TrickBot Malware Uses DNS for Covert Command and Control

Key Takeaways

• A new variant of TrickBot malware has been identified employing DNS tunneling for covert command and control (C2) communications.
• This tactic allows the malware to blend C2 traffic with legitimate DNS queries, making detection more challenging for traditional security systems.
• The malware targets Microsoft Windows systems, granting attackers full control, including command execution, module loading, and process injection.
• TrickBot establishes persistence through disguised Windows Task Scheduler entries and hides configuration data in NTFS Alternate Data Streams.
• Organizations should enhance DNS traffic monitoring and regularly inspect scheduled tasks for suspicious activity to mitigate this threat.

The notorious TrickBot malware has undergone a significant evolution, now utilizing ordinary DNS traffic to establish a stealthy channel for its command and control (C2) operations. This sophisticated technique allows the malware to operate largely undetected within enterprise networks, where DNS queries are a constant and often overlooked form of communication.

Recent analysis reveals a new TrickBot variant actively compromising Windows systems. Instead of relying on more easily detectable HTTP traffic, this variant leverages DNS queries and responses to transmit C2 data, camouflaging its malicious communications within routine internet lookups. This shift significantly enhances the attackers’ ability to maintain remote control over infected machines while evading many conventional security mechanisms.

The malware continues to pose a severe threat to Microsoft Windows users, capable of providing attackers with comprehensive control over victim devices. This includes the ability to execute arbitrary commands, load additional malicious modules, and inject code into legitimate processes, reflecting its high severity rating as a flexible platform for multi-stage attacks.

Earlier versions of TrickBot predominantly communicated with C2 servers via HTTP, which facilitated easier network detection. However, researchers at Fortinet’s FortiGuard Labs have documented a notable change in the malware family’s tactics, observing samples that have transitioned to DNS tunneling for their communication layer, as Fortinet said in a report shared with Cyber Security News (CSN).

Modular Design and Evasion Tactics

The Fortinet report highlights that this TrickBot variant employs a modular architecture, enabling attackers to dynamically download, execute, or inject various payloads tailored to their objectives on a compromised host. These modules range from those designed to execute Windows commands and PowerShell scripts to those supporting advanced evasion techniques like process hollowing, process doppelganging, and direct execution of raw shellcode in memory.

This evolving use of DNS for covert C2 operations is part of a broader trend where threat actors weaponize the protocol for stealthy control channels. For a deeper understanding of this phenomenon, readers can review how hackers exploit DNS queries for C2 operations.

The impact of this malware extends beyond mere data exfiltration, as its high severity stems from its role as a versatile platform for subsequent attack phases. TrickBot ensures its persistence across system reboots by configuring scheduled tasks via the Windows Task Scheduler, often masquerading as benign entries such as “Wireshark autoupdate #72784.” These tasks are set to run at startup and re-execute every few minutes. Furthermore, the malware conceals critical configuration data within NTFS Alternate Data Streams, a tactic designed to bypass basic file-based security scans.

The adoption of DNS tunneling complicates incident response efforts significantly. Malicious traffic is now interwoven with legitimate DNS activity, making it exceedingly difficult to differentiate and isolate. This strategy mirrors other campaigns where threat actors embed exfiltration or control signals within seemingly innocuous protocol fields, as highlighted by researchers uncovered Zloader DNS tunneling tactics.

Inside TrickBot’s DNS Tunneling Mechanism

At the core of this TrickBot variant’s stealth capability is its method of embedding C2 traffic within what appear to be standard DNS queries directed at attacker-controlled domains. Before transmission, the malware encrypts its C2 payload using a simple XOR key, converts the encrypted data to hexadecimal, and then structures it as a lengthy subdomain string. This string is strategically segmented with dots to mimic a legitimate domain structure, which is then appended to the constant domain “westurn.in”. This process results in a DNS query that largely bypasses many network monitoring tools due to its seemingly benign appearance.

To dispatch these specially crafted queries, TrickBot leverages the Windows getaddrinfo() API. It routes this traffic through public DNS servers, including 8.8.8.8, further obscuring its activities within typical enterprise network patterns. The malware employs a compact protocol with three distinct packet types for requesting data, negotiating payload sizes, and delivering response content. It also incorporates fragmentation logic to break down larger payloads into smaller, manageable chunks.

During testing, transferring a 1.2 MB file through this DNS tunnel took approximately 40 seconds, achieving a throughput of roughly 30.7 KB per second. While slow, this speed is adequate for transmitting commands and modules that do not require high bandwidth. For additional insights into how other malware families are adopting similar strategies, one can refer to research on researchers uncovered Zloader DNS tunneling tactics, which describes comparable C2 patterns in another threat family.

For inbound communications, TrickBot cleverly embeds response data within the IP addresses provided in DNS answers. It allocates specific bits in the first octet of each IP address to serve as an index. This indexing allows the malware to correctly sort and reconstruct the original payload, even if DNS resolvers alter the order of IP addresses during transmission. After reordering, three bytes of data from each IP address are reassembled into a buffer, reconstructing the full command results or module content sent from the simulated C2 server.

Persistence, Modular Execution

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.

Tags:

AttackExploitHackerMalwareSecurityThreat