New TrickBot Variant Spotted Using DNS to Control Infected Windows PCs
Fortinet has found a new TrickBot variant hiding commands in DNS traffic and using scheduled tasks and added modules to maintain access on infected Windows PCs.
TrickBot
Trojan
Modular banking trojan used for credential theft and as a precursor to Ryuk/Conti ransomware deployment.
Also known as: trickbot, trick bot, trickster
AI Intelligence Brief cached
Related YARA Rules View all on YARA Rules page →
90-Day Activity
Last 90 Days (4)
Last 90 Days
All Time
TrickBot variant uses DNS tunneling for command and control
This TrickBot variant, detailed in research by Fortinet's FortiGuard Labs, utilizes a modular architecture but features a redesigned transport layer.
TrickBot Ditches HTTP for DNS Tunneling in Latest Variant
New TrickBot variant hides C2 communication inside DNS queries, replacing decade-old HTTP pattern
Inside a TrickBot Variant Using DNS Tunneling for C2
FortiGuard Labs analyzes a TrickBot variant that uses DNS tunneling for C2 communication, modular execution, and employs persistence and obfuscation techniques