TrickBot Evolves to DNS Tunneling for Evasion
A new variant of the TrickBot banking trojan has adopted DNS tunneling for command and control, significantly enhancing its ability to evade detection.
The notorious TrickBot banking trojan has resurfaced with a significant technical evolution, replacing its long-standing HTTP-based command and control (C2) infrastructure with a sophisticated DNS tunneling scheme. This new variant, detailed in recent research from Fortinet's FortiGuard Labs, embeds C2 traffic within seemingly legitimate DNS queries, a move that dramatically increases its stealth and resilience against traditional network defenses.
This shift marks a substantial departure for TrickBot, a malware family that has persisted for nearly a decade. Despite a coordinated takedown effort by Microsoft in 2020, which aimed to dismantle its botnet, operators have evidently continued to innovate and adapt the malware's capabilities. The adoption of DNS tunneling is a testament to their ongoing efforts to maintain the threat's viability.
John Bambenek, president at cybersecurity consultancy Bambenek Consulting, highlighted the adaptive nature of the threat actors behind TrickBot. "TrickBot has been a long-running malware family that has survived because the adversary adapts," he stated. Bambenek further emphasized the importance of enterprises managing their own DNS resolution infrastructure, noting that passive DNS analysis of the C2 domains used in this variant underscored the need for such controls.
The technical implementation of the DNS tunneling is particularly noteworthy. Outbound C2 messages are encrypted using a single-byte XOR key, hex-encoded, and then segmented into 63-character chunks. These chunks are formatted to mimic valid domain names before being appended to a hardcoded C2 domain. This technique effectively disguises malicious commands as routine DNS lookups.
Inbound traffic leverages a feature within the DNS specification that allows for multiple IPv4 addresses to be returned in a single reply. TrickBot interprets the first byte of each returned IP address as an ordering index, enabling it to reassemble the shuffled response data. The remaining three bytes of each IP address are then read as raw payload, allowing for the exfiltration of data and reception of further instructions.
FortiGuard Labs measured the throughput of this DNS tunneling channel at approximately 30.7 KB per second in their lab environment, capable of transferring a 1.2 MB file in roughly 40 seconds. While not exceptionally fast, this speed is sufficient for the stealthy exfiltration of sensitive data and the delivery of commands.
For persistence, the malware relies on the Windows Task Scheduler, creating tasks with names that blend random folder names with "autoupdate #" and a random number, such as "Wireshark autoupdate #72784." These tasks are configured to run every five minutes. To further evade detection and prevent duplicate tasks, the task name and executable path are stored in NTFS Alternate Data Streams (ADS).
The malware retains its modular execution capabilities, allowing for a range of malicious actions. These include downloading and executing new modules, running DLLs via rundll32.exe, process injection techniques like process hollowing or doppelganging, executing PowerShell commands through anonymous pipes, and running raw shellcode directly in memory. Runtime decryption of strings and API hashing are employed to thwart static analysis, ensuring the malware remains difficult to dissect.