TrickBot Banking Trojan (Anchor_DNS) Uses DNS Tunneling Over westurn.in for Covert C2 — Threadlinqs Intelligence
As of 2026-07-25, TrickBot Banking Trojan (Anchor_DNS) Uses DNS Tunneling Over westurn.in for Covert C2 is a high-severity malware threat attributed to Periwinkle Tempest (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 27 indicators of compromise.
Threat ID: TL-2026-1684 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Periwinkle Tempest · Russia · FINANCIAL
FortiGuard Labs documented a TrickBot variant tied to the malware's long-running "Anchor" module family that hides command-and-control traffic inside DNS queries and A-record responses to westurn.in,
On 2026-07-22, FortiGuard Labs researcher Xiaopeng Zhang published "Inside a TrickBot Variant Using DNS Tunneling for C2," a technical teardown of a TrickBot sample that abandons the family's traditional HTTP-based C2 in favor of DNS tunneling to the domain westurn.in. The malware encrypts its outbound command payload with a single-byte XOR key (0xB9), converts the ciphertext to hexadecimal, and splits it into 63-character labels joined with periods and appended to westurn.in to mimic a legitimate FQDN. Requests are issued via the Windows `getaddrinfo()` API against the public resolver 8.8.8.8, causing the traffic to originate from ordinary system DNS resolution rather than a malware-owned socket — a technique that defeats process-based network monitoring and most perimeter firewalls that do not inspect DNS payload content.
The protocol uses three request markers, each packet also carrying a 10-byte UUID session ID: 0x30 for outbound command/registration packets (fragmented, with a fragment-index/count header, if the encoded payload exceeds 96 bytes), 0x31 to query the size of a pending response (for memory allocation), and 0x32 to retrieve response data (carrying a data offset and size). Registration (command 0) uses the format `/anchor_dns/{Client_ID}/{command}/{system_info}/{IP}/{random_64bytes}/{32-byte_verification}/`, where Client_ID is composed of computer name, OS version, and a hardware ID, and the 32-byte verification value is echoed back and checked via `memcmp` — the literal "anchor_dns" path segment ties this sample directly to TrickBot's Anchor framework, first publicly documented by SentinelOne/Jason Reaves in October 2020 as a toolset built for higher-value targets (including healthcare) offering DNS (AnchorDNS), ICMP, and mail-based (AnchorMail) C2 fallback channels, plus a companion PowerShell post-exploitation tool (PowerTrick) and a Linux port. westurn.in itself has been associated with this Anchor/AnchorDNS C2 infrastructure since that 2020 reporting, indicating years of continued reuse.
C2 responses are smuggled back across standard DNS A records: the high 6 bits of each returned IPv4 address's first octet (right-shifted by 2, max index 0x3F/63) serve as a reassembly index — needed because resolvers may reorder returned addresses — the first two returned addresses encode the total payload offset/size, and the remaining up to 61 addresses each carry 3 payload bytes, a maximum ~183 bytes per response packet. FortiGuard clocked the channel at approximately 30.7 KB/s, sufficient to move a 1.2 MB module in about 40 seconds.
Once a command is received, the malware supports 12 distinct response-command execution paths: command 0 registration, commands 1/2 EXE module download-and-run, commands 3/4 DLL execution via `rundll32.exe`'s `Control_RunDLL` export, commands 5/6 process hollowing, commands 7/8 process doppelganging (leveraging Windows Transactional NTFS), command 9 command execution via an anonymous pipe to `cmd.exe`, command 10 PowerShell execution via an anonymous pipe, and command 11 raw in-memory shellcode/machine-code execution. Persistence is established via the Windows Task Scheduler COM interface (`Schedule.Service.1` ProgID) rather than the schtasks.exe CLI, building the task name from an `%AppData%` folder name plus "autoupdate #" and a random number (observed as "Wireshark autoupdate #72784"), running the implant with a `-u` argument every five minutes and at system startup. Task name and executable-path metadata are hidden in NTFS Alternate Data Streams named `$TASK` and `$FILE`, each Base64-encoded, and are read back on subsequent executions to prevent duplicate task creation. The sample further resists analysis via encrypted constant strings (XOR-decrypted at runtime) and hash-based dynamic Windows API resolution rather than static imports.
TrickBot itself first emerged in October 2016 as a modular banking trojan considered a successor to the Dyre/Dyreza malware family, and by 2018 had ma
Target sectors: financial services, health, corporate enterprise
Target regions: North America, Europe, Global
Detections & IOCs
As of 2026-08-24, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 27 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1566, T1204, T1059, T1559, T1053, T1055, T1620, T1564, T1027
