A newly discovered variant of the notorious TrickBot malware has been identified employing a unique DNS tunneling technique, signaling a significant evolution in its operational methods. Traditionally relying on a standard HTTP command-and-control (C2) channel, this refreshed iteration utilizes a bespoke DNS mechanism that effectively conceals its beacons and payloads within malformed DNS queries. This shift marks a profound change for a malware family that has been in the cybersecurity crosshairs for nearly a decade.
Research conducted by Fortinet’s FortiGuard Labs, released on July 22, highlights the modular architecture of the TrickBot samples examined. While remaining consistent with previous TrickBot campaigns, this variant substantially alters its transport layer to facilitate encrypted data transmission disguised as DNS packets directed toward a public resolver. Such a refinement in strategy raises alarms about the maneuverability and adaptability of this malware in the face of ongoing law enforcement efforts to dismantle it.
The TrickBot family has a notorious history. In 2020, Microsoft executed a court-ordered operation aimed at disrupting the TrickBot botnet, which had surpassed over one million infections globally. This large-scale offensive led many to speculate that the malware family’s reign was coming to an end. Yet, this new variant undermines such assumptions and illustrates that the operators are still innovating, adapting their strategies to evade detection and maintain operational capabilities.
John Bambenek, the president of Bambenek Consulting, emphasized the importance of adaptability for the longevity of malware like TrickBot. He noted that the malware’s survival in the cybersecurity landscape results from a relentless evolution by its operators. Bambenek pointed out that the passive DNS analysis of the newly identified C2 showcased extensive exploitation activities, underscoring the imperative for organizations to implement more rigorous control over their DNS resolution processes.
Delving deeper into the mechanics of this TrickBot variant, the malware disguises outbound C2 communications in a manner that mimics typical domain name lookups. The responses—appearing as innocuous IP addresses—are designed to baffle traditional detection systems. The outbound communication channel employs an encryption method that utilizes a single-byte XOR key, subsequently converting the encrypted commands into a hex-encoded format. This process breaks the message into 63-character segments, separated by periods to appear as a legitimate domain before prepending it to a hardcoded C2 domain.
The design of the malware incorporates three distinct packet types to facilitate communication: code 0x30 for command requests, code 0x31 for size inquiries, and code 0x32 for response data. Additionally, TrickBot takes advantage of the DNS specification that permits multiple IPv4 addresses in a single reply. By treating the first byte of each address as an ordering index, the malware can effectively reassemble the shuffled responses from the resolver and decipher the subsequent bytes as a raw payload.
FortiGuard’s analysis revealed that the malware could achieve a throughput rate of approximately 30.7 KB per second, successfully transferring a 1.2 MB file within a mere 40 seconds. This efficiency demonstrates the potential for rapid dissemination of malicious payloads, which could pose significant threats to infected networks.
Furthermore, the variant exhibits persistent behavior reliant on the Windows Task Scheduler. It creates a task name generated from a random selection of characters combining a %AppData% folder name with the string “autoupdate #,” followed by a random number. This results in task names like “Wireshark autoupdate #72784,” scheduled to run every five minutes. The malware cleverly avoids duplicating tasks by storing the task names and executable paths in NTFS Alternate Data Streams (ADS), allowing for the seamless recreation of scheduled tasks with each execution.
The command handling architecture remains reflective of the original HTTP-based system, as documented by FortiGuard’s research. It identifies 12 distinct response commands that permit actions such as downloading and executing executable modules, running dynamic link libraries (DLLs) through rundll32.exe, process injection via techniques like process hollowing or process doppelganging, executing PowerShell commands through anonymous pipes, and running raw shellcode directly in memory.
To counter static analysis methods, the malware deploys runtime-decrypted strings and hash-based resolutions for Windows APIs, consequently facilitating stealthy operations. The transition to DNS tunneling does not sacrifice any of the modular functionalities that have fortified TrickBot’s position as an enduring menace in the cybersecurity realm. As the landscape of malware evolves, the resilience and adaptability showcased by TrickBot serve as a stark reminder of the ongoing battle between cybersecurity professionals and cybercriminals.