TrickBot has quietly evolved into a more covert threat by turning everyday DNS traffic into a stealth channel for malware commands, making its activity harder to spot on busy enterprise networks.

In a recent campaign, a new variant was seen hijacking Windows systems and using DNS queries and responses to move command and control data in ways that blend into normal internet lookups.

This allows attackers to keep remote control over compromised machines while staying below the radar of many traditional security controls.

The malware continues to target Microsoft Windows users, where it can grant an attacker complete control of the victim device, including running commands, loading modules, and injecting code into other processes.

Earlier generations of TrickBot mainly relied on HTTP traffic to talk to their control servers, which made network detection more straightforward.

In this latest analysis, however, analysts from Fortinet’s FortiGuard Labs observed samples that had shifted to DNS tunneling for their communication layer, marking a notable change in the family’s tradecraft.

Captured samples and analysis in a PE tool (Source - Fortinet) — Captured samples and analysis in a PE tool (Source – Fortinet)

Fortinet said in a report shared with Cyber Security News (CSN) that this TrickBot variant uses a modular design so attackers can download, execute, or inject different payloads based on what they want to achieve on a compromised host.

Some modules focus on executing Windows commands and PowerShell, while others support process hollowing, process doppelganging, and running raw shellcode directly in memory.

Readers who want a broader view of DNS abuse can compare this activity with recent coverage on hackers exploit DNS queries for C2 operations, which highlights how attackers are weaponizing the protocol for stealthy control channels.

Impact on victims goes beyond simple data theft, since the malware’s high severity rating reflects its ability to act as a flexible platform for further stages of an attack.

Once installed, TrickBot sets up persistence using Windows Task Scheduler, disguising itself as a seemingly harmless scheduled job with names such as “Wireshark autoupdate #72784” that run at startup and repeat every few minutes.

It also hides key configuration details inside NTFS Alternate Data Streams to avoid simple file-based checks that defenders might rely on.

By shifting to DNS tunneling, TrickBot also makes incident response more complex because malicious traffic is now mixed with routine activity like domain lookups that most organizations depend on every day.

This trend mirrors broader abuse of DNS-based channels seen in campaigns where threat actors hide exfiltration or control traffic inside protocol fields that appear benign at first glance, as detailed in research on hackers exploiting DNS tunneling service.

TrickBot Turns Ordinary DNS Traffic Into a Hidden Channel

The heart of this variant’s strategy is its ability to wrap command and control traffic inside what look like ordinary DNS queries to a domain under attacker control.

Before sending data, TrickBot encrypts its command payload with a simple XOR key, converts the result to hexadecimal, and formats it as a long subdomain string that is periodically split with dots to mimic a plausible domain structure.

Task created in the Task Scheduler (Source - Fortinet) — Task created in the Task Scheduler (Source – Fortinet)

That string is then appended to the constant domain “westurn.in,” creating a DNS query that appears normal to many network monitoring tools.

To ship these crafted queries, the malware relies on the Windows getaddrinfo() API and can route traffic through public DNS servers, including one at 8.8.8.8, which further blends its activity into common patterns seen on enterprise networks.

Inside the packets, TrickBot uses a small protocol of three packet types that support request data, size negotiation, and response content, with fragmentation logic to split larger payloads into manageable chunks.

During one test, it took about forty seconds to move a 1.2 MB file through this DNS tunnel, achieving a throughput of roughly 30.7 KB per second, slow but sufficient for commands and modules that do not need high speed.

For context on how other malware families are adopting similar ideas, check out researchers uncovered Zloader DNS tunneling tactics, which describes comparable C2 patterns in another threat family.

On the response side, the malware hides return data inside the IP addresses of DNS answers by encoding payload bytes across multiple IPv4 entries.

DNS tunneling model (Source - Fortinet) — DNS tunneling model (Source – Fortinet)

TrickBot reserves bits in the first octet of each IP address as an index value so it can later sort and reconstruct the original payload even if DNS resolvers reorder the addresses along the way.

After sorting by index, it reassembles three bytes of data from each address into a buffer, rebuilding the command results or module content sent back from the simulated control server.

Persistence, modular execution, and protections

Once running, TrickBot makes sure it survives reboots and cleanup attempts by creating scheduled tasks via the Task Scheduler COM interface and storing task names and executable paths as Base64 strings in hidden streams named “$TASK” and “$FILE.”

On subsequent runs, it reads these streams and recreates the task if needed, avoiding multiple duplicate jobs while ensuring the malware continues to launch on a regular schedule.

The variant’s command system uses a series of numeric codes to register victims, request tasks, download modules, and execute payloads, whether via rundll32, process injection, or direct command execution.

Data reassembled from sorted IP addresses (Source - Fortinet) — Data reassembled from sorted IP addresses (Source – Fortinet)

Related activity from TrickBot operators has been documented in earlier campaigns, such as TrickBot operators abusing Windows 10 App Installer, where the same ecosystem is used to deploy additional malware like BazarLoader.

The report maps this activity to several MITRE ATT&CK techniques, including DNS-based application protocols, protocol tunneling, scheduled tasks, NTFS artifact hiding, process injection approaches, signed binary proxy execution with rundll32, PowerShell-based command execution, and ingress tool transfer.

According to Fortinet, customers using its protections already have signatures that detect this TrickBot DNS tunneling variant and block its associated domain, while general best practices include monitoring DNS traffic for unusual patterns, inspecting scheduled tasks for odd update jobs, and watching for modules that execute via rundll32 or unexpected PowerShell activity.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
Domain	westurn.in	Command and control server domain used by the TrickBot DNS tunneling variant.
SHA-256 hash	DF527A5C2FBDE43816CD02F4CD49EEE4BB82FB4A3C7045021360888C7D504C98	TrickBot sample associated with this DNS tunneling campaign.
SHA-256 hash	6677EB2B3FFD288083C59A13D7BB712D4754AF61A5563873F76C440962346F41	TrickBot sample linked to the same campaign and sharing identical behavior.
SHA-256 hash	05F652E6B8F31C371F2385877E43B6772AFF5D3168D5D4635F8A1FCBB321421	Additional TrickBot sample from the analyzed campaign.
SHA-256 hash	33C331EDEDBF8EE9829895424423CE3FD17E359D2E784FCBCE396AACFF458CF5	TrickBot sample identified in FortiGuard Labs’ appendix of related binaries.
SHA-256 hash	3B19A82E1354AC14A3DA7C840CBDD0CE50DB38432D78E767B36F08E45024C23D	Further TrickBot sample tied to the DNS tunneling TrickBot variant.
SHA-256 hash	BF80245BA792992FBFE24ABAC33F8FD66F24CDEB5F0F21CFDF45A29D107C8D3B	TrickBot sample hash listed among the associated campaign artifacts.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

ALERT!: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.

The post TrickBot Turns Ordinary DNS Traffic Into a Hidden Channel for Malware Commands appeared first on Cyber Security News.