TrickBot variant uses DNS tunneling for C2 instead of HTTP, with ADS-stored config and in-memory modules
FortiGuard Labs analyzed a TrickBot variant that carries command-and-control (C2) traffic over DNS tunneling, embedding encoded data in DNS queries and responses, instead of the HTTP used by earlier variants. The malware persists through Windows Task Scheduler, stores its configuration in NTFS Alternate Data Streams, and hinders analysis …