Threat Research

Almost Half of Malware Samples Communicate Direct to IP

Unit42
Almost Half of Malware Samples Communicate Direct to IP
Unit 42 found that nearly half of malware samples with command-and-control activity make direct-to-IP connections, bypassing DNS and exposing a major visibility gap in traditional defenses. The report highlights ZT-IP detections for Phorpiex, SectopRAT, Mozi, and Boatnet activity, plus an obfuscated GET exfiltration campaign and hard-coded IP-based infrastructure. #Phorpiex #SectopRAT #Mozi #Boatnet #ZT-IP

Keypoints

  • Analysis of more than 4 million dynamic malware reports found that 45.32% of malware samples with C2 activity made at least one direct-to-IP connection.
  • Direct-to-IP traffic accounted for 23.17% of all C2 connection attempts, showing that DNS-based defenses miss a large portion of malicious traffic.
  • ZT-IP is introduced as a zero trust enforcement approach for IP-based traffic that only allows outbound connections previously sanctioned by DNS.
  • Phorpiex ransomware droppers were seen connecting directly to hard-coded IP addresses and downloading staged payloads without any preceding DNS query.
  • A persistent GET exfiltration campaign used obfuscated HTTP requests, rotating IPs and ports while targeting high-value sectors through cloud-hosted C2 infrastructure in Brazil.
  • SectopRAT infrastructure was used against educational institutions to mirror browser traffic and steal session data, SSO redirects, usernames, and plaintext passwords.
  • Mozi and Boatnet demonstrated how IoT botnets and Mirai variants use D2IP communications to spread, including targeting older and industrial hardware with multiple architectures.

MITRE Techniques

  • [T1071.001 ] Web Protocols – Malware used HTTP and WebSocket communications to reach C2 directly over web traffic (‘initiating a WebSocket connection directly to an IP address’; ‘custom obfuscated HTTP GET request’).
  • [T1095 ] Non-Application Layer Protocol – The analysis describes direct network communications that bypass normal application-layer DNS resolution (‘communicating directly to IP addresses instead’; ‘without DNS’).
  • [T1105 ] Ingress Tool Transfer – Phorpiex-related activity fetched additional payloads from the server (‘initially fetching configuration, and then retrieving additional malicious components such as a ransomware payload’; ‘binary retrieved from hxxp[:]//178.16.54[.]109/st.exe’).
  • [T1027 ] Obfuscated Files or Information – The GET campaign used an obfuscated request format and encoded payloads to evade detection (‘This is an obfuscated request format designed to evade security detection’; ‘followed by a long encoded string’).
  • [T1041 ] Exfiltration Over C2 Channel – SectopRAT and the GET campaign sent stolen data back through attacker-controlled connections (‘exfiltrates form fields including usernames and plaintext passwords’; ‘persistent campaign … exfiltrating data’).
  • [T1071.001 ] Web Protocols – SectopRAT used browser proxy endpoints to relay URLs and form submissions over HTTP (‘The first, /churl, relays every URL the victim visits’; ‘The second, /fsave, exfiltrates form fields’).
  • [T1090 ] Proxy – SectopRAT leveraged an in-browser proxy capability to mirror victim browser traffic to attacker servers (‘in-browser proxy capability to silently mirror all victim browser traffic’).
  • [T1568.001 ] Dynamic Resolution: Fast Flux DNS – The article notes rotating destination IPs and ports to evade static blocking, resembling dynamic infrastructure changes (‘It rotates both its destination port and IP address on a regular schedule’).
  • [T1095 ] Non-Application Layer Protocol – Mozi and other IoT malware propagated through direct IP exploitation traffic without DNS resolution (’embedded directly in HTTP requests’; ‘making D2IP connections without DNS resolution’).
  • [T1203 ] Exploitation for Client Execution – IoT exploitation payloads were embedded to trigger device compromise (‘example of an IoT exploitation payload embedded in an HTTP request’).

Indicators of Compromise

  • [Malicious destination IP addresses] C2 and delivery infrastructure used across multiple campaigns – 2.26.98[.]67, 178.16.54[.]109, and other 7 items
  • [Malware sample hashes] Associated samples linked to the discussed activity – 01a96eeafb72042b3f69afd21b4c9155dbfe7f97ab3dca392972ad531a075ac2, 9639f7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9bfd1d4, and other 4 items
  • [File names / URLs] Payload retrieval and staging artifacts used by Phorpiex and Boatnet – st.exe, /hiddenbin/, and other 2 items
  • [HTTP request paths] Malicious web endpoints used for proxying, downloads, and exfiltration – /churl, /fsave, and other 4 items
  • [User-Agent strings] Botnet fingerprint observed on infected devices – Wget/1.13.4
  • [WebSocket destination] Hard-coded backdoor destination seen in one sample – wss://154.92.19[.]71:39989

Read more: https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/

SHARE THIS STORY

WhatsAppX (Twitter)TelegramBlueskyFacebookLinkedInThreadsEmailPrint