New Trickbot module uses Masscan for local network reconnaissance

[silversurfer]

Content source

https://www.zdnet.com/article/new-trickbot-module-uses-masscan-for-local-network-reconnaissance/

Cyber-security experts say they spotted a new component of the Trickbot malware that performs local network reconnaissance.
Named masrv, the component incorporates a copy of the Masscan open-source utility in order to scan local networks for other systems with open ports that can be attacked at a later stage.
The idea behind masrv is to drop the component on newly infected devices, send a series of Masscan commands, let the component scan the local network, and upload the scan results to a Trickbot command and control server.
If the scan finds systems with sensitive or management ports left open inside an internal network —which is very common in most companies— the Trickbot gang can then deploy other modules specialized in exploiting those loopholes and move laterally to infect new systems.

"Not overall novel — but strange for it to be included in Trickbot," Suweera DeSouza, a malware analyst at Kryptos Logic, and the one who discovered masrv, told ZDNet today.
DeSouza said she believes the module is still under testing, something that Trickbot has done before with other modules in the past, which have often ended up being added to its large arsenal of second-stage components.
"We only came across one variant of this module," DeSouza said.
"The recent module compiled was on December 4, 2020. Since then we haven't come across the module being used again."
A technical analysis and indicators of compromise for the new masrv Trickbot module, authored by DeSouza and her colleagues, is available on the Kryptos Logic blog.

New Trickbot module uses Masscan for local network reconnaissance

The new Trickbot module is used to scan local networks for other nearby systems with open ports that could be hacked for quick lateral movement inside a company.

www.zdnet.com