Threat reportMalwareTL-2026-1684
TrickBot Banking Trojan (Anchor_DNS) Uses DNS Tunneling Over westurn.in for Covert C2
TrickBot Banking Trojan (Anchor_DNS) Uses DNS Tunneling Over (TL-2026-1684), also tracked as Anchor_DNS, is a high-severity malware campaign, first published 2026-07-23. It is attributed to Periwinkle Tempest (Russia) with medium confidence, affects Microsoft Windows, maps to 30 MITRE ATT&CK techniques (T1003, T1008, T1016), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 30MITRE ATT&CK
- Actors
- 1Periwinkle Tempest
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-1684
- Threat ID
- TL-2026-1684
- Also known as
- Anchor_DNS, AnchorDNS, TrickBot DNS Tunneling Variant
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Periwinkle Tempest
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- financial services, health, corporate enterprise
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in TrickBot Banking Trojan (Anchor_DNS) Uses DNS Tunneling Over
Malware and tooling: Anchor - S0504, Conti, PowerTrick, Ryuk, TrickBot, W64/TrickBot.WC!tr (Fortinet AV signature), AnchorDNS C2 framework, Schedule.Service.1 (COM ProgID), Trick.Botnet (Fortinet IPS signature), rundll32.exe
How TrickBot Banking Trojan (Anchor_DNS) Uses DNS Tunneling Over works
FortiGuard Labs documented a TrickBot variant tied to the malware's long-running "Anchor" module family that hides command-and-control traffic inside DNS queries and A-record responses to westurn.in, XOR-encrypting and hex-encoding subdomain-embedded commands and reconstructing response payloads from indexed IPv4 octets at roughly 30.7 KB/s. The sample retains TrickBot's modular capability set — remote/PowerShell command execution, process hollowing and doppelganging, raw shellcode injection, COM-based Task Scheduler persistence with disguised task names, and NTFS Alternate Data Stream configuration hiding — and the westurn.in domain has served as Anchor/AnchorDNS C2 infrastructure since at least 2020.
On 2026-07-22, FortiGuard Labs researcher Xiaopeng Zhang published "Inside a TrickBot Variant Using DNS Tunneling for C2," a technical teardown of a TrickBot sample that abandons the family's traditional HTTP-based C2 in favor of DNS tunneling to the domain westurn.in. The malware encrypts its outbound command payload with a single-byte XOR key (0xB9), converts the ciphertext to hexadecimal, and splits it into 63-character labels joined with periods and appended to westurn.in to mimic a legitimate FQDN. Requests are issued via the Windows `getaddrinfo()` API against the public resolver 8.8.8.8, causing the traffic to originate from ordinary system DNS resolution rather than a malware-owned socket — a technique that defeats process-based network monitoring and most perimeter firewalls that do not inspect DNS payload content.
The protocol uses three request markers, each packet also carrying a 10-byte UUID session ID: 0x30 for outbound command/registration packets (fragmented, with a fragment-index/count header, if the encoded payload exceeds 96 bytes), 0x31 to query the size of a pending response (for memory allocation), and 0x32 to retrieve response data (carrying a data offset and size). Registration (command 0) uses the format `/anchor_dns/{Client_ID}/{command}/{system_info}/{IP}/{random_64bytes}/{32-byte_verification}/`, where Client_ID is composed of computer name, OS version, and a hardware ID, and the 32-byte verification value is echoed back and checked via `memcmp` — the literal "anchor_dns" path segment ties this sample directly to TrickBot's Anchor framework, first publicly documented by SentinelOne/Jason Reaves in October 2020 as a toolset built for higher-value targets (including healthcare) offering DNS (AnchorDNS), ICMP, and mail-based (AnchorMail) C2 fallback channels, plus a companion PowerShell post-exploitation tool (PowerTrick) and a Linux port. westurn.in itself has been associated with this Anchor/AnchorDNS C2 infrastructure since that 2020 reporting, indicating years of continued reuse.
C2 responses are smuggled back across standard DNS A records: the high 6 bits of each returned IPv4 address's first octet (right-shifted by 2, max index 0x3F/63) serve as a reassembly index — needed because resolvers may reorder returned addresses — the first two returned addresses encode the total payload offset/size, and the remaining up to 61 addresses each carry 3 payload bytes, a maximum ~183 bytes per response packet. FortiGuard clocked the channel at approximately 30.7 KB/s, sufficient to move a 1.2 MB module in about 40 seconds.
