Cybersecurity researchers have identified a sophisticated new variant of the TrickBot malware that has abandoned its traditional HTTP-based communication infrastructure in favor of a bespoke DNS tunneling scheme. This architectural shift, documented in recent findings from Fortinet’s FortiGuard Labs, represents a significant evolution for one of the world’s most resilient botnets. By hiding its command-and-control (C2) beacons and data payloads within malformed DNS queries, the malware aims to bypass standard network security filters that typically scrutinize HTTP and HTTPS traffic while allowing DNS traffic to pass relatively unhindered.
The discovery, published on July 22, 2024, reveals that while the core modular nature of TrickBot remains intact, the transport layer has been entirely redesigned. The new variant leverages encrypted data smuggled through DNS packets directed at public resolvers, a technique that significantly complicates detection for enterprise security teams. This development is particularly noteworthy given the history of the TrickBot operation, which many analysts believed had been permanently crippled following a massive, coordinated takedown by Microsoft and international law enforcement agencies in late 2020.
The Technical Mechanics of DNS Tunneling in TrickBot
The primary innovation in this TrickBot variant is the transition from standard web-based protocols to Domain Name System (DNS) tunneling. In a typical network environment, DNS is used to translate human-readable domain names into IP addresses. Because DNS is fundamental to the functioning of the internet, many organizations do not apply the same level of inspection to DNS traffic as they do to web traffic. TrickBot operators have exploited this trust by embedding malicious commands and data within the structure of DNS queries.
Once a system is compromised, the malware initiates its C2 communication by disguising outbound messages as ordinary domain-name lookups. However, these lookups do not point to legitimate websites. Instead, the outbound channel encrypts each command using a single-byte XOR key. The resulting ciphertext is then hex-encoded and fragmented into 63-character strings—the maximum length allowed for a single DNS label. These chunks are separated by periods to mimic a valid, multi-level domain name and are then prepended to a hardcoded C2 domain controlled by the attackers.
FortiGuard Labs identified three specific packet types used to facilitate this traffic:
- 0x30: Used for initial command requests from the infected host.
- 0x31: Used for size queries to determine the volume of data being sent or received.
- 0x32: Used for the actual transmission of response data from the C2 server.
The inbound traffic mechanism is equally ingenious, exploiting the DNS specification’s allowance for multiple IPv4 addresses in a single reply. When the C2 server responds, it sends what appears to be a list of IP addresses. TrickBot is programmed to treat the first byte of each returned "address" as an ordering index. This allows the malware to re-sort the packets if they arrive out of order due to the resolver’s behavior. The remaining three bytes of each IP address are then read as raw payload data. This method allows the botnet to reconstruct complex files and instructions from seemingly random networking data.
Despite the overhead associated with DNS tunneling, the performance observed in laboratory settings was surprisingly efficient. Researchers measured a throughput of approximately 30.7 KB per second, allowing the malware to transfer a 1.2 MB file in roughly 40 seconds. While slower than traditional HTTP transfers, this speed is more than sufficient for the delivery of modular payloads and the exfiltration of sensitive credentials.
Persistence and the Use of Windows Task Scheduler
To ensure long-term survival on a victim’s machine, this TrickBot variant utilizes the Windows Task Scheduler with a high degree of randomization to avoid detection by behavior-based security tools. The malware generates a task name by combining a randomly selected folder name from the %AppData% directory with the string "autoupdate #" followed by a random integer. This results in innocuous-looking scheduled tasks such as "Wireshark autoupdate #72784."
These tasks are configured to execute every five minutes, ensuring the malware remains active even if the initial process is terminated or the system is rebooted. To manage these tasks without creating suspicious duplicates, the malware utilizes NTFS Alternate Data Streams (ADS). By storing the task name and the executable path in these hidden streams, the malware can check for its own presence and rebuild the scheduled task if it is deleted, all while keeping the configuration data invisible to standard file explorers.
This use of ADS is a classic "living off the land" technique, leveraging legitimate Windows file system features to hide malicious intent. By embedding data in these streams, TrickBot avoids creating new, conspicuous files on the disk, further lowering its forensic footprint.
A History of Resilience: The TrickBot Chronology
The emergence of this DNS-based variant is the latest chapter in a decade-long history of cybercrime. TrickBot first appeared in 2016, believed to be a successor to the Dyre banking trojan. Initially focused on stealing financial credentials from customers of global banks, it quickly evolved into a multi-purpose "malware-as-a-service" (MaaS) platform.
2016–2019: Expansion and Ransomware Partnerships
During its early years, TrickBot expanded its module library to include capabilities for network reconnaissance, credential harvesting from browsers and email clients, and lateral movement within corporate networks. It became a primary delivery mechanism for high-stakes ransomware, most notably Ryuk and Conti.
2020: The Global Takedown
In October 2020, just ahead of the U.S. presidential election, Microsoft’s Digital Crimes Unit, in collaboration with telecommunications providers and security firms like ESET and Lumen’s Black Lotus Labs, executed a court-ordered disruption. The operation successfully cut off the botnet’s infrastructure, which at the time consisted of over one million infected devices. While the takedown was hailed as a major victory, experts warned that the core developers remained at large.
2021–2023: Fragmentation and Absorption
Following the 2020 disruption, the TrickBot group appeared to fragment. Reports suggested that members of the group were absorbed into the Conti ransomware collective or moved on to develop new strains like BazarBackdoor and Emotet. By 2023, many industry reports had begun to refer to TrickBot in the past tense.
2024: The Return via DNS
The discovery of the DNS tunneling variant proves that the operators behind TrickBot never truly disappeared. Instead, they spent the intervening years re-engineering their platform to survive in an era of heightened network monitoring and more aggressive law enforcement intervention.
Modular Execution and Command Capabilities
The modular nature of TrickBot remains its most dangerous attribute. Once the DNS-based C2 channel is established, the malware can deploy a variety of specialized modules depending on the nature of the target. FortiGuard Labs documented 12 distinct response commands that the malware is capable of executing:
- EXE and DLL Execution: Downloading and running additional malicious binaries or libraries.
- Process Injection: Utilizing advanced techniques like "process hollowing" or "process doppelganging" to inject malicious code into the memory space of legitimate system processes.
- PowerShell Integration: Executing complex scripts through anonymous pipes to the command line, allowing for fileless attacks.
- Raw Shellcode: Running arbitrary code directly in memory to bypass disk-based antivirus scanning.
To further frustrate analysis, the malware uses runtime-decrypted strings and hash-based Windows API resolution. This means that an analyst looking at the static code would not see recognizable function names or text strings, as they only exist in a readable state while the malware is actually running in memory.
Expert Analysis and Industry Implications
The survival of TrickBot is a testament to the adaptability of modern cyber-criminal organizations. John Bambenek, president of Bambenek Consulting, noted that the malware’s longevity is directly tied to the adversary’s willingness to iterate on their design. "TrickBot has been a long-running malware family that has survived because the adversary adapts," Bambenek stated. He emphasized that passive DNS analysis of the C2 identified in the report showed extensive exploitation activity, reinforcing the need for enterprises to maintain strict control over their DNS resolution processes.
The shift to DNS tunneling highlights a broader trend in the threat landscape: the move toward "covert channels" that exploit foundational internet protocols. As organizations get better at monitoring HTTP/S traffic, attackers are forced to find alternative paths. DNS, ICMP (ping), and even cloud-based services like Microsoft 365 calendars are increasingly being hijacked for C2 purposes.
For enterprise defenders, the implications are clear. Traditional perimeter defenses are no longer sufficient if they do not include deep inspection of DNS traffic. Security experts recommend that organizations implement DNS filtering, monitor for unusually long or high-frequency DNS queries, and consider using "Sinkholing" techniques to redirect traffic intended for known malicious domains.
Conclusion: The Persistent Threat of the "Botnet That Wouldn’t Die"
The re-emergence of TrickBot via DNS tunneling serves as a stark reminder that the "takedown" of a botnet is rarely a permanent solution. As long as the developers remain active and the financial incentives for cybercrime exist, malware families will continue to evolve. This latest variant proves that TrickBot is no longer just a banking trojan or a simple loader; it is a highly sophisticated, stealthy, and adaptable platform capable of maintaining a foothold in the most secure environments.
As the cybersecurity community continues to analyze this new variant, the focus must shift from simple signature-based detection to behavioral analysis and the rigorous monitoring of all network protocols—not just the ones that are easiest to watch. The story of TrickBot is far from over, and its latest transformation suggests that the battle for network integrity is entering a more complex and covert phase.
