TrickBot Evolves: New Variant Uses DNS Tunneling to Evade Detection, Hijack Windows PCs

TrickBot, the decade-old banking trojan turned all-purpose loader, has picked up a dangerous new communication trick. FortiGuard Labs researcher Xiaopeng Zhang disclosed on July 22, 2026.

That recent TrickBot samples are abandoning their traditional HTTP-based command-and-control (C2) channel in favor of DNS tunneling, a method that smuggles malicious traffic inside ordinary-looking DNS queries and responses.

Because DNS is rarely blocked or deeply inspected by enterprise firewalls, this shift lets the malware slip past network defenses that would otherwise flag suspicious HTTP beaconing.

New Variant Uses DNS Tunneling to Evade Detection

TrickBot has plagued Windows environments for years thanks to its modular design, which lets operators bolt on new capabilities by downloading additional components after initial infection.

The samples Zhang analyzed are 64-bit, unpacked executables that share identical startup code and behavior despite carrying different file hashes, strongly suggesting they belong to a single, coordinated campaign rather than scattered, unrelated infections.

Before it even reaches the network stage, this variant works hard to frustrate analysts. Constant strings, like “Kernel32.dll,” are encrypted and decrypted only at runtime using XOR and subtraction operations,.

while nearly every Windows API call is resolved dynamically through hash-based lookups rather than static imports.This kind of layered evasion is exactly why signature-based detection alone keeps failing against mature malware families.

To survive reboots, the malware abuses the Windows Task Scheduler, creating a recurring task disguised with benign-sounding names like “Wireshark autoupdate #72784.”

It builds this task programmatically via the ITaskService COM interface, then stashes both the task name and its own executable path inside NTFS Alternate Data Streams, an often-overlooked filesystem feature, so that on relaunch it can recover this data and avoid spawning duplicate tasks.

Once launched with a “-u” flag, the malware encrypts its C2 requests with a simple XOR key, hex-encodes the result, and stitches it into subdomains ending in a hardcoded domain, sending the whole package as a DNS query to public resolvers such as 8.8.8.8.

Three packet types drive the exchange: type 0x30 carries outbound requests (split into 96-byte fragments when needed), 0x31 asks the server how much response data is coming, and 0x32 delivers the actual payload.

The response side is even more inventive. TrickBot hides data inside the IPv4 addresses returned in DNS answers, reserving the top six bits of the first octet as a sequence index so it can reorder addresses if a resolver scrambles them, and packing three payload bytes into each remaining address.

That scheme yields roughly 183 bytes per response packet and a measured throughput near 30.7 KB/s, slow, but tunneling traffic through DNS.

Once registered with its C2 server through a handshake-like “command 0,” the bot can execute shell commands, run PowerShell, inject code via process hollowing or doppelgänging, load DLLs through rundll32.exe, or run raw shellcode directly in memory.

This command menu mirrors capabilities seen in TrickBot’s HTTP-based versions, confirming that the DNS channel is a transport upgrade rather than a rewritten payload.

Fortinet reports that its AntiSpam, Web Filtering, IPS, and AntiVirus services already flag this campaign’s C2 domain and detect the DNS tunneling behavior under the signature “Trick.Botnet,” with samples caught by the AV signature “W64/TrickBot.WC!tr”.

Security teams should watch for unusually long or high-entropy DNS subdomains, repeated queries to a single external domain, and scheduled tasks referencing common software update names as low-cost indicators of this activity.