SectopRAT - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/sectoprat/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 04 Aug 2026 13:34:18 +0000Prevalence of Direct-to-IP Malware Command and Controlhttps://feed.craftedsignal.io/briefs/2026-08-malware-d2ip/Tue, 04 Aug 2026 13:34:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-malware-d2ip/Nearly half of malware samples with command-and-control activity bypass DNS resolution by connecting directly to hardcoded IP addresses, rendering traditional DNS-based defenses ineffective.Research from Unit 42 indicates that approximately 45% of malware samples with command-and-control (C2) activity bypass DNS resolution, instead initiating direct-to-IP (D2IP) connections. This behavior is prevalent across various threats, including Phorpiex ransomware droppers, SectopRAT, and Mozi botnet variants. Attackers utilize hardcoded IP addresses within malware binaries to evade DNS sinkholing and anomaly detection systems that rely on domain-based reputation.

The research highlights that D2IP traffic accounts for over 23% of total C2 connection attempts. Attackers leverage this technique for diverse objectives, ranging from staged payload delivery and P2P mesh communication to obfuscated data exfiltration protocols (e.g., the \GET protocol). This evasion strategy effectively bypasses traditional DNS-based security controls, necessitating network-level zero trust IP (ZT-IP) enforcement that verifies the legitimacy of outbound connections against historical DNS resolution context.

Attack Chain

  1. Malware binary is executed on the victim host (e.g., via phish-delivered dropper).
  2. The malware performs internal checks or staging; no DNS queries are initiated for C2 resolution.
  3. The malware initiates a raw TCP or UDP connection directly to a hardcoded C2 IP address.
  4. The connection establishes a C2 channel (e.g., WebSocket for backdoors or \GET protocol for exfiltration).
  5. The attacker transmits configuration data or malicious payloads (e.g., ransomware modules) over the direct connection.
  6. The malware exfiltrates sensitive browser data or form fields (e.g., SectopRAT /churl and /fsave endpoints).
  7. The connection persists or rotates IPs/ports based on attacker operational security requirements.

Impact

Successful D2IP communication facilitates silent C2 channel establishment, bypassing perimeter security that lacks DNS context. Observed campaigns impact high-value sectors, including government entities, airlines, and universities. Threats like SectopRAT enable real-time mirror exfiltration of browser traffic, including authenticated session pages and plaintext credentials, leading to significant risk of unauthorized access and lateral movement.

Recommendation

  • Implement Zero Trust IP (ZT-IP) enforcement at the firewall level to verify outbound connections against sanctioned DNS responses.
  • Monitor network traffic for persistent outbound TCP/UDP connections to untrusted external IP addresses that lack a corresponding preceding DNS query.
  • Deploy the provided IOCs (154.92.19.71, 178.16.54.109, etc.) to network blocklists, acknowledging potential overlap with shared cloud infrastructure.
  • Utilize EDR telemetry to hunt for suspicious processes (e.g., non-browser binaries) initiating direct network connections to external IP ranges without DNS lookup activity.
]]>highadvisory