9 minhigh
Abyssos Modular RAT Analysis | ThreatLabz
Abyssos is a modular remote administration tool written in C++ identified by Zscaler ThreatLabz in late June 2026. It uses LLVM-based obfuscation, anti-analysis checks, and a custom AES-GCM encrypted TCP protocol for C2 communication. The RAT supports a wide range of capabilities including VNC, keylogging, clipboard interception, file exfiltration, process management, UAC bypass, browser session hijacking, and a modular plugin system for credential harvesting and network scanning.
Sens:▲ 24hConf:high
Showing defanged values
- filenamecookies.jsonFile created under %TEMP%\fontconfigs\ by Abyssos HVNC_CLONE_START command when cloning browser data. Used by HVNC_PROG chrome_cdp to inject cookies into a Chrome instance via DevTools API for session hijacking.
- filename%TEMP%\fontconfigs\Directory created by Abyssos under the Windows temporary folder to store cloned browser data (cookies, profiles) for use in HVNC session hijacking.
- filenamewindows_update_cache.jsonHardcoded filename used by Abyssos keylogger to store captured keystrokes in the Windows temporary folder. Read when C2 sends KEYLOGGER_GETLOGS command.
- mutexGlobal\68AA60E5-6C45-4C01-9F0E-E25FC57C652FExample mutex created by Abyssos to ensure single instance execution. Mutex follows format Global\[UUID4] with _Admin or _User suffix appended based on user privileges or -elevated command line parameter.
Detection / Hunteropenrouter
What Happened
A new type of malicious software called Abyssos was discovered in June 2026. It allows attackers to remotely control infected computers, steal passwords, record keystrokes, capture screenshots, and hijack web browser sessions. The software is designed to be difficult for security researchers to analyze and can detect when it is running inside a virtual machine. It can also download additional tools to expand its capabilities, such as stealing browser credentials or scanning networks. Organizations using Windows computers should be aware of this threat and ensure their security tools are updated. Defenders should look for unusual files in the Windows temporary folder and unexpected network connections.
Key Takeaways
- Abyssos is a modular C++ RAT with credential theft, file exfiltration, VNC, keylogging, and browser session hijacking capabilities, first identified in late June 2026.
- The malware uses LLVM-based obfuscation passes including control flow flattening, bogus control flow, constant encryption, and stack-based string obfuscation to hinder reverse engineering.
- Abyssos implements anti-analysis checks for hypervisors via CPUID and terminates if VM-related processes are detected, though the most recent version omits these checks.
- The RAT uses a custom TCP protocol encrypted with AES-GCM and supports downloading additional modules decrypted via XOR or AES-CBC using the hardcoded key 1234567890abcdef.
- Abyssos includes two UAC bypass methods (fodhelper and ICMLuaUtil) and can hijack browser sessions by launching Chrome with debugging port 9222 and injecting cookies via the Chrome DevTools API.
Affected Systems
- Windows (all versions supporting the described APIs)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Abyssos binary executed on target Windows host (delivery method not described in article)
- Anti-Analysis: Malware checks for hypervisors via CPUID and VM-related process names; terminates if detected (not present in latest version)
- Initialization: Dynamically resolves Windows APIs via CRC32 checksum matching, creates mutex (Global[UUID4]_Admin or _User), collects host information
- C2 Communication: Establishes TCP connection to C2, sends registration beacon (HELLO format), begins PING/PONG heartbeat on dedicated thread
- Execution & Collection: Receives and executes network commands including VNC, keylogging, clipboard interception, file exfiltration, process management, and browser session hijacking via Chrome DevTools port 9222
- Modular Expansion: Downloads encrypted modules from C2, decrypts with XOR or AES-CBC (key 1234567890abcdef), writes to temp folder with specific prefixes, and executes via exported functions
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article is a technical analysis and does not include any detection rules, queries, or signatures.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can observe process creation, mutex creation, file writes to temp directory, and network connections. However, LLVM obfuscation and dynamic API resolution via CRC32 checksums reduce static analysis visibility. The absence of anti-analysis checks in the latest version means sandbox-based EDR detonation may succeed. |
| Network Visibility | Medium | Abyssos uses a custom TCP protocol with AES-GCM encryption, making payload inspection difficult. Network defenders can detect the C2 beacon pattern (HELLO format string) if TLS inspection or network-level decryption is available. The PING/PONG heartbeat pattern and consistent packet structure may be identifiable via traffic analysis. |
| Detection Difficulty | Hard | Abyssos uses LLVM-based obfuscation including control flow flattening and string encryption, dynamic API resolution via CRC32, and encrypted C2 communications. Module filenames are randomly generated with short prefixes, making file-based detection less reliable. The modular architecture means core behavior is split across downloaded components. |
Required Log Sources
- Sysmon Event ID 1 (Process Creation)
- Sysmon Event ID 2 (File Creation Time)
- Sysmon Event ID 3 (Network Connection)
- Sysmon Event ID 7 (Image Loaded - DLL loads)
- Sysmon Event ID 17/18 (Pipe events if applicable)
- Windows Security Event ID 4688 (Process Creation)
- EDR process telemetry and file write events
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for processes creating mutexes matching the pattern Global[UUID4]_Admin or Global[UUID4]_User, as Abyssos uses this format for single-instance enforcement. | Sysmon Event ID 17 (Pipe Event) or EDR mutex creation telemetry | Initialization | Low. Legitimate applications rarely use Global[UUID]_Admin/_User mutex naming. |
| Consider hunting for Chrome browser instances launched with remote debugging port 9222, which Abyssos uses for cookie injection and session hijacking via the HVNC_PROG chrome_cdp command. | Process creation logs with command line arguments (Sysmon Event ID 1, EDR) | Collection / Credential Access | Low to Medium. Developers may legitimately use Chrome debugging port, but it is uncommon in production environments. |
| Consider hunting for files written to the Windows temporary folder with prefixes klog, rcv, rvg, plg, dcf, vul, ds, gc, or rdp followed by random strings, as these correspond to Abyssos module naming conventions. | File creation events in temp directory (Sysmon Event ID 11, EDR file write telemetry) | Execution / Modular Expansion | Low. These specific short prefixes with random suffixes in the temp folder are atypical for legitimate software. |
| Consider hunting for processes that resolve Windows APIs by iterating export directories and comparing CRC32 checksums, as Abyssos uses this technique to dynamically load APIs without static imports. | EDR memory access telemetry, API call tracing, DLL load events (Sysmon Event ID 7) | Initialization / Defense Evasion | Medium. Some legitimate software uses hash-based API resolution, but it is uncommon. |
| Consider hunting for network connections that send a beacon matching the HELLO | %s | %s | %s |
Control Gaps
- Static signature-based AV may not detect Abyssos due to LLVM obfuscation passes including control flow flattening and constant encryption.
