Cybersecurity researchers at Fortinet’s FortiGuard Labs have identified a TrickBot variant that uses DNS tunneling to exchange commands with its operators. The Windows malware can download additional modules, run PowerShell code, inject code into other processes, and execute commands on an infected computer.
The samples were identified after FortiGuard Labs noticed malformed DNS queries. Further analysis confirmed that the traffic belonged to TrickBot variants using DNS in place of the HTTP connections seen in earlier versions.
TrickBot Uses DNS to Contact Its Operators
For better understanding, DNS normally translates website names into IP addresses. On the other hand, DNS tunneling abuses that process by placing non-DNS data inside queries and responses, allowing malware to communicate through a service that most networks need to keep available.
In this case, the TrickBot variant disguises its communications as ordinary website lookups. It breaks commands into small pieces, inserts them into requests for the westurn.in domain and sends them through Google’s public DNS service at 8.8.8.8.
The server replies with data made to look like normal IP address information. TrickBot collects those replies and rebuilds the attacker’s instructions or downloaded files on the infected computer. During Fortinet’s test, it transferred a 1.2 MB file in about 40 seconds.
By the time Fortinet examined the malware, its original control server had been taken offline. Researchers created a safe imitation of the server to confirm how TrickBot received commands and additional modules.
Scheduled Tasks Keep TrickBot Running
According to FortiGuard Labs’ technical blog post, on an infected computer, TrickBot creates a Windows scheduled task that runs at startup and repeats every five minutes. The task receives a name designed to resemble an ordinary software update, such as “Wireshark autoupdate” followed by a random number.
To keep track of the task, the malware stores its name and executable path in NTFS Alternate Data Streams. This Windows feature allows additional data to be attached to a file without appearing as a normal separate file, making the configuration less obvious during routine inspection.
Once active, the malware reads those stored values and recreates its scheduled task if needed. It also encrypts internal strings and resolves Windows functions at runtime, complicating static analysis.
Modules Can Give Attackers Full Control
The commands supported by this variant allow operators to download executable or DLL modules and run them through several methods. Downloaded code can be launched with rundll32.exe, injected into another process or executed directly within TrickBot’s memory.
Other commands provide access to the Windows command prompt and PowerShell. This gives an operator the ability to run commands, install further malware, and control the compromised computer.
Fortinet found multiple samples with different file hashes but identical startup code and behaviour, indicating that they belonged to the same campaign. The company’s antivirus products detect the files as W64/TrickBot.WC!tr, while the associated command server domain has been classified as malicious.
TrickBot’s History
TrickBot first appeared in 2016 as a banking trojan before developing into a modular malware platform used for credential theft and ransomware delivery.
In 2020, Microsoft and several cybersecurity companies disrupted much of its infrastructure, but subsequent research continued to identify TrickBot-related activity.
Nevertheless, for Windows administrators, unusually long DNS queries, repeated requests involving unfamiliar subdomains, and scheduled tasks disguised as software updates warrant investigation.
Additionally, monitoring PowerShell activity, new services, process injection, and unauthorized DNS traffic can also help identify compromised computers.
