New TrickBot Malware Variant Uses DNS Tunneling for Command-and-Control

A new TrickBot malware variant that significantly evolves its command-and-control (C2) communication by leveraging DNS tunneling, replacing the traditional HTTP-based mechanisms observed in earlier campaigns.

The discovery highlights a continued shift among financially motivated threat actors toward stealthier communication channels designed to evade network detection and security controls.

However, the newly analyzed samples demonstrate a clear transition to DNS-based communication, embedding encrypted payloads within malformed DNS queries sent through public resolvers such as 8.8.8.8.

Despite differing file hashes, the captured samples share identical PE structures and execution flows, confirming their origin from a single campaign.

Static analysis reveals that the payload is a 64-bit executable without packer protection, but it employs layered obfuscation techniques to resist reverse engineering.

Constant strings, including critical API references like Kernel32.dll, are encrypted and decrypted at runtime using XOR and subtraction operations.

Additionally, all Windows API calls are dynamically resolved through hash-based lookups via a routine commonly referred to as Get_API_By_Hash(), complicating static detection and analysis workflows.

Persistence is achieved through abuse of the Windows Task Scheduler. The malware creates scheduled tasks with deceptive naming patterns such as “Wireshark autoupdate #<random>,” blending into legitimate system activity.

These tasks are configured to execute every five minutes and at system startup.

TrickBot executable is launched with no parameters or without the “-u” flag, it executes the persistence maintenance workflow to create a new task that runs every several minutes.

Notably, TrickBot stores task metadata and executable paths within NTFS Alternate Data Streams (ADS), specifically in $TASK and $FILE streams encoded in Base64, ensuring persistence without creating obvious filesystem artifacts.

FortiGuard Labs said in a report shared with GBhackers, TrickBot, a long-standing modular malware family linked to numerous ransomware operations and post-exploitation frameworks, has historically relied on HTTP for C2 traffic.

The most significant enhancement lies in its DNS tunneling implementation. The malware encrypts C2 data using an XOR key (0xB9), converts it into hexadecimal format, and segments it into subdomains appended to attacker-controlled domains such as “.westurn.in.”

These crafted domains are resolved via standard DNS queries, effectively disguising malicious traffic as legitimate DNS activity.

TrickBot Malware Variant Uses DNS

Communication occurs through a structured packet system consisting of three types: 0x30 (request), 0x31 (size query), and 0x32 (response).

Data exfiltration and command delivery are fragmented across multiple packets, with each fragment carefully reconstructed on the receiving end.

In DNS responses, TrickBot encodes payload data within IPv4 addresses by utilizing the high-order bits of each octet as indexing markers.

This allows up to 183 bytes of data per response packet, with built-in logic to reorder packets in case of DNS resolver-induced shuffling.

To facilitate analysis after the original C2 infrastructure was offline, researchers simulated a DNS server, confirming that TrickBot maintains compatibility with its legacy HTTP command structure.

Commands such as “0” (victim registration) and “1” (task retrieval) remain intact, while additional commands support module downloads, process injection via techniques like process hollowing and doppelgänging, and execution of PowerShell or raw assembly code.

Performance testing indicates that DNS tunneling achieves transfer speeds of approximately 30.7 KB/s, allowing a 1.2 MB payload to be delivered in under a minute sufficient for modular payload staging in real-world attacks.

This development aligns with broader industry observations documented by MITRE ATT&CK (T1071.004 – Application Layer Protocol: DNS) and recent CISA advisories warning of increased abuse of DNS for covert communication.

Security teams are advised to implement deep DNS inspection, anomaly detection for long or malformed queries, and monitoring of unusual resolver traffic patterns to identify similar threats.

The emergence of DNS-based TrickBot variants reinforces the malware’s adaptability and persistence in modern threat landscapes, underscoring the need for enhanced visibility into encrypted and covert network channels.

IOCs

C2 server domain	Malware family	Sample SHA-256	Note
westurn.in	TrickBot	DF527A5C2FBDE43816CD02F4CD49EEE4BB82FB4A3C7045021360888C7D504C98	TrickBot sample
westurn.in	TrickBot	6C677EB2B3FFD288083C59A13D7BB712D4754AF61A5563873F76C440962346F4	TrickBot sample
westurn.in	TrickBot	105F652E6B8F31C371F2385877E43B6772AFF5D3168D5D4635F8A1FCBB321421	TrickBot sample
westurn.in	TrickBot	33C331EDEDBF8EE9829895424423CE3FD17E359D2E784FCBCE396AACFF458CF5	TrickBot sample
westurn.in	TrickBot	3B19A82E1354AC14A3DA7C840CBDD0CE50DB38432D78E767B36F08E45024C23D	TrickBot sample
westurn.in	TrickBot	BF80245BA792992FBFE24ABAC33F8FD66F24CDEB5F0F21CFDF45A29D107C8D3B	TrickBot sample

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist