TrickBot malware shifts to DNS tunnelling for command and control

Security researchers have identified a new variant of the TrickBot malware that has replaced its decade-old HTTP-based command and control communication method with DNS tunnelling, a technique that hides malicious traffic inside legitimate DNS queries. Infosecurity Magazine reports that this change represents a significant evolution in TrickBot's detection evasion capabilities, as DNS traffic is rarely inspected with the same rigour as HTTP or HTTPS connections, and DNS tunnelling can bypass many traditional network security controls. TrickBot has been a persistent threat to organisations worldwide since 2016, historically used for credential theft, lateral movement and ransomware deployment, and this shift in communication method suggests the operators are adapting to improved network visibility and detection capabilities.

Why this matters for UK organisations

This development is a reminder that established malware families continue to evolve in response to defensive improvements, and that detection strategies must adapt accordingly. DNS tunnelling is not a new technique, but its adoption by a widely deployed and operationally mature threat like TrickBot increases the likelihood that organisations will encounter it in real incidents. Many networks allow DNS traffic to flow with minimal inspection, and DNS queries to external resolvers are often considered routine and low-risk. If TrickBot or similar malware is using DNS for command and control, traditional perimeter defences, web proxies and endpoint detection tools that focus on HTTP traffic may not provide adequate visibility. For UK businesses, this highlights the importance of monitoring DNS activity as part of a layered detection strategy. DNS tunnelling can be identified through anomaly detection, such as unusually large query volumes, suspicious domain patterns, long or encoded query strings, or queries to newly registered or low-reputation domains. However, these indicators require visibility into DNS traffic, which many organisations do not currently have.

What to review

Organisations should review whether DNS traffic is being monitored, logged and inspected for anomalies such as tunnelling or data exfiltration attempts. This includes verifying that DNS queries are being sent through controlled resolvers rather than directly to external DNS servers, and that logs are being retained and analysed for suspicious patterns. It is also worth considering whether DNS filtering, threat intelligence feeds for malicious domains, and visibility into DNS queries leaving the network are in place, particularly from endpoints and servers that do not typically generate high DNS activity. For organisations using endpoint detection and response tools, it is worth checking whether DNS monitoring is enabled and whether alerts are configured for DNS-based command and control indicators. This is not a high-urgency change, but it is a sensible addition to network monitoring and detection capabilities, particularly given the continued prevalence of TrickBot and similar threats in the wild.

Source: Infosecurity Magazine