Inside a TrickBot Variant Using DNS Tunneling for C2

July 22, 2026 · Fortinet Threat Research · Severity: MEDIUM

FortiGuard Labs has identified a new TrickBot variant that leverages DNS tunneling for command-and-control (C2) communication, bypassing traditional network monitoring. The malware employs modular execution, allowing attackers to dynamically load malicious components, and uses persistence techniques like registry modifications to maintain access. Obfuscation methods, including encrypted strings and anti-analysis checks, further evade detection. This variant primarily targets financial institutions and enterprises, posing a heightened risk due to its stealthy DNS-based C2, which blends malicious traffic with legitimate DNS queries. The attack underscores the evolving sophistication of TrickBot, which remains a persistent threat despite previous takedown efforts. Organizations are urged to monitor DNS traffic anomalies and apply patches for known vulnerabilities (e.g., CVE-2021-44228) to mitigate risks.

FortiGuard Labs analyzes a TrickBot variant that uses DNS tunneling for C2 communication, modular execution, and employs persistence and obfuscation techniques