New TrickBot Variant Spotted Using DNS to Control Infected Windows PCs

Summary

Fortinet's FortiGuard Labs identified a new TrickBot variant that uses DNS tunneling to communicate with command servers, disguising malicious traffic as ordinary DNS queries through Google's public DNS (8.8.8.8). The malware maintains persistence through Windows scheduled tasks, uses NTFS Alternate Data Streams for obfuscation, and can download modules enabling credential theft, code injection, and PowerShell execution. This represents an evolution of the TrickBot banking trojan, which first emerged in 2016 and continues to be actively developed despite prior infrastructure disruptions by Microsoft and law enforcement.

Full text

Security MalwareNew TrickBot Variant Spotted Using DNS to Control Infected Windows PCs Fortinet has found a new TrickBot variant hiding commands in DNS traffic and using scheduled tasks and added modules to maintain access on infected Windows PCs. byWaqasJuly 23, 20263 minute read Listen to this article 0:00 — ← 10s ▶ Play 10s → Speed 0.75× 1× 1.25× 1.5× 2× Voice Loading voices… Press play to start listening Cybersecurity researchers at Fortinet’s FortiGuard Labs have identified a TrickBot variant that uses DNS tunneling to exchange commands with its operators. The Windows malware can download additional modules, run PowerShell code, inject code into other processes, and execute commands on an infected computer. The samples were identified after FortiGuard Labs noticed malformed DNS queries. Further analysis confirmed that the traffic belonged to TrickBot variants using DNS in place of the HTTP connections seen in earlier versions. TrickBot Uses DNS to Contact Its Operators For better understanding, DNS normally translates website names into IP addresses. On the other hand, DNS tunneling abuses that process by placing non-DNS data inside queries and responses, allowing malware to communicate through a service that most networks need to keep available. In this case, the TrickBot variant disguises its communications as ordinary website lookups. It breaks commands into small pieces, inserts them into requests for the westurn.in domain and sends them through Google’s public DNS service at 8.8.8.8. The server replies with data made to look like normal IP address information. TrickBot collects those replies and rebuilds the attacker’s instructions or downloaded files on the infected computer. During Fortinet’s test, it transferred a 1.2 MB file in about 40 seconds. By the time Fortinet examined the malware, its original control server had been taken offline. Researchers created a safe imitation of the server to confirm how TrickBot received commands and additional modules. Scheduled Tasks Keep TrickBot Running According to FortiGuard Labs’ technical blog post, on an infected computer, TrickBot creates a Windows scheduled task that runs at startup and repeats every five minutes. The task receives a name designed to resemble an ordinary software update, such as “Wireshark autoupdate” followed by a random number. To keep track of the task, the malware stores its name and executable path in NTFS Alternate Data Streams. This Windows feature allows additional data to be attached to a file without appearing as a normal separate file, making the configuration less obvious during routine inspection. Once active, the malware reads those stored values and recreates its scheduled task if needed. It also encrypts internal strings and resolves Windows functions at runtime, complicating static analysis. Modules Can Give Attackers Full Control The commands supported by this variant allow operators to download executable or DLL modules and run them through several methods. Downloaded code can be launched with rundll32.exe, injected into another process or executed directly within TrickBot’s memory. Other commands provide access to the Windows command prompt and PowerShell. This gives an operator the ability to run commands, install further malware, and control the compromised computer. Fortinet found multiple samples with different file hashes but identical startup code and behaviour, indicating that they belonged to the same campaign. The company’s antivirus products detect the files as W64/TrickBot.WC!tr, while the associated command server domain has been classified as malicious. TrickBot’s History TrickBot first appeared in 2016 as a banking trojan before developing into a modular malware platform used for credential theft and ransomware delivery. In 2020, Microsoft and several cybersecurity companies disrupted much of its infrastructure, but subsequent research continued to identify TrickBot-related activity. Nevertheless, for Windows administrators, unusually long DNS queries, repeated requests involving unfamiliar subdomains, and scheduled tasks disguised as software updates warrant investigation. Additionally, monitoring PowerShell activity, new services, process injection, and unauthorized DNS traffic can also help identify compromised computers. Waqas I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cybersecurity and tech world. I am also into gaming, reading and investigative journalism. View Posts CybersecurityDNSFortiGuard LabsFortinetMalwareRansomwareTrickBotWindows Leave a Reply Cancel reply View Comments (0) Related Posts Read More Security Cyber Attacks Gaming PoodleCorp Says it DDoSed GTA and PlayStation Servers PoodleCorp hacking group says they attacked Grand Theft Auto (GTA) and PlayStation servers earlier today forcing the service… byWaqas Read More Security ‘Admin’ and ‘123456’ Still Among Most Used Passwords in FTP Attacks Weak passwords continue to be a major vulnerability for FTP servers. Specops’ latest report highlights the most frequent… byDeeba Ahmed Read More Cyber Crime Malware Security Meet Retadup botnet that was infected by another malware Meet Retadup malware botnet that was infected by another malware - Avast and French authorities have now dismantled the nasty Retadup botnet. bySudais Asif Read More Security Live Nation Confirms Massive Ticketmaster Data Breach In an SEC filing, Live Nation Entertainment confirmed its subsidiary Ticketmaster suffered a data breach, claiming it will… byWaqas

Indicators of Compromise

• domain — westurn.in
• ip — 8.8.8.8
• malware — TrickBot
• malware — W64/TrickBot.WC!tr

Entities