45% of C2-Active Malware Bypasses DNS With Direct-to-IP Connections

Nearly half of malware samples that show command-and-control (C2) activity connect directly to IP addresses instead of using domain names, according to Unit 42 research. The technique removes the DNS lookup that many security tools rely on to identify, block, or sinkhole malicious infrastructure. Researchers analyzed more than four million dynamic malware-analysis reports over 30 […]

The post .