# TrickBot Malware Variant Adopts DNS Tunneling for C2 Communications (westurn.in)

> FortiGuard Labs identified a new TrickBot variant that replaces the trojan's decade-old HTTP C2 channel with a custom DNS tunneling protocol, XOR-encrypting (key 0xB9) and hex-encoding command data into subdomains of westurn.in resolved through public DNS resolvers such as 8.8.8.8. The sample persists via a disguised Windows Task Scheduler entry backed by NTFS Alternate Data Streams and retains full legacy HTTP command support including process hollowing, process doppelganging, and PowerShell/raw-assembly execution.

- **Published:** 2026-07-23T00:00:00Z
- **Last reviewed:** 2026-07-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1651
- **ID:** TL-2026-1651
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Periwinkle Tempest (Russia)
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On July 22-23, 2026, FortiGuard Labs published "Inside a TrickBot Variant Using DNS Tunneling for C2," documenting a 64-bit, unpacked TrickBot sample that abandons the malware family's traditional HTTP-based command-and-control channel in favor of a bespoke DNS tunneling protocol. Command data is XOR-encrypted with a static single-byte key (0xB9), converted to a hexadecimal string, and periodically dotted every 63 characters to mimic legitimate DNS label structure before being prepended to the decrypted hardcoded domain westurn.in. Three custom DNS packet types drive the protocol: 0x30 request packets (fragmented above 96 bytes), 0x31 size-query packets used to pre-allocate response buffers, and 0x32 response packets that smuggle data inside the octets of returned IPv4 addresses, using the high-order bits of the first octet as a packet index (supporting up to 63 addresses per exchange) and encoding up to 183 bytes of payload per response. The implementation includes logic to re-sort response packets to compensate for DNS resolver reordering. FortiGuard measured sustained throughput of approximately 30.7 KB/s, sufficient to move a 1.2 MB payload in roughly 40 seconds, entirely over what appears on the wire as ordinary DNS traffic to a public resolver (8.8.8.8), which allows the channel to bypass HTTP/TLS-focused network security controls (proxies, TLS inspection, web-filtering) that would otherwise catch legacy TrickBot beacons.

Victim registration mirrors legacy TrickBot's Anchor_DNS module convention, sending a formatted string in the pattern "/anchor_dns/[Client_ID]/0/[OS info]/[hardcoded IP 0.0.0.0]/[random 64-byte hex]/[32-byte verification string]" as Command 0. Command 1 requests tasking, with the C2 returning Base64-encoded module names and parameters. The malware supports 12 distinct response/execution primitives spanning Windows command execution, EXE download-and-execute, rundll32.exe-based execution (via the Control_RunDLL export), process hollowing (commands 5-6) and process doppelganging (commands 7-8) injection, anonymous-pipe command execution, PowerShell execution over pipes, and raw in-memory assembly/shellcode execution (command 11) - giving the operator a full modular tasking suite comparable to the malware's historic HTTP-based Anchor/gtag protocols.

Persistence is established via a COM-based Task Scheduler entry (Schedule.Service.1) that names itself after the malware's AppData folder plus "autoupdate #[random number]" (observed example: "Wireshark autoupdate #72784") and is configured to run every five minutes as well as at system startup. To avoid duplicate task creation and reduce forensic visibility, the malware stores the Base64-encoded task name and Base64-encoded executable path in NTFS Alternate Data Streams ($TASK and $FILE respectively) attached to the dropped binary rather than in plaintext registry or scheduler metadata alone.

Internally, the sample avoids traditional packer protection but relies on layered obfuscation: runtime string decryption using combined SUB/XOR instruction sequences, and dynamic Windows API resolution via a hash-based Get_API_By_Hash() routine that keeps references to sensitive APIs (e.g., Kernel32.dll exports) encrypted until execution time, complicating static analysis and signature-based detection.

TrickBot itself, tracked by MITRE ATT&CK as Software S0266, is a modular banking trojan first observed in 2016, developed and operated by the Russia-based financially motivated threat group Wizard Spider (aka UNC1878, TEMP.MixMaster, Grim Spider, FIN12, GOLD BLACKBURN, ITG23, Periwinkle Tempest, DEV-0193, Pistachio Tempest, DEV-0237 / MITRE G0102). Wizard Spider added Ryuk ransomware deployment capability via TrickBot in August 2018 and has since used the trojan as an initial-access and post-exploitation platform ahead of big-game-hunting ransomware operations across virtually all sectors. CISA/FBI joint advisory AA21-076A documents TrickBot's spearphishing-driven distribution, credential-theft and SMB-based lateral movement capability, and recommends blocking known-malicious IPs, enforcing SMBv2+ (disabling SMBv1), and phishing awareness training as core mitigations - guidance that remains applicable to this DNS-tunneling variant since initial delivery and legacy HTTP fallback modules are unchanged.

Fortinet has released matching detection content: IPS signature "Trick.Botnet", antivirus signature "W64/TrickBot.WC!tr", web-filtering classification of westurn.in as malicious, and Botnet C2 Domain Database coverage of the observed infrastructure.

## MITRE ATT&CK

- T1071.004 DNS
- T1572 Protocol Tunneling
- T1571 Non-Standard Port
- T1008 Fallback Channels
- T1132.001 Standard Encoding
- T1573.001 Symmetric Cryptography
- T1105 Ingress Tool Transfer
- T1071.001 Web Protocols
- T1053.005 Scheduled Task
- T1564.004 NTFS File Attributes
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1055.012 Process Hollowing
- T1055.013 Process Doppelgänging
- T1218.011 Rundll32
- T1497.003 Time Based Checks
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1106 Native API
- T1559.001 Component Object Model
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1016 System Network Configuration Discovery
- T1555.003 Credentials from Web Browsers
- T1185 Browser Session Hijacking
- T1210 Exploitation of Remote Services

## Sources

- [TrickBot Malware Variant Uses DNS Tunneling](https://gbhackers.com/trickbot-malware-variant-uses-dns/)
- [Inside a TrickBot Variant Using DNS Tunneling for C2](https://www.fortinet.com/blog/threat-research/inside-a-trickbot-variant-using-dns-tunneling-for-c2)
- [Inside a TrickBot Variant Using DNS Tunneling for C2 (mirror)](https://www.hendryadrian.com/inside-a-trickbot-variant-using-dns-tunneling-for-c2/)
- [TrickBot Ditches HTTP for DNS Tunneling in Latest Variant](https://www.infosecurity-magazine.com/news/trickbot-dns-tunneling-c2/)
- [TrickBot variant uses DNS tunneling for command and control](https://www.scworld.com/brief/trickbot-variant-uses-dns-tunneling-for-command-and-control)
- [TrickBot, Software S0266](https://attack.mitre.org/software/S0266/)
- [Wizard Spider, Group G0102](https://attack.mitre.org/groups/G0102/)
- [AA21-076A: TrickBot Malware](https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-076a)
- [Anchor Project for TrickBot Adds ICMP](https://www.sentinelone.com/labs/anchor-project-for-trickbot-adds-icmp/)
- [AA20-302A: Ransomware Activity Targeting the Healthcare and Public Health Sector (Anchor_DNS)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1651