TrickBot Malware Variant Adopts DNS Tunneling for C2 Communications (westurn.in) — Threadlinqs Intelligence
As of 2026-07-23, TrickBot Malware Variant Adopts DNS Tunneling for C2 Communications (westurn.in) is a high-severity malware threat attributed to Periwinkle Tempest (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-1651 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Periwinkle Tempest · Russia · FINANCIAL
FortiGuard Labs identified a new TrickBot variant that replaces the trojan's decade-old HTTP C2 channel with a custom DNS tunneling protocol, XOR-encrypting (key 0xB9) and hex-encoding command data
On July 22-23, 2026, FortiGuard Labs published "Inside a TrickBot Variant Using DNS Tunneling for C2," documenting a 64-bit, unpacked TrickBot sample that abandons the malware family's traditional HTTP-based command-and-control channel in favor of a bespoke DNS tunneling protocol. Command data is XOR-encrypted with a static single-byte key (0xB9), converted to a hexadecimal string, and periodically dotted every 63 characters to mimic legitimate DNS label structure before being prepended to the decrypted hardcoded domain westurn.in. Three custom DNS packet types drive the protocol: 0x30 request packets (fragmented above 96 bytes), 0x31 size-query packets used to pre-allocate response buffers, and 0x32 response packets that smuggle data inside the octets of returned IPv4 addresses, using the high-order bits of the first octet as a packet index (supporting up to 63 addresses per exchange) and encoding up to 183 bytes of payload per response. The implementation includes logic to re-sort response packets to compensate for DNS resolver reordering. FortiGuard measured sustained throughput of approximately 30.7 KB/s, sufficient to move a 1.2 MB payload in roughly 40 seconds, entirely over what appears on the wire as ordinary DNS traffic to a public resolver (8.8.8.8), which allows the channel to bypass HTTP/TLS-focused network security controls (proxies, TLS inspection, web-filtering) that would otherwise catch legacy TrickBot beacons.
Victim registration mirrors legacy TrickBot's Anchor_DNS module convention, sending a formatted string in the pattern "/anchor_dns/[Client_ID]/0/[OS info]/[hardcoded IP 0.0.0.0]/[random 64-byte hex]/[32-byte verification string]" as Command 0. Command 1 requests tasking, with the C2 returning Base64-encoded module names and parameters. The malware supports 12 distinct response/execution primitives spanning Windows command execution, EXE download-and-execute, rundll32.exe-based execution (via the Control_RunDLL export), process hollowing (commands 5-6) and process doppelganging (commands 7-8) injection, anonymous-pipe command execution, PowerShell execution over pipes, and raw in-memory assembly/shellcode execution (command 11) - giving the operator a full modular tasking suite comparable to the malware's historic HTTP-based Anchor/gtag protocols.
Persistence is established via a COM-based Task Scheduler entry (Schedule.Service.1) that names itself after the malware's AppData folder plus "autoupdate #[random number]" (observed example: "Wireshark autoupdate #72784") and is configured to run every five minutes as well as at system startup. To avoid duplicate task creation and reduce forensic visibility, the malware stores the Base64-encoded task name and Base64-encoded executable path in NTFS Alternate Data Streams ($TASK and $FILE respectively) attached to the dropped binary rather than in plaintext registry or scheduler metadata alone.
Internally, the sample avoids traditional packer protection but relies on layered obfuscation: runtime string decryption using combined SUB/XOR instruction sequences, and dynamic Windows API resolution via a hash-based Get_API_By_Hash() routine that keeps references to sensitive APIs (e.g., Kernel32.dll exports) encrypted until execution time, complicating static analysis and signature-based detection.
TrickBot itself, tracked by MITRE ATT&CK as Software S0266, is a modular banking trojan first observed in 2016, developed and operated by the Russia-based financially motivated threat group Wizard Spider (aka UNC1878, TEMP.MixMaster, Grim Spider, FIN12, GOLD BLACKBURN, ITG23, Periwinkle Tempest, DEV-0193, Pistachio Tempest, DEV-0237 / MITRE G0102). Wizard Spider added Ryuk ransomware deployment capability via TrickBot in August 2018 and has since used the trojan as an initial-access and post-exploitation platform ahead of big-game-hunting ransomware operations across virtually all sectors. CISA/FBI joint advisory AA21-076A documents TrickBot's spearphishing-driven distr
Target sectors: finance, health, government administration, retail, manufacturing, education, professionalservices
Target regions: North America, Europe, australia
Detections & IOCs
As of 2026-07-24, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1071.004, T1572, T1571, T1008, T1132.001, T1573.001, T1105, T1071.001, T1053.005, T1564.004