# TrickBot Banking Trojan (Anchor_DNS) Uses DNS Tunneling Over westurn.in for Covert C2

> FortiGuard Labs documented a TrickBot variant tied to the malware's long-running "Anchor" module family that hides command-and-control traffic inside DNS queries and A-record responses to westurn.in, XOR-encrypting and hex-encoding subdomain-embedded commands and reconstructing response payloads from indexed IPv4 octets at roughly 30.7 KB/s. The sample retains TrickBot's modular capability set — remote/PowerShell command execution, process hollowing and doppelganging, raw shellcode injection, COM-based Task Scheduler persistence with disguised task names, and NTFS Alternate Data Stream configuration hiding — and the westurn.in domain has served as Anchor/AnchorDNS C2 infrastructure since at least 2020.

- **Published:** 2026-07-23T00:00:00Z
- **Last reviewed:** 2026-07-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1684
- **ID:** TL-2026-1684
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Periwinkle Tempest (Russia)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-07-22, FortiGuard Labs researcher Xiaopeng Zhang published "Inside a TrickBot Variant Using DNS Tunneling for C2," a technical teardown of a TrickBot sample that abandons the family's traditional HTTP-based C2 in favor of DNS tunneling to the domain westurn.in. The malware encrypts its outbound command payload with a single-byte XOR key (0xB9), converts the ciphertext to hexadecimal, and splits it into 63-character labels joined with periods and appended to westurn.in to mimic a legitimate FQDN. Requests are issued via the Windows `getaddrinfo()` API against the public resolver 8.8.8.8, causing the traffic to originate from ordinary system DNS resolution rather than a malware-owned socket — a technique that defeats process-based network monitoring and most perimeter firewalls that do not inspect DNS payload content.

The protocol uses three request markers, each packet also carrying a 10-byte UUID session ID: 0x30 for outbound command/registration packets (fragmented, with a fragment-index/count header, if the encoded payload exceeds 96 bytes), 0x31 to query the size of a pending response (for memory allocation), and 0x32 to retrieve response data (carrying a data offset and size). Registration (command 0) uses the format `/anchor_dns/{Client_ID}/{command}/{system_info}/{IP}/{random_64bytes}/{32-byte_verification}/`, where Client_ID is composed of computer name, OS version, and a hardware ID, and the 32-byte verification value is echoed back and checked via `memcmp` — the literal "anchor_dns" path segment ties this sample directly to TrickBot's Anchor framework, first publicly documented by SentinelOne/Jason Reaves in October 2020 as a toolset built for higher-value targets (including healthcare) offering DNS (AnchorDNS), ICMP, and mail-based (AnchorMail) C2 fallback channels, plus a companion PowerShell post-exploitation tool (PowerTrick) and a Linux port. westurn.in itself has been associated with this Anchor/AnchorDNS C2 infrastructure since that 2020 reporting, indicating years of continued reuse.

C2 responses are smuggled back across standard DNS A records: the high 6 bits of each returned IPv4 address's first octet (right-shifted by 2, max index 0x3F/63) serve as a reassembly index — needed because resolvers may reorder returned addresses — the first two returned addresses encode the total payload offset/size, and the remaining up to 61 addresses each carry 3 payload bytes, a maximum ~183 bytes per response packet. FortiGuard clocked the channel at approximately 30.7 KB/s, sufficient to move a 1.2 MB module in about 40 seconds.

Once a command is received, the malware supports 12 distinct response-command execution paths: command 0 registration, commands 1/2 EXE module download-and-run, commands 3/4 DLL execution via `rundll32.exe`'s `Control_RunDLL` export, commands 5/6 process hollowing, commands 7/8 process doppelganging (leveraging Windows Transactional NTFS), command 9 command execution via an anonymous pipe to `cmd.exe`, command 10 PowerShell execution via an anonymous pipe, and command 11 raw in-memory shellcode/machine-code execution. Persistence is established via the Windows Task Scheduler COM interface (`Schedule.Service.1` ProgID) rather than the schtasks.exe CLI, building the task name from an `%AppData%` folder name plus "autoupdate #" and a random number (observed as "Wireshark autoupdate #72784"), running the implant with a `-u` argument every five minutes and at system startup. Task name and executable-path metadata are hidden in NTFS Alternate Data Streams named `$TASK` and `$FILE`, each Base64-encoded, and are read back on subsequent executions to prevent duplicate task creation. The sample further resists analysis via encrypted constant strings (XOR-decrypted at runtime) and hash-based dynamic Windows API resolution rather than static imports.

