Abyssos RAT Uses Modular C2 Commands for Credential Theft, File Exfiltration, and Remote Access
Summary
Zscaler ThreatLabz analyzes Abyssos, a modular Windows RAT with encrypted C2 communications, extensive remote-control and data-theft commands, obfuscation, and optional anti-analysis checks.
Key points
- Abyssos is a C++ Windows RAT identified by Zscaler ThreatLabz in late June 2026 and remains in active development.
- Its capabilities include remote VNC access, file collection and exfiltration, clipboard monitoring, keylogging, remote shells, and browser-cookie theft.
- The malware uses a custom TCP protocol and AES-GCM encryption for most incoming and outgoing C2 data.
- It supports commands to download and execute files or shellcode, manipulate processes, bypass UAC, and collect host and network information.
- Abyssos obfuscates code with techniques including control-flow flattening, opaque predicates, integer encryption, and stack-based string obfuscation.
- Some samples check for hypervisors and analysis-related processes and terminate if detected; the latest version discussed does not include these checks.
- ThreatLabz provides two sample hashes and two C2 IP addresses as indicators of compromise.
Article Details
- Attack Vectors
- Abyssos communicates with its C2 server over a custom TCP protocol, using AES-GCM to encrypt network data.
- Abyssos supports remote access through VNC, including remote mouse and keyboard input, screen recording, and launching applications in the VNC session.
- Abyssos can collect browser cookies and credentials, capture keystrokes and clipboard data, gather files, and send collected data to its C2 server.
- Abyssos can download and execute files or modules from its C2 server, and can inject decrypted shellcode into a process specified by name.
- Abyssos includes commands for UAC bypass using fodhelper or the ICMLuaUtil COM interface.
- Some samples detect hypervisors and analysis-related processes, and use code obfuscation to hinder analysis.
- Defensive Notes
- ThreatLabz notes that anti-analysis features are not present in all samples; the most recent version it analyzed did not include them.
- Zscaler reports that its multilayered cloud security platform, including Zscaler Cloud Sandbox, detects indicators related to Abyssos.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 209[.]99[.]184[.]223 | Abyssos C2 server. |
| IPV4 | 213[.]145[.]86[.]42 | Abyssos C2 server. |
| SHA256 | 52b400c5be1557a8df146f62fde76d906e7e0a92ed76788717ef61c758f315aa | Abyssos sample version 2.4F. |
| SHA256 | ca94d95413210a2a325155740eb8a5c58627ad5c4e704478621e7fc8165fe173 | Abyssos sample version 2.1F. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationAbyssos uses control-flow flattening, opaque predicates, constant integer encryption, and stack-based string obfuscation.T1041 · Exfiltration Over C2 ChannelAbyssos uploads files and archives from the compromised host to its C2 server.T1049 · System Network Connections DiscoveryAbyssos can collect active TCP and UDP connections and their associated processes.T1055 · Process InjectionAbyssos can decrypt downloaded or packet-embedded shellcode and inject it into a specified process.T1056.001 · KeyloggingAbyssos supports a keylogger module and can read captured keystrokes.T1057 · Process DiscoveryAbyssos lists running processes and can collect process information repeatedly.T1059.001 · PowerShellAbyssos can launch PowerShell in its VNC session.T1059.003 · Windows Command ShellAbyssos supports a remote shell session using cmd.exe.T1082 · System Information DiscoveryAbyssos collects host details including the Windows version, CPU architecture, RAM, uptime, and GPU name.T1083 · File and Directory DiscoveryAbyssos can scan specified directories and files and list files and directories in a specified location.T1095 · Non-Application Layer ProtocolAbyssos uses a custom TCP protocol to communicate with its C2 server.T1105 · Ingress Tool TransferAbyssos downloads additional modules and files from its C2 server to the host.T1113 · Screen CaptureAbyssos can start a screen recorder and collect screenshots or images.T1115 · Clipboard DataAbyssos can intercept clipboard data.T1539 · Steal Web Session CookieAbyssos can collect browser cookies and use them to hijack browser sessions.T1548.002 · Bypass User Account ControlAbyssos supports UAC bypass using fodhelper or the ICMLuaUtil COM interface.
Malware
Vendors
Products
Google Chromechrome: Starts the Chrome browser.Microsoft WindowsDynamically loads any required Windows API functions and libraries. Abyssos iterates the export directory of each loaded library, calculates the CRC32 checksum of the exported function, and compares the result againstZscaler Cloud SandboxZscaler’s multilayered cloud security platform detects indicators related to Abyssos at various levels. The figure below depicts the Zscaler Cloud Sandbox, showing detection details for Abyssos.