasizes that zero trust enforcement at the IP layer is critical to defend against these threats, as relying solely on DNS-based defenses is insufficient. The data is drawn from a detailed Unit 42 article analyzing malware communication patterns.

Malware that communicates directly to IP addresses can evade DNS-based detection and filtering mechanisms, potentially increasing the success rate of command-and-control communications. This reduces the effectiveness of traditional network security controls that depend on DNS monitoring, potentially allowing malware to maintain persistence and control within compromised environments.

Implement zero trust network policies that enforce strict IP-level controls and monitoring. Do not rely solely on DNS-based detection and filtering for malware communication. Network defenders should consider IP reputation, behavioral analysis, and other network-layer controls to detect and block direct IP communications used by malware. There is no specific patch or fix since this is a behavioral technique rather than a software vulnerability.