Listen to this Post
Introduction: A Cyber Threat That Refuses to Disappear
For years, cybersecurity professionals believed TrickBot had reached the end of its lifecycle after global law enforcement operations, industry collaboration, and Microsoft’s historic botnet takedown significantly disrupted its infrastructure. Many organizations considered it a relic of the past—a malware family remembered for banking theft, ransomware delivery, and large-scale enterprise compromises.
However, cybercriminals rarely abandon successful platforms. Instead, they evolve them. The latest research reveals that TrickBot has quietly resurfaced with a sophisticated communication mechanism that abandons the traditional HTTP command-and-control (C2) infrastructure it relied upon for nearly a decade. In its place is an advanced DNS tunneling technique designed to hide malicious communications inside what appears to be perfectly normal DNS traffic.
This evolution demonstrates an important reality in cybersecurity: malware never truly disappears. It adapts, changes tactics, and waits for defenders to lower their guard.
TrickBot Returns with a Completely Redesigned Communication Channel
According to newly published research by Fortinet’s FortiGuard Labs, the latest TrickBot samples retain the malware’s familiar modular architecture while introducing an entirely redesigned communication layer.
Instead of contacting command-and-control servers over standard HTTP requests—which are relatively easy for modern security tools to inspect—the malware now communicates through specially crafted DNS requests.
DNS is one of the most trusted protocols on the internet. Every device depends on it to translate domain names into IP addresses. Because DNS traffic is essential for daily operations, organizations often allow it to pass through security controls with minimal inspection.
TrickBot’s developers clearly understand this weakness.
Rather than hiding malware inside encrypted web traffic, they now conceal commands and stolen data inside malformed DNS queries that appear legitimate at first glance.
Why the Shift from HTTP to DNS Matters
Traditional HTTP-based malware communication has become increasingly difficult for attackers.
Modern Endpoint Detection and Response (EDR), Secure Web Gateways, Network Detection and Response (NDR), and Zero Trust architectures continuously inspect web traffic for suspicious behavior.
DNS traffic, however, often receives far less scrutiny.
By moving its communication channel to DNS, TrickBot dramatically reduces its visibility while increasing its chances of bypassing traditional network defenses.
This strategic redesign represents more than a technical improvement—it reflects years of adaptation by experienced cybercriminal operators.
How TrickBot Hides Commands Inside DNS Requests
The malware disguises its outbound communications as ordinary domain lookups.
Before transmitting data, TrickBot performs several transformations:
Encrypts commands using a single-byte XOR key.
Converts the encrypted data into hexadecimal format.
Splits the encoded information into 63-character labels.
Separates those labels using periods to imitate legitimate DNS naming conventions.
Appends everything to a hardcoded command-and-control domain.
To network administrators, these packets initially resemble unusually long DNS queries rather than obvious malware communications.
This clever abuse of DNS protocol standards enables the malware to evade many traditional security monitoring solutions.
Three Specialized Packet Types Power the New Protocol
The redesigned communication protocol utilizes three packet identifiers:
0x30 for requesting commands from the command server.
0x31 for querying data sizes.
0x32 for receiving returned payloads.
Although these values appear simple, together they create a structured communication framework capable of delivering complex malware functionality over DNS alone.
Receiving Data Through Fake IP Addresses
Perhaps the most ingenious aspect of
DNS responses can legally contain multiple IPv4 addresses.
TrickBot abuses this capability by embedding encrypted payload data within those returned IP addresses.
Each address serves a hidden purpose:
The first byte acts as an ordering index.
The remaining three bytes contain fragments of encrypted payload data.
Since DNS resolvers often shuffle returned addresses, TrickBot reconstructs the original message using the embedded ordering values before decrypting the complete payload.
This approach transforms ordinary DNS responses into covert data delivery channels.
Unexpectedly High Performance
DNS tunneling has traditionally been viewed as a slow communication method.
FortiGuard’s testing challenges that assumption.
Researchers observed throughput reaching approximately 30.7 KB per second, allowing the malware to transfer a 1.2 MB file in roughly 40 seconds.
This performance is surprisingly efficient for DNS-based communications and demonstrates that the malware is capable of delivering sizable payloads without relying on traditional download mechanisms.
Persistence Through Windows Task Scheduler
Maintaining long-term access remains one of
The malware automatically creates scheduled tasks using Windows Task Scheduler.
Each task receives a believable name generated from:
A randomly selected AppData folder
The phrase autoupdate
A random numeric identifier
An example might appear as:
Wireshark autoupdate 72784
The scheduled task executes every five minutes, ensuring the malware survives system reboots and continues communicating with its operators.
To avoid creating duplicate scheduled tasks, TrickBot stores configuration information inside NTFS Alternate Data Streams (ADS)—a lesser-known Windows filesystem feature frequently abused by advanced malware.
Powerful Modular Capabilities Remain Intact
Despite changing its communication mechanism, TrickBot preserves the modular design that made it one of history’s most dangerous malware families.
Researchers documented numerous supported commands, including:
Downloading executable modules.
Running DLL payloads with rundll32.exe.
Executing PowerShell through anonymous pipes.
Launching raw shellcode directly into memory.
Performing process hollowing.
Performing process doppelgänging.
Injecting malicious code into legitimate Windows processes.
These capabilities allow operators to transform infected systems into ransomware launch platforms, credential theft environments, lateral movement tools, or remote access implants.