Once a command is received, the malware supports 12 distinct response-command execution paths: command 0 registration, commands 1/2 EXE module download-and-run, commands 3/4 DLL execution via `rundll32.exe`'s `Control_RunDLL` export, commands 5/6 process hollowing, commands 7/8 process doppelganging (leveraging Windows Transactional NTFS), command 9 command execution via an anonymous pipe to `cmd.exe`, command 10 PowerShell execution via an anonymous pipe, and command 11 raw in-memory shellcode/machine-code execution. Persistence is established via the Windows Task Scheduler COM interface (`Schedule.Service.1` ProgID) rather than the schtasks.exe CLI, building the task name from an `%AppData%` folder name plus "autoupdate #" and a random number (observed as "Wireshark autoupdate #72784"), running the implant with a `-u` argument every five minutes and at system startup. Task name and executable-path metadata are hidden in NTFS Alternate Data Streams named `$TASK` and `$FILE`, each Base64-encoded, and are read back on subsequent executions to prevent duplicate task creation. The sample further resists analysis via encrypted constant strings (XOR-decrypted at runtime) and hash-based dynamic Windows API resolution rather than static imports.
TrickBot itself first emerged in October 2016 as a modular banking trojan considered a successor to the Dyre/Dyreza malware family, and by 2018 had matured into a malware-as-a-service platform with separate modules for credential theft, browser data harvesting, and SMB-based propagation (leveraging EternalBlue-derived techniques). Beginning around June 2019, the Multi-State Information Sharing and Analysis Center (MS-ISAC) observed a consistent pattern of TrickBot infections being followed by Ryuk ransomware deployment. In October 2020, Microsoft — together with U.S. Cyber Command, telecommunications partners, and a federal court order — executed a coordinated takedown that Microsoft stated eliminated 120 of TrickBot's 128 known command-and-control servers (roughly 94% of tracked infrastructure), though the operators rebuilt and continued operating, increasingly through the Conti ransomware-as-a-service brand. TrickBot is attributed to the Russia-based, financially motivated threat group tracked by MITRE as Wizard Spider (G0102; aliases UNC1878, TEMP.MixMaster, Grim Spider, FIN12, GOLD BLACKBURN, ITG23, Periwinkle Tempest, DEV-0193, Pistachio Tempest, DEV-0237). CISA and the FBI documented TrickBot's TTPs and IOCs in Joint Cybersecurity Advisory AA21-076A (2021-03-17), noting delivery primarily via spearphishing and subsequent credential theft, lateral movement, and handoff to Ryuk/Conti ransomware operations — the same criminal enterprise later sanctioned by the US and UK in February 2023. The U.S. Department of Justice separately prosecuted individual TrickBot developers: Vladimir Dunaev (who wrote browser-injection/credential-harvesting modules and anti-detection code, and enhanced remote-access capability) pleaded guilty on 2023-11-30 and was sentenced on 2024-01-25 to five years and four months in prison, and Latvian national Alla Witte, also a TrickBot developer, pleaded guilty and was sentenced to two years and eight months. This specific DNS-tunneling sample does not itself confirm ransomware deployment, credential dumping, or lateral movement, but sits within a malware family and operator lineage that routinely performs all three as follow-on activity after C2 is established.
MITRE ATT&CK techniques used in TL-2026-1684
Credential Access
Command and Control
T1008 Fallback Channels; T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1572 Protocol Tunneling
Discovery
T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1082 System Information Discovery; T1135 Network Share Discovery; T1518 Software Discovery
Lateral Movement
T1021 Remote Services; T1570 Lateral Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1564 Hide Artifacts; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution; T1559 Inter-Process Communication
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery
Initial Access
Resource Development
Affected products and versions in TrickBot Banking Trojan (Anchor_DNS) Uses DNS Tunneling Over
- Microsoft — Windows
Vulnerable versions: All supported Windows desktop and server versions (malware target, not version-specific vulnerability)
Remediation for TrickBot Banking Trojan (Anchor_DNS) Uses DNS Tunneling Over
Patches
- Not applicable — this is a malware campaign, not a software vulnerability; no vendor patch exists. Keep Windows OS and AV/EDR signature definitions current.
