Key Takeaways
- Attackers are increasingly bypassing traditional network defenses by sending malware traffic directly to IP addresses, evading web and DNS inspection.
- 23 % of modern malware uses direct‑to‑IP connections; 52 % of the malicious IPs involved never appear in popular threat‑intel feeds, and new threats take ~20 days to surface in those feeds.
- Conventional MDR and SOC workflows that rely on static feeds, content inspection, and alerting are too slow for today’s rapid infrastructure rotation.
- Real‑time visibility at the network layer—combined with automated correlation and rapid response—is now a baseline requirement for effective threat prevention.
- Recent market activity shows consolidation and investment: Recorded Future teams with Wipro for managed threat intelligence; Valiant Solutions acquires BreakPoint Labs to boost federal cyber‑operations capabilities; Arpio raises $15 M Series A to expand its AI‑native cloud recovery platform.
Attackers Evading Traditional Defenses
Palo Alto Networks’ Unit 42 report, Attackers Are Evading Threat Prevention at the Internet Edge, highlights a stark shift in adversary tactics. Threat actors are no longer relying solely on domain‑based infrastructures that can be caught by web proxies, DNS filters, or URL‑based reputation feeds. Instead, they are crafting malware that initiates communication straight to IP addresses, thereby sidestepping the inspection points that many security stacks have built their defenses around. This maneuver allows attackers to blend in with legitimate traffic, reduce the fingerprint left on DNS logs, and shorten the window during which defensive tools can observe and act on malicious behavior.
Data on Direct‑to‑IP Malware
The report quantifies the prevalence of this evasion technique: 23 % of modern malware samples now send traffic directly to IP addresses rather than through a resolvable hostname. Even more troubling, 52 % of the malicious IPs used for these direct‑to‑IP connections are absent from the most widely consumed threat‑intelligence feeds. Because feeds are updated on a cadence that assumes slower‑moving adversary infrastructure, new threats typically take an average of 20 days to appear in those sources. Consequently, a significant portion of harmful traffic remains invisible to organizations that depend solely on feed‑based blocking or reputation scoring, creating a dangerous gap between detection and actual compromise.
Implications for MDR/SOC and Need for Real‑time Visibility
Managed Detection and Response (MDR) teams and Security Operations Centers (SOCs) have historically built their workflows around three pillars: threat‑feed enrichment, content inspection (e.g., HTTP/S payload analysis), and alert triage based on known indicators. When attackers bypass DNS and web inspection, those pillars lose efficacy. The delay in feed updates means analysts are often reacting to stale data, while the volume of noise generated by false positives can overwhelm limited resources. To close this gap, security teams must attain real‑time visibility at the network layer—leveraging flow data, passive DNS, and behavioral analytics that can spot anomalous IP‑to‑IP communication the moment it occurs. Integrating such telemetry with automated orchestration enables faster detection‑to‑decision‑to‑response cycles, reducing the likelihood that an evasive foothold escalates into a full‑blown incident.
Recorded Future Partners with Wipro for Managed Threat Intelligence
In response to the growing need for timely, contextual intelligence, Recorded Future announced a strategic partnership with Wipro to launch a Managed Threat Intelligence and Brand Monitoring service under Wipro’s MSSP portfolio. The offering merges Recorded Future’s AI‑driven threat‑intel engine—capable of ingesting open‑web, dark‑web, technical, and geopolitical data—with Wipro’s CyberShield managed security platform. Together, they aim to provide enterprises with a unified intelligence model that connects cyber risk, technology trends, geopolitical events, and business impact. Wipro will take the joint solution to market globally and will also employ the Recorded Future platform internally to harden its own digital footprint, illustrating a dual‑track approach of external sales and internal risk reduction.
Valiant Solutions Acquires BreakPoint Labs
Valiant Solutions bolstered its federal‑sector cybersecurity practice by acquiring BreakPoint Labs, a firm renowned for AI‑enabled cyber operations, adversarial threat emulation, red‑team exercises, modern DevSecOps, and software‑enabled mission support. This acquisition marks Valiant’s second strategic purchase in six months and expands its portfolio across operational technology security, advanced penetration testing, threat analytics, software‑factory enablement, and agent‑based cybersecurity workflow automation. The combined entity intends to deliver advanced cyber operations, automation, and security engineering tailored to high‑consequence government environments and critical national‑security missions, addressing the increasing demand for resilient, mission‑critical defenses against sophisticated state‑level threats.
Arpio Secures $15 M Series A Funding
Arpio, a provider of an AI‑native recovery and resilience platform for cloud environments, closed a $15 million Series A financing round co‑led by S3 Ventures and Paladin Capital Group, with additional participation from Draper Associates, Uncorrelated, Valor Ventures, CreativeCo Capital, and Lookout Ventures. The capital will be used to deepen Arpio’s recovery capabilities across AWS and Microsoft Azure, extend support for Google Cloud and other AI‑native services, and advance its broader cloud‑resilience roadmap. The platform automates disaster‑recovery orchestration, enables rapid restoration of workloads after ransomware, outages, or infrastructure failures, and validates recovery plans through continuous automated failover testing—capabilities that are increasingly vital as organizations adopt multi‑cloud strategies and face rising ransomware prevalence.
Conclusion / Outlook
The Unit 42 findings underscore a fundamental shift: attackers are exploiting the latency inherent in traditional feed‑based defenses by moving straight to IP addresses and rotating infrastructure faster than most intelligence sources can keep up. For MDR teams, SOC analysts, and MSSPs, the prescription is clear—invest in real‑time network‑layer telemetry, automate correlation and response, and augment static feeds with dynamic behavioral analytics. Simultaneously, the market is reacting with targeted partnerships and acquisitions that aim to bring richer, faster intelligence and specialized capabilities to the forefront. Recorded Future’s alliance with Wipro, Valiant’s integration of BreakPoint Labs, and Arpio’s fundraising illustrate a broader trend toward integrated, AI‑enhanced, and operationally focused security solutions that can keep pace with the speed of modern adversaries. Organizations that adopt these approaches will be better positioned to detect evasive threats early, reduce alert fatigue, and prevent incidents from cascading into costly breaches.