Threat Research · unit42.paloaltonetworks.com

Unit 42 Finds 45% of C2 Malware Samples Connect Directly to IPs

Aug 4, 2026 · Original article ↗

Summary

Unit 42 analyzed more than 4 million dynamic reports and found 45.32% of malware samples with C2 activity made at least one direct-to-IP connection, exposing limits in DNS-based defenses. The research details Phorpiex, SectopRAT, Mozi and Boatnet activity and proposes Z

Key points

Analysis of more than 4 million Advanced WildFire reports over 30 days found that 45.32% of malware samples with C2 activity made at least one direct-to-IP connection; these connections accounted for 23.17% of C2 attempts.
The direct-to-IP rate remained 41.97% after the analysis excluded bulk port-scanning behavior.
Unit 42 observed Phorpiex droppers contacting hard-coded IP addresses without prior DNS queries and fetching staged payloads.
An obfuscated HTTP GET exfiltration campaign used encoded requests and regularly rotated destination IP addresses and ports; its infrastructure was hosted on public cloud services in Brazil.
SectopRAT activity targeting educational institutions used an in-browser proxy to relay browsing activity and exfiltrate submitted usernames and plaintext passwords.
The analysis describes Mozi and Boatnet direct-to-IP activity against IoT devices; Boatnet binaries targeted at least 14 architectures, including m68k.
ZT-IP is a proposed network enforcement approach that permits outbound connections to IP addresses previously approved through DNS, with allowances for specified legitimate direct-IP traffic.

Article Details

Attack Vectors: Malware used hard-coded IP addresses for command-and-control connections without prior DNS queries.
Phorpiex-related activity downloaded staged payloads, including a binary from an IP-hosted URL.
A campaign used obfuscated HTTP GET requests to exfiltrate data through rotating destination IP addresses and ports.
SectopRAT mirrored victim browser traffic and exfiltrated submitted usernames and plaintext passwords.
Mozi and Boatnet used direct-to-IP communications in IoT botnet activity, including propagation through HTTP requests containing exploitation payloads.
Defensive Notes: ZT-IP checks whether an outbound IP destination was recently approved by DNS and flags or blocks connections without that approval.
ZT-IP uses allowlists and exemptions for private intranet addresses, trusted protocols, and well-known benign public IP addresses to reduce false positives.
The article says DNS-based controls alone can miss malware that communicates directly with IP addresses.
The article states that Advanced WildFire, Advanced URL Filtering, Advanced DNS Security, Cortex XDR, and XSIAM provide protections against threats discussed in the report.

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]245[.]236[.]146`	Listed by the article as a malicious destination IP address associated with the discussed activity.
IPV4	`178[.]16[.]54[.]109`	Malicious payload-delivery infrastructure associated with Phorpiex activity.
IPV4	`178[.]16[.]54[.]31`	Listed by the article as a malicious destination IP address associated with the discussed activity.
IPV4	`18[.]228[.]188[.]56`	Destination shown for the obfuscated GET campaign, which the article describes as using cloud-hosted C2 infrastructure.
IPV4	`194[.]76[.]227[.]94`	Infrastructure used by one of the reported SectopRAT attackers targeting educational institutions.
IPV4	`2[.]26[.]98[.]67`	Identified as the distribution IP address for the Boatnet Mirai variant.
IPV4	`206[.]189[.]229[.]43`	Listed by the article as a malicious destination IP address associated with the discussed activity.
IPV4	`62[.]60[.]179[.]230`	Listed by the article as a malicious destination IP address associated with the discussed activity.
IPV4	`87[.]120[.]107[.]33`	Infrastructure used by one of the reported SectopRAT attackers targeting educational institutions.
IPV4	`91[.]92[.]243[.]29`	Listed by the article as a malicious destination IP address associated with the discussed activity.
SHA256	`01a96eeafb72042b3f69afd21b4c9155dbfe7f97ab3dca392972ad531a075ac2`	Listed as a malware sample hash associated with the activity discussed in the report.
SHA256	`9639f7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9bfd1d4`	Listed as a malware sample hash associated with the activity discussed in the report.
SHA256	`bf24277400cc453d530e4277d3bd24e96c5e409adef6970518bdc59205aa0241`	Listed as a malware sample hash associated with the activity discussed in the report.
SHA256	`cc43cdbe8eb9874f55fffbe23b560b673eb9f31fb9a953926bba29464fd2dd07`	Hash of an associated malware sample analyzed in connection with the obfuscated GET exfiltration campaign.
SHA256	`e310476c41ae4f6e3c4ed9bb88303ee6e5e1455bd7afe51cf48965ea7599e6e5`	Listed as a malware sample hash associated with the activity discussed in the report.
SHA256	`e3513922666c202c1ae5c06eea277ba10477868d6d89ce2819f4f8ff9070bc85`	Listed as a malware sample hash associated with the activity discussed in the report.
SHA256	`e5715e6611ef6bcb233f5d2098510dab3db408abbb728b00e1821bb255829373`	Listed as a malware sample hash associated with the activity discussed in the report.
URL	`hxxp[:]//178[.]16[.]54[.]109/st.exe`	Phorpiex-associated binary retrieval URL identified by the article as a malicious payload.