TrickBot itself first emerged in October 2016 as a modular banking trojan considered a successor to the Dyre/Dyreza malware family, and by 2018 had matured into a malware-as-a-service platform with separate modules for credential theft, browser data harvesting, and SMB-based propagation (leveraging EternalBlue-derived techniques). Beginning around June 2019, the Multi-State Information Sharing and Analysis Center (MS-ISAC) observed a consistent pattern of TrickBot infections being followed by Ryuk ransomware deployment. In October 2020, Microsoft — together with U.S. Cyber Command, telecommunications partners, and a federal court order — executed a coordinated takedown that Microsoft stated eliminated 120 of TrickBot's 128 known command-and-control servers (roughly 94% of tracked infrastructure), though the operators rebuilt and continued operating, increasingly through the Conti ransomware-as-a-service brand. TrickBot is attributed to the Russia-based, financially motivated threat group tracked by MITRE as Wizard Spider (G0102; aliases UNC1878, TEMP.MixMaster, Grim Spider, FIN12, GOLD BLACKBURN, ITG23, Periwinkle Tempest, DEV-0193, Pistachio Tempest, DEV-0237). CISA and the FBI documented TrickBot's TTPs and IOCs in Joint Cybersecurity Advisory AA21-076A (2021-03-17), noting delivery primarily via spearphishing and subsequent credential theft, lateral movement, and handoff to Ryuk/Conti ransomware operations — the same criminal enterprise later sanctioned by the US and UK in February 2023. The U.S. Department of Justice separately prosecuted individual TrickBot developers: Vladimir Dunaev (who wrote browser-injection/credential-harvesting modules and anti-detection code, and enhanced remote-access capability) pleaded guilty on 2023-11-30 and was sentenced on 2024-01-25 to five years and four months in prison, and Latvian national Alla Witte, also a TrickBot developer, pleaded guilty and was sentenced to two years and eight months. This specific DNS-tunneling sample does not itself confirm ransomware deployment, credential dumping, or lateral movement, but sits within a malware family and operator lineage that routinely performs all three as follow-on activity after C2 is established.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1559 Inter-Process Communication
- T1053 Scheduled Task/Job
- T1055 Process Injection
- T1620 Reflective Code Loading
- T1564 Hide Artifacts
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1218 System Binary Proxy Execution
- T1036 Masquerading
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1135 Network Share Discovery
- T1518 Software Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1071 Application Layer Protocol
- T1572 Protocol Tunneling
- T1132 Data Encoding
- T1105 Ingress Tool Transfer
- T1008 Fallback Channels
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [TrickBot Turns Ordinary DNS Traffic Into a Hidden Channel for Malware Commands](https://cybersecuritynews.com/trickbot-dns-traffic-hidden-channel/)
- [Inside a TrickBot Variant Using DNS Tunneling for C2](https://www.fortinet.com/blog/threat-research/inside-a-trickbot-variant-using-dns-tunneling-for-c2)
- [TrickBot Malware - Joint Cybersecurity Advisory AA21-076A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-076a)
- [TrickBot Malware Fact Sheet](https://www.cisa.gov/sites/default/files/publications/TrickBot_Fact_Sheet_508.pdf)
- [Wizard Spider, Group G0102](https://attack.mitre.org/groups/G0102/)
- [Anchor Project for TrickBot Adds ICMP](https://www.sentinelone.com/labs/anchor-project-for-trickbot-adds-icmp/)
- [Trickbot disrupted](https://www.microsoft.com/en-us/security/blog/2020/10/12/trickbot-disrupted/)
- [Conti Ransomware 'Acquires' TrickBot As It Thrives Amid Crackdowns](https://www.securityweek.com/conti-ransomware-acquires-trickbot-it-thrives-amid-crackdowns/)
- [Russian National Pleads Guilty to Trickbot Malware Conspiracy](https://www.justice.gov/opa/pr/russian-national-pleads-guilty-trickbot-malware-conspiracy)
- [Russian National Sentenced for Involvement in Development and Deployment of Trickbot Malware](https://www.justice.gov/archives/opa/pr/russian-national-sentenced-involvement-development-and-deployment-trickbot-malware)
- [US and UK Sanction TrickBot and Conti Ransomware Operation Members](https://www.bleepingcomputer.com/news/security/us-and-uk-sanction-trickbot-and-conti-ransomware-operation-members/)
- [New TrickBot Malware Variant Uses DNS Tunneling for Command-and-Control](https://gbhackers.com/trickbot-malware-variant-uses-dns/)
- [New TrickBot Variant Spotted Using DNS to Control Infected Windows PCs](https://hackread.com/new-trickbot-variant-dns-control-infected-windows-pcs/)
- [TrickBot Ditches HTTP for DNS Tunneling in Latest Variant](https://www.infosecurity-magazine.com/news/trickbot-dns-tunneling-c2/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1684