TrickBot Malware Variant Adopts DNS Tunneling for C2 Communications (westurn.in)
TrickBot Malware Variant Adopts DNS Tunneling for C2 (TL-2026-1651), also tracked as TrickBot DNS Tunneling Variant, is a high-severity malware campaign, first published 2026-07-23. It is attributed to Periwinkle Tempest (Russia) with medium confidence, affects Microsoft Windows, maps to 30 MITRE ATT&CK techniques (T1008, T1016, T1027), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-1651
- Threat ID
- TL-2026-1651
- Also known as
- TrickBot DNS Tunneling Variant, Anchor_DNS-style TrickBot
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-23
- Last reviewed
- 2026-07-23
- Attribution
- Periwinkle Tempest
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- finance, health, government administration, retail, manufacturing, education, professionalservices
- Target regions
- North America, Europe, australia
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in TrickBot Malware Variant Adopts DNS Tunneling for C2
Malware and tooling: Anchor - S0504, BazarBackdoor, TrickBot
FortiGuard Labs identified a new TrickBot variant that replaces the trojan's decade-old HTTP C2 channel with a custom DNS tunneling protocol, XOR-encrypting (key 0xB9) and hex-encoding command data into subdomains of westurn.in resolved through public DNS resolvers such as 8.8.8.8. The sample persists via a disguised Windows Task Scheduler entry backed by NTFS Alternate Data Streams and retains full legacy HTTP command support including process hollowing, process doppelganging, and PowerShell/raw-assembly execution.
How TrickBot Malware Variant Adopts DNS Tunneling for C2 works
On July 22-23, 2026, FortiGuard Labs published "Inside a TrickBot Variant Using DNS Tunneling for C2," documenting a 64-bit, unpacked TrickBot sample that abandons the malware family's traditional HTTP-based command-and-control channel in favor of a bespoke DNS tunneling protocol. Command data is XOR-encrypted with a static single-byte key (0xB9), converted to a hexadecimal string, and periodically dotted every 63 characters to mimic legitimate DNS label structure before being prepended to the decrypted hardcoded domain westurn.in. Three custom DNS packet types drive the protocol: 0x30 request packets (fragmented above 96 bytes), 0x31 size-query packets used to pre-allocate response buffers, and 0x32 response packets that smuggle data inside the octets of returned IPv4 addresses, using the high-order bits of the first octet as a packet index (supporting up to 63 addresses per exchange) and encoding up to 183 bytes of payload per response. The implementation includes logic to re-sort response packets to compensate for DNS resolver reordering. FortiGuard measured sustained throughput of approximately 30.7 KB/s, sufficient to move a 1.2 MB payload in roughly 40 seconds, entirely over what appears on the wire as ordinary DNS traffic to a public resolver (8.8.8.8), which allows the channel to bypass HTTP/TLS-focused network security controls (proxies, TLS inspection, web-filtering) that would otherwise catch legacy TrickBot beacons.
Victim registration mirrors legacy TrickBot's Anchor_DNS module convention, sending a formatted string in the pattern "/anchor_dns/[Client_ID]/0/[OS info]/[hardcoded IP 0.0.0.0]/[random 64-byte hex]/[32-byte verification string]" as Command 0. Command 1 requests tasking, with the C2 returning Base64-encoded module names and parameters. The malware supports 12 distinct response/execution primitives spanning Windows command execution, EXE download-and-execute, rundll32.exe-based execution (via the Control_RunDLL export), process hollowing (commands 5-6) and process doppelganging (commands 7-8) injection, anonymous-pipe command execution, PowerShell execution over pipes, and raw in-memory assembly/shellcode execution (command 11) - giving the operator a full modular tasking suite comparable to the malware's historic HTTP-based Anchor/gtag protocols.
Persistence is established via a COM-based Task Scheduler entry (Schedule.Service.1) that names itself after the malware's AppData folder plus "autoupdate #[random number]" (observed example: "Wireshark autoupdate #72784") and is configured to run every five minutes as well as at system startup. To avoid duplicate task creation and reduce forensic visibility, the malware stores the Base64-encoded task name and Base64-encoded executable path in NTFS Alternate Data Streams ($TASK and $FILE respectively) attached to the dropped binary rather than in plaintext registry or scheduler metadata alone.
Internally, the sample avoids traditional packer protection but relies on layered obfuscation: runtime string decryption using combined SUB/XOR instruction sequences, and dynamic Windows API resolution via a hash-based Get_API_By_Hash() routine that keeps references to sensitive APIs (e.g., Kernel32.dll exports) encrypted until execution time, complicating static analysis and signature-based detection.
TrickBot itself, tracked by MITRE ATT&CK as Software S0266, is a modular banking trojan first observed in 2016, developed and operated by the Russia-based financially motivated threat group Wizard Spider (aka UNC1878, TEMP.MixMaster, Grim Spider, FIN12, GOLD BLACKBURN, ITG23, Periwinkle Tempest, DEV-0193, Pistachio Tempest, DEV-0237 / MITRE G0102). Wizard Spider added Ryuk ransomware deployment capability via TrickBot in August 2018 and has since used the trojan as an initial-access and post-exploitation platform ahead of big-game-hunting ransomware operations across virtually all sectors. CISA/FBI joint advisory AA21-076A documents TrickBot's spearphishing-driven distribution, credential-theft and SMB-based lateral movement capability, and recommends blocking known-malicious IPs, enforcing SMBv2+ (disabling SMBv1), and phishing awareness training as core mitigations - guidance that remains applicable to this DNS-tunneling variant since initial delivery and legacy HTTP fallback modules are unchanged.
