Threat reportMalwareTL-2026-3827
TrickBot masrv Module: Masscan-based Network Scanner with Anchor/Bazar Infrastructure Overlap
TrickBot masrv Module (TL-2026-3827), also tracked as masrv, is a high-severity malware campaign, first published 2026-10-17. It is attributed to TrickBot operators with low confidence, affects Microsoft Windows (32-bit and 64-bit), maps to 5 MITRE ATT&CK techniques (T1018, T1046, T1071.001), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 1TrickBot operators
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-3827
- Threat ID
- TL-2026-3827
- Also known as
- masrv, TrickBot Masscan module
- Severity
- HIGH
- Status
- MONITORING
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- TrickBot operators
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in TrickBot masrv Module
Malware and tooling: Anchor - S0504, Bazar - S0534, BazarBackdoor, masrv, Masscan, Trick Bot
How TrickBot masrv Module works
Kryptos Logic analyzed 'masrv', a TrickBot module that embeds the open-source Masscan port scanner. It pulls IP ranges, port ranges and scan rate from C2 over HTTP and posts discovered open ports back, giving operators internal-network reconnaissance. The sample was compiled 2020-12-04 and had not been observed in the wild at time of reporting.
masrv is a network reconnaissance module for the TrickBot modular trojan, delivered as a 32-bit or 64-bit DLL (the analyzed samples are debug builds) exporting two functions, Start and Control. The module embeds Masscan and uses Masscan's own packet-level TCP/IP stack, which requires the NPcap driver (NPcap\Packet.dll). If NPcap is absent, masrv downloads an installer named npcap.exe from the C2 and runs it via CreateProcessA or ShellExecuteExA.
C2 communication is plain HTTP using URIs of the form http://<c2>:<port>/<gtag>/<botID>/mass/<command>, where gtag is the campaign ID from the bot config and botID identifies the victim. At startup the module issues GET requests for the commands 'freq' (reporting frequency), 'domains' (despite the name, the IP and port ranges to scan) and 'rate' (packet transmission rate), and can fetch 'npcap.exe'. Discovered open ports are aggregated and POSTed to the C2 with command '81' at the interval set by 'freq'; a 'over' GET signals scan completion. For adapter selection the module reads the ARP table and local IP table (GetIpNetTable, GetIpAddrTable) and verifies connectivity with 'ping 8.8.8.8 -S <local_IP>'.
The module carries an unreferenced Anchor C2 communication function and a hardcoded list of IP addresses previously associated with Anchor and Bazar infrastructure, consistent with TrickBot developers' practice of sharing code across toolsets. Debug strings and PDB paths (D:\Project\masrv\build-masrv\debug\Desktop_msvc_15_0_32bit|64bit\masrv.pdb) show it was built from a Qt/MSVC 2017 project. Kryptos Logic dates the compilation to 2020-12-04 and reported the module had not yet been seen deployed, suggesting testing or early development after the October 2020 Microsoft-led disruption of TrickBot. Secondary reporting (Security Affairs) assesses that the scan results would help operators plan lateral movement; this is analyst inference rather than observed behavior.
Defenders should treat the module as a precursor to internal reconnaissance: high-rate SYN scanning from a single workstation, an NPcap installation not initiated by an administrator, and HTTP requests with a /mass/ path segment to non-corporate hosts are the main observable behaviors.
MITRE ATT&CK techniques used in TL-2026-3827
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery
Command and Control
Execution
Reconnaissance
Affected products and versions in TrickBot masrv Module
- Microsoft — Windows (32-bit and 64-bit)
Vulnerable versions: Hosts infected with TrickBot; no software vulnerability is exploited
Remediation for TrickBot masrv Module
Immediate actions
- Block the hardcoded masrv/Anchor/Bazar IP addresses listed in the IOCs at the perimeter and alert on any historical connections
- Hunt for the masrv DLL SHA-256 hashes and the strings 'maserv.txt' and '/mass/' HTTP paths on endpoints and in proxy logs
- Alert on unexpected NPcap installations (npcap.exe) on non-administrative workstations
Workarounds
- Restrict outbound HTTP to categorized/proxied destinations to prevent direct-to-IP C2 requests
- Use application allow-listing to block unsigned DLL modules and unauthorized driver installers
Longer-term hardening
- Deploy EDR with detection for high-rate port scanning originating from user endpoints
- Monitor east-west traffic for single hosts sweeping many IPs/ports (Masscan-style SYN scans)
- Segment internal networks so a compromised workstation cannot reach management and server ports broadly
Timeline of TrickBot masrv Module
- October 2020: Microsoft-led disruption effort against TrickBot infrastructure; the botnet subsequently rebounded (exact day not stated in the cited sources).
- December 2020: TrickBot adds UEFI/BIOS inspection capabilities, per Threatpost's resurgence context.
- masrv DLLs compiled (13:19:27 timestamp per Kryptos Logic).
- Kryptos Logic begins analysis of the masrv module (research window 2021-01-29 to 2021-02-01).
- Researchers report the module had not been observed deployed in the wild, suggesting testing/early development.
- Kryptos Logic publishes 'TrickBot masrv Module' with hashes, hardcoded IPs and YARA indicators.
Sources cited for TrickBot masrv Module
Detection coverage for TL-2026-3827
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3827 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.