New TrickBot Variant Uses DNS for Command & Control of Infected Windows Systems

Post Views: 3

Researchers at Fortinet’s FortiGuard Labs discovered a new iteration of TrickBot malware that employs DNS traffic to conceal command-and-control communications.

Discovery of the New TrickBot Variant

Researchers at Fortinet’s FortiGuard Labs discovered a new iteration of TrickBot malware that employs DNS traffic to conceal command-and-control communications. The Windows-based threat uses DNS tunneling to transmit instructions between compromised systems and its operators, bypassing traditional HTTP-based connections. This approach leverages the inherent trust placed in DNS services, allowing the malware to operate undetected within network environments.

Initial Detection

The initial detection occurred when FortiGuard analysts observed irregular DNS queries. Further investigation confirmed these requests were associated with a TrickBot variant utilizing DNS tunneling. Unlike earlier versions that relied on HTTP protocols, this strain encodes malicious commands within DNS queries and responses, making it harder to identify through conventional network monitoring.

DNS Tunneling Mechanism

DNS tunneling works by embedding non-standard data into DNS transactions, which are typically used to resolve domain names to IP addresses. In this case, the malware sends fragmented commands to the westurn.in domain via Google’s public DNS server at 8.8.8.8. The server’s response contains encoded data that appears as legitimate IP address information. TrickBot reconstructs these fragments to execute attacker-directed actions.

Controlled Environment Analysis

At the time of analysis, the original command-and-control server had been disabled. To study its behavior, researchers established a controlled environment mimicking the malicious infrastructure. This allowed them to observe how the malware receives additional modules and executes instructions.

Persistent Access Mechanisms

Once deployed, the malware creates a Windows scheduled task that activates at system startup and runs every five minutes. The task’s name is designed to mimic routine software updates, such as “Wireshark autoupdate” combined with a random identifier. To avoid detection, TrickBot stores the task’s configuration in NTFS Alternate Data Streams, a feature that allows data to be attached to files without appearing as separate entities. This technique obscures the malware’s presence during standard security audits.

Security Evasion Techniques

The malware also employs runtime encryption for internal strings and dynamically resolves Windows functions, complicating static analysis by security tools. These measures enhance its resilience against reverse engineering efforts.

Expanded Capabilities for Attackers

This variant supports a range of commands that grant adversaries extensive control over infected systems. Operators can access the Windows command prompt and PowerShell, enabling them to execute arbitrary code, deploy additional malware, or exfiltrate sensitive data. The ability to inject malicious processes and manipulate system services further expands the threat’s potential impact.

Coordinated Campaign Evidence

Multiple samples analyzed by FortiGuard exhibited identical startup behavior and file structures despite differing hash values, indicating a coordinated campaign. The malware is classified as W64/TrickBot.WC!tr by Fortinet’s antivirus solutions, with its associated command server domain marked as malicious.

Historical Context and Ongoing Threats

TrickBot first emerged in 2016 as a banking trojan before evolving into a modular platform for credential theft and ransomware distribution. Despite disruptions to its infrastructure in 2020 by Microsoft and cybersecurity firms, the malware remains active, with new variants continuously emerging.

Recommendations for Network Administrators

Network administrators are advised to monitor for anomalies such as unusually long DNS queries, repeated requests to unfamiliar subdomains, and scheduled tasks masquerading as legitimate updates. Additional indicators include elevated PowerShell activity, unauthorized DNS traffic, and the presence of unexplained services or process injections. The evolution of TrickBot underscores the importance of proactive threat detection and network segmentation to mitigate risks posed by advanced persistent threats.