Listen to this Post
Introduction: TrickBot Continues to Reinvent Itself
Cybercriminals rarely abandon malware that continues to generate results. Instead, they continuously redesign it to bypass modern security controls, making detection increasingly difficult for defenders. TrickBot, one of the most notorious malware families in recent years, has once again evolved with a sophisticated campaign that replaces traditional HTTP-based communications with covert DNS tunneling. This transformation demonstrates how attackers are adapting to today’s security landscape, where network monitoring tools often focus on web traffic while overlooking abnormal DNS activity.
FortiGuard researchers recently uncovered a new TrickBot campaign that hides its command-and-control (C2) communications inside malformed DNS requests. Combined with advanced anti-analysis techniques, encrypted strings, API hashing, scheduled task persistence, and a convincing disguise as a legitimate Wireshark update, this new variant represents another significant step in malware evolution.
TrickBot Adopts DNS Tunneling to Hide Its Communications
Researchers analyzing recently captured malware samples discovered that this latest TrickBot variant no longer relies primarily on HTTP traffic to communicate with its operators. Instead, it leverages DNS tunneling, allowing malicious communications to blend into one of the most trusted protocols on corporate and home networks.
DNS traffic is rarely blocked because every internet-connected system depends on it. By embedding encrypted information inside DNS queries and responses, TrickBot dramatically reduces its visibility while maintaining reliable communications with its command-and-control servers.
This technique significantly complicates network detection because many organizations inspect HTTP and HTTPS traffic far more aggressively than DNS requests.
A Modular Malware Platform Designed for Expansion
TrickBot remains a modular malware framework rather than a single-purpose infection.
After successfully compromising a Windows machine, operators can remotely deploy additional modules depending on their objectives. These modules may provide capabilities such as:
Remote command execution
PowerShell execution
Additional payload downloads
Credential theft
Process injection
Lateral movement
System reconnaissance
Persistence enhancements
This modular architecture allows attackers to tailor infections for espionage, ransomware deployment, financial theft, or long-term network persistence.
Researchers Link Multiple Samples to the Same Campaign
FortiGuard researchers examined several Windows executable samples that possessed different file hashes but displayed nearly identical behavior.
Although each executable appeared unique from a hashing perspective, they shared:
Matching Portable Executable (PE) structures
Identical startup routines
Similar execution flow
Nearly identical persistence mechanisms
Common communication techniques
These similarities strongly indicate that all analyzed binaries originated from the same malware campaign despite minor modifications intended to evade signature-based detection.
Advanced Anti-Analysis Techniques Slow Reverse Engineering
One of the strongest characteristics of this TrickBot variant is its heavy investment in anti-analysis mechanisms.
Rather than exposing readable strings inside the executable, important information—including DLL names such as Kernel32.dll—is encrypted within the binary.
Only during runtime does the malware decrypt these values using multiple mathematical operations including XOR and subtraction.
The malware further complicates analysis by dynamically calculating constants instead of embedding fixed values directly into the executable.
This means static malware scanners cannot easily recover important information without actually executing the sample.
Hash-Based API Resolution Makes Detection More Difficult
Instead of importing Windows API functions in the traditional way, TrickBot computes hash values corresponding to API names.
For example, rather than directly referencing LoadLibraryA, the malware calculates its hash during execution before resolving its memory address.
This technique provides several advantages for attackers:
Fewer readable indicators inside the binary
Smaller import tables
Greater resistance against static analysis
More difficult reverse engineering
Reduced signature effectiveness
API hashing has become increasingly common among advanced malware families because many security products rely on imported function names during classification.
Persistence Through a Fake Wireshark Auto-Update
Persistence remains one of
When executed without the -u parameter, the malware creates a scheduled Windows task designed to survive system reboots.
Instead of using suspicious names, TrickBot generates task names that closely resemble legitimate software updates.
One observed example was:
Wireshark autoupdate 72784
To an unsuspecting administrator, this scheduled task appears almost identical to a legitimate software update process.
The malware configures the task to execute every five minutes while also launching automatically whenever Windows starts.
This persistence mechanism ensures that even if the malware process is terminated, it will quickly return.
Alternate Data Streams Hide Critical Information
Rather than storing configuration files in obvious locations, TrickBot abuses NTFS Alternate Data Streams (ADS).
The malware stores:
Base64-encoded scheduled task names
Base64-encoded executable paths
inside hidden streams named:
$TASK
$FILE
Because Alternate Data Streams remain invisible during normal file browsing, many users—and even some security products—fail to inspect them.
During subsequent executions, TrickBot retrieves and decodes these hidden values before rebuilding or validating its persistence mechanism.
DNS Tunneling Powers Command-and-Control Communications
Once launched with the -u parameter, TrickBot begins communicating through DNS tunneling.
The malware performs several steps before transmitting data:
Encrypts command information using XOR key 0xB9
Converts encrypted bytes into hexadecimal
Splits the hexadecimal data into DNS-compatible labels
Appends the payload to the command-and-control domain
Sends malformed DNS requests using getaddrinfo()
Routes requests through public DNS resolvers such as 8.8.8.8
Because DNS traffic is generally allowed through enterprise firewalls, these communications often avoid detection unless organizations deploy advanced DNS monitoring solutions.
Known Indicators of Compromise (IOCs)
Researchers identified several important indicators associated with this campaign.
