Unit 42 measured a large share of C2-active malware that connected straight to IP addresses, sidestepping DNS and the visibility layer many security teams still depend on.