# AnchorDNS backdoor and AnchorAdjuster tool used by TrickBot actors (Kryptos Logic)

> Kryptos Logic's Vantage Team analyzed the AnchorDNS backdoor and the AnchorAdjuster patching tool used by TrickBot actors. AnchorDNS tunnels C2 over DNS and is deployed after reconnaissance on high-value victims infected via TrickBot and Bazar campaigns.

- **Published:** 2026-10-17T20:37:08Z
- **Last reviewed:** 2026-10-17T20:37:08Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3837
- **ID:** TL-2026-3837
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** TrickBot group
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AnchorDNS is a backdoor in the Anchor framework operated by the TrickBot group (tracked by IBM X-Force as ITG23). It is deployed post-infection on high-value victims, after the actors have performed reconnaissance on a TrickBot or Bazar infection. On first execution it creates a scheduled task that runs every 15 minutes, and the C2 can send commands that change the task frequency. Each cycle follows the same sequence: initial beacon, command request, payload request if needed, then execution report.

C2 uses DNS tunneling with three sequential query types. Older samples labelled the C2 path 'anchor_dns' and XOR-encoded messages with key 0xb9. Newer variants use the identifier 'stickseed' (possibly a reference to GetTickCount and pseudorandom generation). In the newer variants, query type 0x0001 carries the message, XOR-encoded with the string 'United States of America (USA)' and then encoded with a custom Base32 alphabet ('dghbcijklmnfqrwxyz23stuopaev4569'). Query type 0xfffe returns an identifier. Query type 0xffff returns data encoded as multiple IP records, decoded with the XOR key 'Miguel de Cervantes Saavedra'. Message part sizes are randomized based on message length and C2 domain length. Special answers control the bot: 255.255.255.255 means retry, 239.255.255.255 means sleep and retry, and the C2 IP means the message was received and the next part should be sent.

Each bot is identified by a GUID in the form <Computer_Name>_W<major><minor><build>.<16-byte UUID>, for example ADMINWIN10_W629200.1BDD88D8278746A68CE4BCF8DCF27B7E. If the .rand section holds no UUID, or still holds the placeholder 'AAAAAAAAAAAAAAAA', the bot skips all DNS queries.

AnchorAdjuster is a 64-bit EXE that patches AnchorDNS samples in place. It takes --source, --target, --domain, optional --period (default 15 minutes) and --lasthope (default 100) arguments, plus a required -guid flag. It overwrites the 16-byte 'AAAAAAAAAAAAAAAA' placeholder in the .rand section with a UUID from CoCreateGuid, and overwrites a 66-byte string of 'B' characters with the C2 domains XOR-encoded with key 0x23. The modified binary is written to the target filename. Kryptos Logic observed it being run through Cobalt Strike.

Related reporting places AnchorDNS in a longer Anchor lineage. The framework was developed in 2018 and has been paired with TrickBot and BazarBackdoor intrusions that end in ransomware. IBM X-Force later documented a successor, AnchorMail (Delegatz), which moved C2 to SMTPS/IMAPS and was seen in attacks ending in Conti ransomware. A Linux port, Anchor_Linux, installs a cron job and beacons over DNS. Severity is analyst-assigned because the source gives no CVE or CVSS.

## MITRE ATT&CK

- T1071.004 DNS
- T1132.002 Non-Standard Encoding
- T1053.005 Scheduled Task
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1583.001 Domains
- T1082 System Information Discovery

## Sources

- [Adjusting the Anchor - Kryptos Logic Vantage Team](https://www.kryptoslogic.com/blog/2021/07/adjusting-the-anchor/)
- [Trickbot group's AnchorDNS backdoor upgrades to AnchorMail - IBM X-Force](https://www.ibm.com/think/x-force/new-malware-trickbot-anchordns-backdoor-upgrades-anchormail)
- [TrickBot Malware Gang Upgrades its AnchorDNS Backdoor to AnchorMail - The Hacker News](https://thehackernews.com/2022/03/trickbot-malware-gang-upgrades-its.html)
- [TrickBot Linux variants active in the wild - The Hacker News](https://thehackernews.com/2020/10/trickbot-linux-variants-active-in-wild.html)
- [Dropping Anchor: From a TrickBot Infection to the Discovery of the Anchor Malware - Cybereason](https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware)
- [Dropping Anchor - NETSCOUT ASERT](https://netscout.com/blog/asert/dropping-anchor)
- [Targeted Attacks Deliver New Anchor Malware to High-Profile Companies - SecurityWeek](https://www.securityweek.com/targeted-attacks-deliver-new-anchor-malware-high-profile-companies/)
- [FIN6 Uses TrickBot's Anchor Malware Framework - SOC Prime](https://socprime.com/news/fin6-uses-trickbots-anchor-malware-framework/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3837