Security researchers have identified a new modular remote access trojan (RAT) named Abyssos, a C++ malware family that gives attackers broad control over infected Windows systems.
Zscaler ThreatLabz first observed Abyssos in late June 2026. The malware is actively being developed, with researchers tracking several versions and different code-obfuscation methods.
Its feature set includes remote shell access, hidden VNC sessions, file theft, browser-data collection, process control, keylogging support, and the ability to download extra modules from its command-and-control (C2) server.
Abyssos appears designed for post-exploitation activity. Once an attacker gains access to a target system, the RAT can collect host data, execute commands, move files, monitor activity, and expand its capabilities using encrypted plugins.
Abyssos RAT Takes Control
Abyssos uses several techniques to make reverse engineering harder and evade security analysis. Earlier samples check for virtualized environments by using the CPUID instruction to identify hypervisors such as VMware, KVM, Xen, and VirtualBox.
The malware also searches for common virtual-machine processes, including vmtoolsd.exe, VBoxService.exe, and xenservice.exe. If detected, it exits.
However, ThreatLabz noted that not every sample uses these anti-analysis checks. The newest observed version reportedly lacks them, showing that the malware is still changing during development.
The RAT also uses LLVM-based code obfuscation, likely relying on publicly available tooling. Observed techniques include control-flow flattening, bogus control flow, encrypted integer constants, and stack-based string obfuscation.
These methods make the binary more difficult for analysts and automated tools to understand.
Before starting its core functions, Abyssos dynamically resolves Windows API calls by calculating CRC32 hashes for exported functions.
It then creates a mutex to prevent multiple copies from running. Mutex names follow the Global\[UUID] pattern and may include _Admin or _User, depending on system privileges.
The malware next connects to its C2 server and registers the compromised device. It collects the computer name, username, CPU architecture, privilege level, public IP address, country code, and its own internal version number.
It then sends periodic PING requests and waits for commands from operators. Abyssos uses a custom TCP-based C2 protocol.
It encrypts inbound and outbound traffic with AES-GCM using a hardcoded 32-byte key. Downloaded modules receive another layer of protection using either AES-CBC encryption or XOR encoding.
One of its most notable features is hidden VNC support. Commands such as HVNC_START allow operators to create a remote desktop session, while HVNC_INPUT can simulate keyboard and mouse activity.
Attackers can launch browsers, PowerShell, Command Prompt, Windows Explorer, and email clients within that session, zscaler said.
Indicators of Compromise
| IOC Type | Indicator | Description |
|---|---|---|
| SHA-256 | 52b400c5be1557a8df146f62fde76d906e7e0a92ed76788717ef61c758f315aa | Abyssos RAT sample, version 2.4F |
| C2 Server | 213[.]145.86.42 | Command-and-control server linked to Abyssos 2.4F |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
 named Abyssos, a C++ malware family that gives attackers broad){kind=link}