Back Scworld

TrickBot variant uses DNS tunneling for command and control | brief

Scworld • July 22, 2026

Per Infosecurity Magazine, a new variant of the TrickBot malware has been observed abandoning its traditional HTTP command-and-control (C2) channel for a custom DNS tunneling scheme, embedding malicious communications within seemingly normal DNS queries.

This TrickBot variant, detailed in research by Fortinet's FortiGuard Labs, utilizes a modular architecture but features a redesigned transport layer. It disguises outbound C2 messages as domain-name lookups and reads responses from IP addresses. Commands are encrypted with a single-byte XOR key, hex-encoded, and broken into chunks to mimic valid domains. Inbound traffic exploits the DNS specification's allowance for multiple IPv4 addresses per , with TrickBot extracting payload data from these addresses.

The malware achieves persistence through the Windows Task Scheduler, creating tasks that run every five minutes. Its modular execution capabilities, including downloading and executing modules, injecting into processes, and running shellcode, remain intact. This shift to DNS tunneling, which FortiGuard measured at approximately 30.7 KB per second throughput, allows TrickBot to evade detection and maintain its status as a persistent threat despite disruption efforts.

Source: Infosecurity Magazine

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

TrickBot Malware Adopts DNS Tunneling for Command-and-Control Communication A new variant of TrickBot has been identified using DNS tunneling instead of HTTP for command-and-control (C2) communication. This shift allows the malware to conceal its traffic within malformed DNS queries, making detection more challenging. FortiGuard Labs reported that this variant maintains its modular architecture, enabling it to download and execute additional malicious modules. The malware persists on infected systems by leveraging the Windows Task Scheduler, creating tasks that run every few minutes. This adaptation highlights the ongoing evolution of TrickBot, which previously faced significant disruption from a 2020 takedown effort. The malware's ability to encrypt commands and disguise its traffic poses a high risk to Windows users. The research indicates that the malware can transfer data at a rate of approximately 30.7 KB per second. Organizations are advised to enhance their DNS security measures to mitigate the risks associated with this variant. 3 sources 70

Extracted Entities

TrickBot variant uses DNS tunneling for command and control | brief

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (4)

Platforms (1)