Inside a TrickBot Variant Using DNS Tunneling for C2

July 22, 2026 · Fortinet Threat Research · Severity: MEDIUM

FortiGuard Labs has uncovered a new TrickBot variant leveraging DNS tunneling for command-and-control (C2) communication, bypassing traditional network detection. The malware employs modular execution, allowing attackers to dynamically load malicious components, and uses persistence techniques like registry modifications to maintain access. Obfuscation methods, including junk code insertion, further evade analysis. This variant primarily targets financial institutions and enterprises, posing a significant threat due to its stealthy DNS-based C2, which blends malicious traffic with legitimate DNS queries. The malware’s modularity enables flexible attack campaigns, while its persistence mechanisms ensure long-term infiltration. Organizations should monitor DNS traffic anomalies and update defenses to mitigate risks from this evolving threat.

FortiGuard Labs analyzes a TrickBot variant that uses DNS tunneling for C2 communication, modular execution, and employs persistence and obfuscation techniques