TrickBot has quietly evolved into a more covert threat by turning everyday DNS traffic into a stealth channel for malware commands, making its activity harder to spot on busy enterprise networks.
In a recent campaign, a new variant was seen hijacking Windows systems and using DNS queries and responses to move command and control data in ways that blend into normal internet lookups.
This allows attackers to keep remote control over compromised machines while staying below the radar of many traditional security controls.
The malware continues to target Microsoft Windows users, where it can grant an attacker complete control of the victim device, including running commands, loading modules, and injecting code into other processes.
Earlier generations of TrickBot mainly relied on HTTP traffic to talk to their control servers, which made network detection more straightforward.
In this latest analysis, however, analysts from Fortinet’s FortiGuard Labs observed samples that had shifted to DNS tunneling for their communication layer, marking a notable change in the family’s tradecraft.
Fortinet said in a report shared with Cyber Security News (CSN) that this TrickBot variant uses a modular design so attackers can download, execute, or inject different payloads based on what they want to achieve on a compromised host.
Some modules focus on executing Windows commands and PowerShell, while others support process hollowing, process doppelganging, and running raw shellcode directly in memory.
Readers who want a broader view of DNS abuse can compare this activity with recent coverage on hackers exploit DNS queries for C2 operations, which highlights how attackers are weaponizing the protocol for stealthy control channels.
Impact on victims goes beyond simple data theft, since the malware’s high severity rating reflects its ability to act as a flexible platform for further stages of an attack.
Once installed, TrickBot sets up persistence using Windows Task Scheduler, disguising itself as a seemingly harmless scheduled job with names such as “Wireshark autoupdate #72784” that run at startup and repeat every few minutes.
It also hides key configuration details inside NTFS Alternate Data Streams to avoid simple file-based checks that defenders might rely on.
By shifting to DNS tunneling, TrickBot also makes incident response more complex because malicious traffic is now mixed with routine activity like domain lookups that most organizations depend on every day.
This trend mirrors broader abuse of DNS-based channels seen in campaigns where threat actors hide exfiltration or control traffic inside protocol fields that appear benign at first glance, as detailed in research on hackers exploiting DNS tunneling service.
TrickBot Turns Ordinary DNS Traffic Into a Hidden Channel
The heart of this variant’s strategy is its ability to wrap command and control traffic inside what look like ordinary DNS queries to a domain under attacker control.
Before sending data, TrickBot encrypts its command payload with a simple XOR key, converts the result to hexadecimal, and formats it as a long subdomain string that is periodically split with dots to mimic a plausible domain structure.
That string is then appended to the constant domain “westurn.in,” creating a DNS query that appears normal to many network monitoring tools.
To ship these crafted queries, the malware relies on the Windows getaddrinfo() API and can route traffic through public DNS servers, including one at 8.8.8.8, which further blends its activity into common patterns seen on enterprise networks.
Inside the packets, TrickBot uses a small protocol of three packet types that support request data, size negotiation, and response content, with fragmentation logic to split larger payloads into manageable chunks.
During one test, it took about forty seconds to move a 1.2 MB file through this DNS tunnel, achieving a throughput of roughly 30.7 KB per second, slow but sufficient for commands and modules that do not need high speed.
For context on how other malware families are adopting similar ideas, check out researchers uncovered Zloader DNS tunneling tactics, which describes comparable C2 patterns in another threat family.
On the response side, the malware hides return data inside the IP addresses of DNS answers by encoding payload bytes across multiple IPv4 entries.
TrickBot reserves bits in the first octet of each IP address as an index value so it can later sort and reconstruct the original payload even if DNS resolvers reorder the addresses along the way.
After sorting by index, it reassembles three bytes of data from each address into a buffer, rebuilding the command results or module content sent back from the simulated control server.
Persistence, modular execution, and protections
Once running, TrickBot makes sure it survives reboots and cleanup attempts by creating scheduled tasks via the Task Scheduler COM interface and storing task names and executable paths as Base64 strings in hidden streams named “$TASK” and “$FILE.”
On subsequent runs, it reads these streams and recreates the task if needed, avoiding multiple duplicate jobs while ensuring the malware continues to launch on a regular schedule.
The variant’s command system uses a series of numeric codes to register victims, request tasks, download modules, and execute payloads, whether via rundll32, process injection, or direct command execution.
Related activity from TrickBot operators has been documented in earlier campaigns, such as TrickBot operators abusing Windows 10 App Installer, where the same ecosystem is used to deploy additional malware like BazarLoader.
The report maps this activity to several MITRE ATT&CK techniques, including DNS-based application protocols, protocol tunneling, scheduled tasks, NTFS artifact hiding, process injection approaches, signed binary proxy execution with rundll32, PowerShell-based command execution, and ingress tool transfer.
According to Fortinet, customers using its protections already have signatures that detect this TrickBot DNS tunneling variant and block its associated domain, while general best practices include monitoring DNS traffic for unusual patterns, inspecting scheduled tasks for odd update jobs, and watching for modules that execute via rundll32 or unexpected PowerShell activity.
Indicators of Compromise (IoCs):-
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
