FortiGuard measured throughput at around 30.7 KB per second in its lab, moving a 1.2 MB file in 40 seconds.
FortiGuard Labs: a modular TrickBot returns with a new transport
Research published by Fortinet's FortiGuard Labs on July 22 documents a TrickBot variant that replaces the malware family's long-running HTTP command-and-control (C2) channel with a bespoke DNS tunneling scheme. FortiGuard's samples showed a modular architecture consistent with earlier TrickBot campaigns but with the transport layer redesigned around encrypted data hidden in DNS packets and routed to a public resolver.
The shift is notable against the family's recent history: Microsoft coordinated a court-ordered takedown of the TrickBot botnet in 2020 after infections exceeded one million devices, and public reporting had largely written the family off. FortiGuard's findings demonstrate operators continue to iterate on the platform.
DNS tunneling mechanics: how commands and payloads ride DNS
Once executed, the malware disguises outbound C2 messages as routine domain-name lookups and parses responses that appear to be ordinary IP addresses. Outbound traffic is encrypted with a single-byte XOR key, then hex-encoded and split into 63-character chunks separated by periods to mimic valid domain labels; the full string is prepended to a hardcoded C2 domain.
- Three packet types carry traffic: 0x30 for command requests, 0x31 for size queries and 0x32 for response data.
- Inbound replies exploit DNS replies that allow multiple IPv4 addresses: TrickBot uses the first byte of each returned "address" as an ordering index to re-sort shuffled replies and reads the remaining three bytes as raw payload.
FortiGuard measured the tunneling throughput at roughly 30.7 KB/s in its lab, sufficient to move a 1.2 MB file in about 40 seconds.
Persistence via Task Scheduler and NTFS Alternate Data Streams
Persistence in this variant relies on the Windows Task Scheduler. TrickBot generates a task name by combining a randomly selected %AppData% folder name, the literal string "autoupdate #", and a random number — producing entries such as "Wireshark autoupdate #72784" that are scheduled to run every five minutes.
The malware stores both the task name and the executable path in two NTFS Alternate Data Streams (ADS). On subsequent runs the ADS entries allow the sample to rebuild the same scheduled task rather than creating duplicate tasks.
Command handling and legacy modular capabilities preserved
Though the transport changed, command handling hews closely to TrickBot's HTTP-era design. FortiGuard documented 12 response commands that include:
- Downloading and executing EXE modules.
- Running DLLs through rundll32.exe.
- Injecting into processes via process hollowing or process doppelganging.
- Executing PowerShell through anonymous pipes to cmd.exe and running raw shellcode in memory.
The sample also uses runtime-decrypted strings and hash-based Windows API resolution intended to frustrate static analysis. In short, the DNS tunneling change preserves the modular execution capabilities that have contributed to TrickBot's persistence.
What this means for enterprise IT, security teams, and incident responders
Enterprise IT: FortiGuard's lab throughput numbers and the use of public resolvers underline that DNS can be a high-bandwidth covert channel when abused. Enterprises that rely on third-party DNS resolution should be aware that DNS queries and replies can carry encrypted command traffic and reconstructed payloads.
Security teams: The encoding pattern — single-byte XOR, hex encoding, and 63-character label segmentation — plus the use of multiple returned IPv4 addresses as sequencing markers, provide concrete indicators defenders can look for in DNS telemetry and passive DNS analysis.
Incident responders: Persistence via Task Scheduler and storage of task metadata in NTFS Alternate Data Streams means forensic investigators should inspect scheduled tasks and ADS entries for unusual names (for example including "autoupdate #") and verify executable paths against expected application behavior.
John Bambenek, president at Bambenek Consulting, framed the development simply: "TrickBot has been a long-running malware family that has survived because the adversary adapts," and he added that passive DNS analysis of the identified C2 showed extensive exploitation activity and reinforced the case for enterprises controlling their own DNS resolution.
The technical picture FortiGuard paints is clear: the operators kept the playbook of modular execution and persistence while changing only the transport. That combination — familiar capabilities wrapped in a new covert channel — is what makes the variant consequential and why defenders will want to treat DNS telemetry as a first-class source of threat intelligence.
