Threat reportMalwareTL-2026-3837
AnchorDNS backdoor and AnchorAdjuster tool used by TrickBot actors (Kryptos Logic)
AnchorDNS backdoor and AnchorAdjuster tool used by TrickBot (TL-2026-3837), also tracked as Anchor_DNS, is a high-severity malware campaign, first published 2026-10-17. It is attributed to TrickBot group with high confidence, affects Microsoft Windows (x64 hosts compromised via TrickBot or Bazar), maps to 7 MITRE ATT&CK techniques (T1027, T1053.005, T1071.004), and is covered by 9 detection rules and 22 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 1TrickBot group
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-3837
- Threat ID
- TL-2026-3837
- Also known as
- Anchor_DNS, AnchorDNS, stickseed, AnchorAdjuster
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- TrickBot group
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- finance, manufacturing, retail
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in AnchorDNS backdoor and AnchorAdjuster tool used by TrickBot
Malware and tooling: Anchor - S0504, AnchorAdjuster, AnchorMail, Bazar - S0534, BazarBackdoor, Cobalt Strike, TrickBot, Cobalt Strike, Trick Bot
How AnchorDNS backdoor and AnchorAdjuster tool used by TrickBot works
Kryptos Logic's Vantage Team analyzed the AnchorDNS backdoor and the AnchorAdjuster patching tool used by TrickBot actors. AnchorDNS tunnels C2 over DNS and is deployed after reconnaissance on high-value victims infected via TrickBot and Bazar campaigns.
AnchorDNS is a backdoor in the Anchor framework operated by the TrickBot group (tracked by IBM X-Force as ITG23). It is deployed post-infection on high-value victims, after the actors have performed reconnaissance on a TrickBot or Bazar infection. On first execution it creates a scheduled task that runs every 15 minutes, and the C2 can send commands that change the task frequency. Each cycle follows the same sequence: initial beacon, command request, payload request if needed, then execution report.
C2 uses DNS tunneling with three sequential query types. Older samples labelled the C2 path 'anchor_dns' and XOR-encoded messages with key 0xb9. Newer variants use the identifier 'stickseed' (possibly a reference to GetTickCount and pseudorandom generation). In the newer variants, query type 0x0001 carries the message, XOR-encoded with the string 'United States of America (USA)' and then encoded with a custom Base32 alphabet ('dghbcijklmnfqrwxyz23stuopaev4569'). Query type 0xfffe returns an identifier. Query type 0xffff returns data encoded as multiple IP records, decoded with the XOR key 'Miguel de Cervantes Saavedra'. Message part sizes are randomized based on message length and C2 domain length. Special answers control the bot: 255.255.255.255 means retry, 239.255.255.255 means sleep and retry, and the C2 IP means the message was received and the next part should be sent.
Each bot is identified by a GUID in the form <Computer_Name>_W<major><minor><build>.<16-byte UUID>, for example ADMINWIN10_W629200.1BDD88D8278746A68CE4BCF8DCF27B7E. If the .rand section holds no UUID, or still holds the placeholder 'AAAAAAAAAAAAAAAA', the bot skips all DNS queries.
AnchorAdjuster is a 64-bit EXE that patches AnchorDNS samples in place. It takes --source, --target, --domain, optional --period (default 15 minutes) and --lasthope (default 100) arguments, plus a required -guid flag. It overwrites the 16-byte 'AAAAAAAAAAAAAAAA' placeholder in the .rand section with a UUID from CoCreateGuid, and overwrites a 66-byte string of 'B' characters with the C2 domains XOR-encoded with key 0x23. The modified binary is written to the target filename. Kryptos Logic observed it being run through Cobalt Strike.
Related reporting places AnchorDNS in a longer Anchor lineage. The framework was developed in 2018 and has been paired with TrickBot and BazarBackdoor intrusions that end in ransomware. IBM X-Force later documented a successor, AnchorMail (Delegatz), which moved C2 to SMTPS/IMAPS and was seen in attacks ending in Conti ransomware. A Linux port, Anchor_Linux, installs a cron job and beacons over DNS. Severity is analyst-assigned because the source gives no CVE or CVSS.
MITRE ATT&CK techniques used in TL-2026-3837
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information
Persistence
Command and Control
T1071.004 DNS; T1132.002 Non-Standard Encoding
Discovery
T1082 System Information Discovery
Resource Development
Affected products and versions in AnchorDNS backdoor and AnchorAdjuster tool used by TrickBot
- Microsoft — Windows (x64 hosts compromised via TrickBot or Bazar)
Vulnerable versions: Windows 10 observed in sample GUID example
Remediation for AnchorDNS backdoor and AnchorAdjuster tool used by TrickBot
Immediate actions
- Block and sinkhole the six AnchorDNS C2 domains (farfaris.com, kalarada.com, xyskencevli.com, sluaknhbsoe.com, jetbiokleas.com, nyhgloksa.com) at DNS resolvers and perimeter
- Hunt for scheduled tasks that run every 15 minutes and launch a DLL or rundll32 from a user-writable path
- Search endpoints for the six listed SHA256 hashes and for DNS queries containing the 'stickseed' or 'anchor_dns' markers or long Base32-looking labels
- Isolate hosts with confirmed TrickBot or BazarLoader infections, since AnchorDNS is a second-stage payload
Workarounds
- Treat answers of 255.255.255.255 or 239.255.255.255 from external DNS as a detection signal for this backdoor
- Restrict outbound SMTPS/IMAPS from servers to detect the AnchorMail successor
Longer-term hardening
- Force all endpoint DNS through monitored resolvers and block outbound DNS/DoH to other resolvers
- Alert on high-entropy, long-label or high-volume TXT/A queries to rarely seen domains
- Deploy EDR with behavioral detection for Cobalt Strike and for patching of binaries on disk
- Monitor scheduled-task creation (Event ID 4698, Sysmon 1/11) for persistence
Timeline of AnchorDNS backdoor and AnchorAdjuster tool used by TrickBot
- Trickbot banking trojan first identified (year-level date per IBM X-Force); its developers later built the Anchor framework.
- ITG23 (Trickbot Group) develops the Anchor malware framework, including AnchorDNS, for attacks on high-profile targets after initial TrickBot or Bazar infection (year-level date).
- NTT Security first describes Anchor and classifies it as a TrickBot variant (month-level date).
- Anchor_DNS reported ported to a Linux version, Anchor_Linux, which installs a cron job and beacons over DNS (month-level date).
- Kryptos Logic Vantage Team publishes 'Adjusting the Anchor', documenting the 'stickseed' AnchorDNS protocol changes, the AnchorAdjuster tool, and IOCs.
- IBM X-Force reports the AnchorMail (Delegatz) successor using SMTPS/IMAPS C2 in attacks ending in Conti ransomware (month-level date).
Sources cited for AnchorDNS backdoor and AnchorAdjuster tool used by TrickBot
- Adjusting the Anchor - Kryptos Logic Vantage Team
- Trickbot group's AnchorDNS backdoor upgrades to AnchorMail - IBM X-Force
- TrickBot Malware Gang Upgrades its AnchorDNS Backdoor to AnchorMail - The Hacker News
- TrickBot Linux variants active in the wild - The Hacker News
- Dropping Anchor: From a TrickBot Infection to the Discovery of the Anchor Malware - Cybereason
- Dropping Anchor - NETSCOUT ASERT
- Targeted Attacks Deliver New Anchor Malware to High-Profile Companies - SecurityWeek
- FIN6 Uses TrickBot's Anchor Malware Framework - SOC Prime
Detection coverage for TL-2026-3837
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3837 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.