Fortinet has released matching detection content: IPS signature "Trick.Botnet", antivirus signature "W64/TrickBot.WC!tr", web-filtering classification of westurn.in as malicious, and Botnet C2 Domain Database coverage of the observed infrastructure.
MITRE ATT&CK techniques used in TL-2026-1651
Command and Control
T1008 Fallback Channels; T1071.001 Web Protocols; T1071.004 DNS; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding; T1571 Non-Standard Port; T1572 Protocol Tunneling; T1573.001 Symmetric Cryptography
Discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1082 System Information Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1036 Masquerading; T1055.012 Process Hollowing; T1055.013 Process Doppelgänging; T1140 Deobfuscate/Decode Files or Information; T1218.011 Rundll32; T1497.003 Time Based Checks; T1564.004 NTFS File Attributes
Persistence
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1106 Native API; T1559.001 Component Object Model
collection
T1185 Browser Session Hijacking
Lateral Movement
T1210 Exploitation of Remote Services
Credential Access
T1555.003 Credentials from Web Browsers
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Affected products and versions in TrickBot Malware Variant Adopts DNS Tunneling for C2
- Microsoft — Windows
Vulnerable versions: All supported 64-bit Windows versions
Remediation for TrickBot Malware Variant Adopts DNS Tunneling for C2
Immediate actions
- Block/sinkhole the C2 domain westurn.in and any subdomains matching hex-encoded label patterns at the DNS resolver/firewall
- Deploy Fortinet IPS signature Trick.Botnet and AV signature W64/TrickBot.WC!tr where Fortinet security stack is in use
- Hunt for scheduled tasks named '[AppData folder] autoupdate #[random number]' (e.g. 'Wireshark autoupdate #72784') configured to run every 5 minutes
- Inspect NTFS Alternate Data Streams ($TASK, $FILE) on suspicious executables in user AppData paths for Base64-encoded task/path artifacts
- Isolate and reimage hosts matching the listed SHA-256 hashes
Workarounds
- Where DNS tunneling monitoring is unavailable, block outbound UDP/53 and TCP/53 to non-approved resolvers at the network perimeter as a stopgap
Longer-term hardening
- Deploy DNS query monitoring/analytics capable of flagging anomalously long hexadecimal subdomain labels and high-volume queries to a single apex domain (DNS tunneling detection)
- Restrict endpoint DNS resolution to internal/enterprise resolvers only, blocking direct outbound queries to public resolvers (8.8.8.8, 1.1.1.1, etc.) from workstations
- Enforce SMBv2+ and disable SMBv1 network-wide to blunt TrickBot's lateral-movement modules
- Deploy EDR with behavioral detection for process hollowing, process doppelganging, and rundll32.exe-based execution chains
- Conduct recurring phishing-simulation and social-engineering awareness training given TrickBot's primary delivery vector
Timeline of TrickBot Malware Variant Adopts DNS Tunneling for C2
- TrickBot malware family first identified as a likely successor to the Dyre banking trojan, developed by Wizard Spider.
- Wizard Spider adds Ryuk ransomware deployment capability to TrickBot infection chains, pivoting the malware toward big-game-hunting operations.
- SentinelOne documents the Wizard Spider 'Anchor' project adding an ICMP-based C2 module (IcmpSendEcho2) to the existing Anchor_DNS tunneling module, with samples tied to the westurn[.]in domain also seen in the 2026 variant.
- CISA publishes advisory AA20-302A detailing Wizard Spider's Anchor_DNS module for DNS-tunneling-based data exfiltration, the direct architectural predecessor of the 2026 C2 protocol.
- CISA and FBI publish joint advisory AA21-076A documenting continued TrickBot spearphishing campaigns and mitigation guidance.
- FortiGuard Labs publishes technical analysis 'Inside a TrickBot Variant Using DNS Tunneling for C2', documenting the new DNS-tunneling C2 protocol, packet types 0x30/0x31/0x32, and Task Scheduler/NTFS ADS persistence.
- TL-Intel Harness ingests the reporting and documents the DNS-tunneling TrickBot variant as TL-2026-1651 with full MITRE ATT&CK mapping and IOC extraction.
- GBHackers, Infosecurity Magazine, and SC Media publish coverage summarizing the FortiGuard findings and associated IOCs.
Sources cited for TrickBot Malware Variant Adopts DNS Tunneling for C2
- TrickBot Malware Variant Uses DNS Tunneling
- Inside a TrickBot Variant Using DNS Tunneling for C2
- Inside a TrickBot Variant Using DNS Tunneling for C2 (mirror)
- TrickBot Ditches HTTP for DNS Tunneling in Latest Variant
- TrickBot variant uses DNS tunneling for command and control
- TrickBot, Software S0266
- Wizard Spider, Group G0102
- AA21-076A: TrickBot Malware
- Anchor Project for TrickBot Adds ICMP
- AA20-302A: Ransomware Activity Targeting the Healthcare and Public Health Sector (Anchor_DNS)
Threats related to TrickBot Malware Variant Adopts DNS Tunneling for C2
- TrickBot Banking Trojan (Anchor_DNS) Uses DNS Tunneling Over westurn.in for Covert C2
- SystemBC (Coroxy / DroxiDat) Malware: Multi-Purpose SOCKS5/Tor Proxy Backdoor Enabling Ransomware Operations
- Latrodectus Loader: Three-Stage JScript/VBScript Obfuscation Delivers WMI/msiexec MSI Payload (sokingscrosshotel[.]com)
Detection coverage for TL-2026-1651
As of 2026-07-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1651 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.