Command-and-Control Domain
westurn[.]in
Persistence Pattern
Wireshark autoupdate <random_number>
Security teams should avoid directly resolving suspicious domains outside isolated threat intelligence environments.
Instead, investigate them using controlled platforms such as:
MISP
VirusTotal
Internal SIEM solutions
Sandboxed malware analysis environments
Deep Analysis
The migration from HTTP to DNS tunneling is far more than a simple protocol change—it reflects a broader shift in malware development toward “living within expected network behavior.” Organizations have spent years strengthening web filtering, HTTPS inspection, endpoint detection, and firewall visibility. Attackers are now exploiting protocols that defenders often treat as inherently trustworthy. DNS has become one of the most attractive channels because every enterprise depends on it, yet relatively few environments inspect DNS payloads with the same depth applied to web traffic.
The use of encrypted DNS queries combined with API hashing, runtime decryption, and NTFS Alternate Data Streams demonstrates a layered defense-evasion strategy. Even if an analyst uncovers one technique, several additional layers remain to slow investigation. This modular approach also allows operators to update individual components without redesigning the entire malware family, extending TrickBot’s operational lifespan.
Security teams should consider strengthening DNS monitoring and hunting for anomalous query patterns, excessive DNS requests, or unusually long subdomains. Useful investigative commands include:
schtasks /query /fo LIST /v
Get-ScheduledTask
Get-Item -Path C:\Users\AppData -Stream
dir /r
Get-FileHash suspicious.exe
nslookup westurn.in
Resolve-DnsName westurn.in
Get-WinEvent -LogName Microsoft-Windows-DNS-Client/Operational
netstat -ano
tasklist /v
Get-Process
Get-Service
Get-ChildItem -Recurse $env:APPDATA
wevtutil qe Security /f:text
Get-MpThreatDetection
Get-MpComputerStatus
Security Operations Centers (SOCs) should also deploy DNS anomaly detection, behavioral endpoint monitoring, scheduled task auditing, and memory analysis to identify infections that traditional antivirus products may overlook.
What Undercode Say:
The newest TrickBot campaign is a clear reminder that malware developers evolve as quickly as defensive technologies. While many organizations focus heavily on HTTP and HTTPS monitoring, DNS often remains a blind spot, making it an ideal communication channel for sophisticated attackers.
This campaign demonstrates a mature understanding of enterprise environments.
The malware avoids obvious signatures.
It minimizes readable strings.
It dynamically resolves APIs.
It hides persistence in scheduled tasks.
It stores metadata inside Alternate Data Streams.
It disguises itself as trusted software.
Each individual technique is not entirely new.
However, combining all of them into a single malware family significantly increases operational stealth.
DNS tunneling deserves far more attention than it currently receives.
Many organizations collect DNS logs but rarely analyze them effectively.
Attackers understand this weakness.
Public DNS services make command-and-control infrastructure even more resilient.
Incident responders should investigate unusual DNS request sizes.
Long DNS labels may indicate encoded payloads.
Repeated failed DNS lookups can also signal tunneling attempts.
Endpoint telemetry becomes increasingly important because network visibility alone is insufficient.
Scheduled task monitoring should become standard practice.
Legitimate applications rarely generate randomly numbered update tasks every few minutes.
Alternate Data Streams remain underutilized by attackers compared to registry persistence.
That could change rapidly.
Modern EDR products should monitor ADS creation events.
Behavioral analytics will outperform signature detection against campaigns like this.
Machine learning can identify abnormal scheduling behavior.
Threat hunters should baseline legitimate DNS traffic.
API hashing continues to frustrate reverse engineering.
Runtime decryption increases malware resilience.
Organizations should assume attackers continuously test against commercial antivirus products.
Security awareness alone cannot stop malware using these techniques.
Layered security remains essential.
Zero Trust principles reduce lateral movement opportunities.
Application allowlisting limits execution.
PowerShell logging remains valuable.
Memory scanning should supplement disk scanning.
Threat intelligence sharing becomes increasingly important.
IOC distribution must happen quickly.
Attackers rotate infrastructure frequently.
DNS security should no longer be optional.
Organizations that continue ignoring DNS visibility risk discovering infections only after ransomware deployment or credential theft has already occurred.
✅ Fact 1: TrickBot now uses DNS tunneling for command-and-control communications.
This is supported by
✅ Fact 2: The malware disguises itself as a Wireshark auto-update through Windows Task Scheduler.
Researchers observed scheduled task names such as “Wireshark autoupdate 72784”, confirming that TrickBot attempts to blend into legitimate software update processes to maintain persistence.
✅ Fact 3: Multiple anti-analysis techniques are employed simultaneously.
The malware encrypts strings, performs runtime decryption, resolves APIs through hashes, dynamically computes constants, and stores persistence data in NTFS Alternate Data Streams. These techniques collectively increase resistance against static analysis and reverse engineering.
Prediction
(+1) Enterprise security vendors will significantly expand DNS inspection, behavioral analytics, and scheduled task monitoring capabilities over the next year as malware increasingly shifts away from traditional HTTP-based command-and-control channels. At the same time, defenders adopting AI-assisted threat hunting and deeper DNS telemetry are likely to identify stealthy campaigns like this much earlier, reducing attacker dwell time and improving incident response effectiveness.
▶️ Related Video (78% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.reddit.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