Immediate actions
- Block DNS resolution and network egress to westurn.in and any related Anchor_DNS C2 domains at the perimeter, secure web/DNS gateway, and endpoint firewall
- Deploy Fortinet IPS signature 'Trick.Botnet' and AV signature 'W64/TrickBot.WC!tr' (or vendor-equivalent detections) across network and endpoint security stacks
- Hunt EDR, proxy, and email-gateway telemetry for the six published SHA-256 sample hashes
- Alert on anomalous DNS query patterns: long, high-entropy hex-formatted subdomain labels split every 63 characters, and A-record responses returning unusually high volumes of IPv4 addresses per query
Workarounds
- Egress-filter DNS at the firewall to permit only approved internal resolvers
- Enable and centrally log full DNS query/response payloads (including A-record answer data) to support retrospective tunneling hunts
Longer-term hardening
- Restrict endpoint DNS resolution to internal, monitored resolvers only; block direct outbound UDP/53 from non-DNS-server hosts to public resolvers such as 8.8.8.8
- Deploy DNS traffic analytics / passive DNS tooling that scores query entropy, label length, and query-volume-per-domain to flag DNS tunneling behavior
- Implement phishing simulation and user-awareness training per CISA AA21-076A, since TrickBot is predominantly delivered via spearphishing
- Monitor for Task Scheduler task creation via the Schedule.Service COM interface with masquerading task names, and for writes to non-standard NTFS Alternate Data Streams (e.g. $TASK/$FILE-style streams)
Timeline of TrickBot Banking Trojan (Anchor_DNS) Uses DNS Tunneling Over
- TrickBot first observed in the wild as a modular banking trojan considered a successor to the Dyre/Dyreza malware family, initially targeting banking credentials.
- The Multi-State Information Sharing and Analysis Center (MS-ISAC) begins observing a consistent pattern of TrickBot infections being followed by Ryuk ransomware deployment.
- Microsoft, U.S. Cyber Command, and telecommunications partners execute a coordinated takedown of TrickBot infrastructure under a federal court order, eliminating roughly 120 of 128 tracked C2 servers (~94%); the operators subsequently rebuild and continue operating.
- SentinelOne (Jason Reaves) publicly documents TrickBot's Anchor framework, including AnchorDNS DNS-tunneling C2 and the westurn[.]in domain, describing it as targeting high-value victims including healthcare organizations.
- CISA and the FBI publish Joint Cybersecurity Advisory AA21-076A documenting TrickBot TTPs, IOCs, and mitigation guidance, attributing the malware to a financially motivated Russia-based cybercrime group.
- Reporting describes the Conti ransomware operation absorbing TrickBot's infrastructure and personnel as law-enforcement pressure on the standalone TrickBot brand increases.
- The United States and United Kingdom sanction seven individuals identified as members of the TrickBot/Conti/Ryuk criminal enterprise (Wizard Spider).
- Russian national Vladimir Dunaev pleads guilty in U.S. federal court to conspiracy to commit computer fraud/identity theft and conspiracy to commit wire fraud/bank fraud for developing TrickBot's browser-injection, credential-harvesting, anti-detection, and remote-access code.
- Vladimir Dunaev is sentenced to five years and four months (64 months) in U.S. federal prison for his role developing and deploying TrickBot; DOJ notes the malware infected millions of computers worldwide since 2016 and was used to deploy Ryuk and Conti ransomware.
- FortiGuard Labs researcher Xiaopeng Zhang publishes 'Inside a TrickBot Variant Using DNS Tunneling for C2,' detailing a TrickBot/Anchor_DNS sample using westurn.in for XOR-encrypted, hex-encoded DNS-tunneled C2.
- Additional outlets (GBHackers, HackRead, Infosecurity Magazine) republish and corroborate the FortiGuard DNS-tunneling findings on the same C2 domain and technique set.
- Cyber Security News syndicates the FortiGuard findings, prompting hunt-phase intake of TL-2026-1684.
Sources cited for TrickBot Banking Trojan (Anchor_DNS) Uses DNS Tunneling Over
- TrickBot Turns Ordinary DNS Traffic Into a Hidden Channel for Malware Commands
- Inside a TrickBot Variant Using DNS Tunneling for C2
- TrickBot Malware - Joint Cybersecurity Advisory AA21-076A
- TrickBot Malware Fact Sheet
- Wizard Spider, Group G0102
- Anchor Project for TrickBot Adds ICMP
- Trickbot disrupted
- Conti Ransomware 'Acquires' TrickBot As It Thrives Amid Crackdowns
- Russian National Pleads Guilty to Trickbot Malware Conspiracy
- Russian National Sentenced for Involvement in Development and Deployment of Trickbot Malware
- US and UK Sanction TrickBot and Conti Ransomware Operation Members
- New TrickBot Malware Variant Uses DNS Tunneling for Command-and-Control
- New TrickBot Variant Spotted Using DNS to Control Infected Windows PCs
- TrickBot Ditches HTTP for DNS Tunneling in Latest Variant
Detection coverage for TL-2026-1684
As of 2026-07-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1684 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.