In the ever-evolving landscape of cybersecurity, the emergence of new techniques and strategies by threat actors is a constant reminder of the need for vigilance and innovation. One such development is the recent evolution of TrickBot, a malware family that has been a persistent threat for years. This time, TrickBot has ditched its traditional HTTP command-and-control (C2) channel for a more sophisticated method: DNS tunneling. This shift not only highlights the adaptability of threat actors but also underscores the importance of understanding and countering these evolving tactics.
The Evolution of TrickBot
TrickBot, a malware family with a long history, has survived and thrived due to its operators' ability to adapt and iterate. In 2020, Microsoft coordinated a court-ordered takedown of the TrickBot botnet after it infected over one million devices. However, this variant shows that the operators are still at it, finding new ways to evade detection and maintain their operations.
DNS Tunneling: A New Twist
What makes this variant particularly interesting is its use of DNS tunneling. Instead of relying on HTTP, the malware now encrypts commands and smuggles them through DNS packets to a public resolver. This method is not only more stealthy but also harder to detect, as it leverages the legitimate functionality of DNS to hide its activities.
How DNS Tunneling Works
The malware disguises outbound C2 messages as ordinary domain-name lookups and reads the responses back from what appear to be ordinary IP addresses. Each command is encrypted with a single-byte XOR key, hex-encoded, and broken into 63-character chunks separated by periods to mimic a valid domain. This entire string is then prepended to a hardcoded C2 domain.
Three packet types carry the traffic: 0x30 for command requests, 0x31 for size queries, and 0x32 for response data. Inbound traffic exploits the DNS specification's allowance for multiple IPv4 addresses per reply, allowing TrickBot to re-sort the resolver's shuffled reply and read the remaining three bytes as raw payload.
Persistence and Modular Execution
TrickBot relies on the Windows Task Scheduler for persistence. It generates a task name by combining a randomly picked %AppData% folder name, the string "autoupdate #", and a random number, producing entries like "Wireshark autoupdate #72784" that run every five minutes. This task name and executable path are stored in two NTFS Alternate Data Streams (ADS), ensuring that subsequent executions rebuild the same scheduled task rather than creating duplicates.
Command handling remains close to the HTTP-era design, with FortiGuard documenting 12 response commands. These include downloading and executing EXE modules, running DLLs through rundll32.exe, injecting into processes via process hollowing or process doppelganging, executing PowerShell through anonymous pipes to cmd.exe, and running raw shellcode in memory.
Implications and Future Trends
The use of DNS tunneling by TrickBot highlights a broader trend in the evolution of malware. As security measures become more sophisticated, threat actors are forced to adapt, finding new and innovative ways to evade detection. This not only underscores the importance of continuous monitoring and adaptation in cybersecurity but also the need for enterprises to control their own DNS resolution to better detect and mitigate such threats.
Personal Perspective
Personally, I find the evolution of TrickBot particularly fascinating. It serves as a stark reminder that the arms race between attackers and defenders is never-ending. As we develop new tools and strategies to defend against threats, threat actors will always find new ways to circumvent them. This dynamic underscores the importance of staying ahead of the curve and continuously innovating in the field of cybersecurity.
In conclusion, the emergence of DNS tunneling by TrickBot is a significant development that highlights the need for vigilance and innovation in the face of evolving threats. As we continue to develop new tools and strategies to defend against these threats, it is crucial to remember that the arms race between attackers and defenders is never-ending.