Designed to Defeat Malware Analysis
Static malware analysis remains difficult due to several defensive techniques incorporated into the malware.
Strings remain encrypted until runtime.
Windows API functions are resolved using hashed values instead of readable names.
Combined with DNS tunneling, these anti-analysis techniques significantly complicate reverse engineering and automated malware detection.
The
The Legacy of TrickBot Continues
TrickBot first gained notoriety as a banking Trojan before evolving into one of the world’s most versatile cybercrime platforms.
Its infrastructure eventually supported ransomware operations, credential theft campaigns, corporate espionage, and enterprise-wide intrusions.
Following
The latest discovery proves otherwise.
Rather than disappearing, its developers appear to have quietly modernized the platform to survive today’s increasingly sophisticated security landscape.
Deep Analysis
The migration from HTTP to DNS is not simply an evasion trick—it represents a strategic architectural shift. Organizations that only monitor web traffic while trusting outbound DNS requests are exposing a significant blind spot. DNS tunneling enables attackers to communicate even in tightly restricted environments where HTTP, HTTPS, or custom ports are filtered.
From a
Example Detection Commands
Monitor suspicious DNS traffic using PowerShell
Get-DnsClientCache
Capture DNS traffic with Wireshark
dns
Monitor DNS traffic using tcpdump
tcpdump -i any port 53
Identify scheduled tasks
schtasks /query /fo LIST /v
Inspect Alternate Data Streams
dir /r
Check suspicious DNS requests using Sysmon logs
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational"
Review DNS queries on Linux
journalctl | grep DNS
Search for long DNS requests
tshark -Y "dns.qry.name.len > 50"
The strongest defense against modern malware is visibility. If defenders cannot see DNS abuse, they cannot stop it.
What Undercode Say:
The latest TrickBot campaign is a reminder that cybercriminals rarely throw away successful malware platforms—they reinvent them. This evolution reflects a broader trend across advanced persistent threats and organized cybercrime groups: shifting away from highly monitored communication channels toward trusted infrastructure like DNS.
DNS has become one of the most overlooked attack surfaces in enterprise environments. While organizations heavily invest in endpoint protection, firewalls, and web filtering, many still treat DNS as a basic networking service rather than a security boundary. Attackers understand this imbalance and are increasingly exploiting it.
The use of DNS tunneling is particularly dangerous because almost every corporate network depends on uninterrupted DNS functionality. Blocking DNS entirely is impossible, making behavioral detection the only practical defense. This means organizations need deeper inspection capabilities rather than relying solely on traditional signature-based detection.
Another notable aspect is TrickBot’s continued use of modular architecture. By separating communication from payload execution, the malware becomes easier to update without rewriting the entire framework. Operators can swap transport mechanisms, encryption routines, or payload modules independently, extending the malware’s lifespan.
The abuse of NTFS Alternate Data Streams for persistence further illustrates the operators’ attention to stealth. ADS remains under-monitored in many environments despite years of abuse by advanced malware families.
The throughput demonstrated by FortiGuard also challenges a long-standing assumption that DNS tunneling is inherently slow. At over 30 KB per second, attackers can deploy additional payloads quickly enough to support ransomware, credential theft, and post-exploitation activities without obvious network anomalies.
Defenders should also recognize that encrypted DNS technologies such as DNS over HTTPS (DoH) and DNS over TLS (DoT) could complicate future detection if malware eventually adopts them. This possibility highlights the importance of endpoint telemetry alongside network visibility.
Organizations should consider implementing protective DNS resolvers, enforcing internal DNS policies, collecting DNS logs centrally, and using anomaly detection capable of identifying long or randomized domain names. Threat hunting should routinely include DNS analysis, scheduled task audits, and inspection for alternate data streams.
Ultimately, TrickBot’s resurgence sends a clear message: dismantling infrastructure does not eliminate a threat actor’s knowledge or capabilities. Malware families evolve just as defenders improve, creating an ongoing cycle of innovation between attackers and security professionals. Enterprises that adapt their monitoring strategies to include DNS intelligence will be far better positioned to detect the next generation of covert command-and-control techniques.
✅ Fact: Fortinet researchers documented a new TrickBot variant that replaces traditional HTTP-based command-and-control with DNS tunneling. This aligns with the technical indicators presented in the research and reflects a significant evolution in the malware’s communication strategy.
✅ Fact: TrickBot previously suffered a major infrastructure disruption during Microsoft’s coordinated takedown in 2020 after infecting more than one million systems. The new findings demonstrate that elements of the malware ecosystem continue to evolve despite earlier disruption efforts.
✅ Fact: The malware maintains advanced persistence, modular payload delivery, process injection techniques, and anti-analysis mechanisms. These capabilities are consistent with TrickBot’s historical behavior and explain why it remains a relevant threat to enterprise environments.
Prediction
(+1) Enterprise security teams will increasingly deploy DNS monitoring, behavioral analytics, and AI-assisted network detection to identify covert command-and-control channels before they can establish persistence. This shift will improve visibility into one of the most frequently overlooked layers of enterprise security.
(-1) Threat actors are likely to continue migrating toward trusted protocols such as DNS, DoH, and other legitimate network services, making malware communications significantly harder to distinguish from normal business traffic. Organizations that continue treating DNS as a simple infrastructure service rather than a security control will face an increased risk of undetected compromise.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.infosecurity-magazine.com
Extra Source Hub (Possible Sources for article):
https://www.reddit.com/r/AskReddit
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
