TrickBot variant uses DNS tunneling for command and control

Per Infosecurity Magazine, a new variant of the TrickBot malware has been observed abandoning its traditional HTTP command-and-control (C2) channel for a custom DNS tunneling scheme, embedding malicious communications within seemingly normal DNS queries.

This TrickBot variant, detailed in research by Fortinet's FortiGuard Labs, utilizes a modular architecture but features a redesigned transport layer. It disguises outbound C2 messages as domain-name lookups and reads responses from IP addresses. Commands are encrypted with a single-byte XOR key, hex-encoded, and broken into chunks to mimic valid domains. Inbound traffic exploits the DNS specification's allowance for multiple IPv4 addresses per reply, with TrickBot extracting payload data from these addresses.

The malware achieves persistence through the Windows Task Scheduler, creating tasks that run every five minutes. Its modular execution capabilities, including downloading and executing modules, injecting into processes, and running shellcode, remain intact. This shift to DNS tunneling, which FortiGuard measured at approximately 30.7 KB per second throughput, allows TrickBot to evade detection and maintain its status as a persistent threat despite previous disruption efforts.

Source: Infosecurity Magazine