- Network-based detection relying on payload inspection will not see C2 traffic due to AES-GCM encryption of the custom TCP protocol.
- Sandbox detonation may fail for samples that include anti-analysis checks, though the latest version omits these checks.
- Module-based detection is challenging because modules are encrypted in transit, written with random filenames, and deleted after execution in some cases.
Key Behavioral Indicators
- Mutex creation matching pattern Global[UUID4]_Admin or Global[UUID4]_User
- File creation in Windows temp folder with prefixes: klog, rcv, rvg, plg, dcf, vul, ds, gc, rdp
- Creation of fontconfigs directory under Windows temp folder containing cookies.json
- Chrome process launched with remote debugging port 9222 parameter
- File named windows_update_cache.json created in Windows temp folder
- Process ancestry showing cmd.exe or powershell.exe spawned by the Abyssos binary via C2CMD or HVNC_PROG commands
- Network connections using custom TCP protocol with consistent packet structure (data_size, flag, 12-byte IV, data, 16-byte AES tag)
False Positive Assessment
Low. The combination of mutex naming pattern, temp folder file prefixes, Chrome debugging port usage, and custom TCP protocol creates a distinctive behavioral profile. Individual indicators such as cmd.exe or powershell.exe execution have higher false positive rates, but the specific file naming conventions and mutex format are uncommon in legitimate software.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider searching endpoint telemetry for mutexes matching Global[UUID4]_Admin or Global[UUID4]_User patterns and files in the Windows temp folder with prefixes klog, rcv, rvg, plg, dcf, vul, ds, gc, or rdp.
- If your EDR supports it, consider hunting for Chrome browser instances launched with remote debugging port 9222, as this indicates potential browser session hijacking activity.
- Consider blocking known C2 infrastructure if identified through network traffic analysis of the custom TCP protocol, though no specific IPs or domains were provided in the article.
Infrastructure Hardening
- Evaluate whether your network monitoring can detect custom TCP protocols with AES-GCM encrypted payloads, as Abyssos does not use standard HTTP/HTTPS for C2.
- Consider implementing application whitelisting or execution controls for files written to the Windows temporary folder, if supported by your endpoint tooling.
- If applicable, evaluate whether UAC configuration can be tightened to reduce the effectiveness of fodhelper and ICMLuaUtil bypass techniques.
User Protection
- Consider ensuring endpoint security products are configured to detect dynamic API resolution patterns and hash-based API lookups, if your EDR vendor supports this capability.
- Evaluate whether your browser security policies can restrict or alert on Chrome instances launched with debugging ports enabled in production environments.
- Consider deploying file integrity monitoring on the Windows hosts file, as Abyssos can add or remove DNS records via DNS_ADD and DNS_DEL commands.
Security Awareness
- Consider incorporating awareness of browser session hijacking risks into existing security training programs, emphasizing that attackers can clone and inject cookies to bypass authentication.
- If your organization uses clipboard monitoring protections, verify that they can detect the periodic clipboard interception pattern Abyssos uses (polling every second).
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping16 techniques
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Credential Access
Tactic
Discovery
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- File Paths:
%TEMP%\fontconfigs\- Directory created by Abyssos under the Windows temporary folder to store cloned browser data (cookies, profiles) for use in HVNC session hijacking.
- Command Lines:
- Purpose: Self-deletion of Abyssos binary after receiving SELF_DELETE command from C2 | Tools:
cmd.exe,ping,del| Stage: Defense Evasion / Cleanup |cmd.exe /C ping 127.0.0.1 -n 3 >nul & del /F /Q - Purpose: Remote shell session initiated by C2CMD command | Tools:
cmd.exe| Stage: Execution |cmd.exe
- Purpose: Self-deletion of Abyssos binary after receiving SELF_DELETE command from C2 | Tools:
- Other:
1234567890abcdef- Hardcoded XOR key and AES-CBC key/IV used to decrypt downloaded Abyssos modules. Used for KEYLOGGER, RECOVERY, RECOVERY_GECKO, SENDTXT, SENDTXT2, GRABCOOKIES (XOR) and HDRPFILE, DCFINDER, VULNSCAN, ELEVATE_SYS_TOKEN, DATASCAN, RDPWRAP (AES-CBC) modules.HELLO|%s|%s|%s|%s|%s|v2.4F|%s|%s|%s- Registration beacon format string sent by Abyssos to C2 server during initialization. Contains CPU architecture, computer name, username, integrity level, public IP, country, and version.
