Loading story…
Zscaler ThreatLabz disclosed Abyssos, a newly identified modular Windows remote access trojan written in C++ that combines surveillance, credential theft, file exfiltration, and post-exploitation features. The malware uses anti-analysis checks for hypervisors and running processes, dynamically resolves Windows APIs with CRC32 checksums, creates a mutex to ensure a single instance, and registers infected hosts to command-and-control infrastructure with a HELLO message carrying host metadata and the malware version. Researchers said Abyssos is under active development, with multiple observed versions including 2.4F and 2.1F and differing obfuscation across samples.
Abyssos communicates over a custom TCP protocol encrypted mainly with AES-GCM using a hardcoded 32-byte key, while some downloaded modules rely on AES-CBC or XOR-based decryption. Its command set enables hidden VNC remote desktop access, browser session hijacking, clipboard interception, process and network monitoring, remote shell access, payload execution, UAC bypass, self-deletion, and broad file operations. Auxiliary modules extend the malware with keylogging, cookie and credential theft, domain controller discovery, vulnerability scanning, SYSTEM token elevation, and possible RDP-related functionality, and the report included associated sample hashes and command-and-control IP addresses.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Zscaler ThreatLabz reported a newly identified malware family named Abyssos and described it as a modular C++ remote administration tool with credential theft, file exfiltration, VNC-based remote access, and post-exploitation capabilities.
ThreatLabz published a technical analysis of Abyssos version 2.4F, detailing its anti-analysis logic, dynamic API resolution, encrypted C2 communications, extensive command set, and auxiliary modules. The report also noted multiple versions in active development and listed sample hashes and C2 IP addresses tied to versions 2.4F and 2.1F.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcezscaler.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered **Auraboros C2**, a previously undocumented Brazilian remote access trojan framework whose management panel at `174.138.43[.]25:5000` was exposed on the public internet **without authentication**. The HTTP-based Express.js and Socket.io dashboard, hosted on DigitalOcean and written in Brazilian Portuguese, allowed anyone with network access to view victim metadata, command history, keylogs, browser credential theft results, and real-time operator activity. Investigators said the platform supports extensive surveillance and post-compromise actions, including screenshots, webcam capture, **live audio streaming**, Wi-Fi password extraction, file operations, shell execution, reverse SOCKS5 proxying, and over-the-air malware updates. Analysis indicated the Windows implant likely used **DLL sideloading** via `DiskIntegrityScanner.exe`, decrypted Chrome and Brave credentials with **Windows DPAPI**, and included a cookie impersonation capability alongside a self-destruct function. Despite the broad feature set, researchers found only one registered beacon tied to a Lenovo laptop in Goiânia, Brazil, suggesting the infrastructure was still in development or testing rather than large-scale deployment. The exposed server also listened on ports `1080` and `9000`, believed to support reverse SOCKS5 and beacon or stager traffic, and the operator was assessed as a Brazilian Portuguese-speaking developer whose poor operational security left the entire framework and test telemetry publicly accessible.
Jun 29, 2026
Threat researchers reported multiple **remote access trojan (RAT)** developments that emphasize stealth, surveillance, and post-exploitation flexibility. A new **Remcos RAT** variant was observed adding real-time surveillance features (including on-demand webcam streaming) and keystroke transmission, while improving evasion through modular DLL plugins, encrypted C2 with in-memory-only config decryption, and dynamic API resolution; it also attempts to reduce forensic artifacts by deleting collected data (e.g., screenshots, audio, keylogging output, cookies) and removing persistence-related registry entries. Separately, Elastic detailed a **ClickFix** social-engineering campaign that uses compromised legitimate websites as delivery infrastructure to deploy a previously undocumented Windows RAT dubbed **MIMICRAT** (*AstarionRAT*). The intrusion chain includes a multi-stage PowerShell flow with **ETW and AMSI bypass**, a Lua-based shellcode loader, and HTTPS C2 on port `443` using traffic patterns designed to resemble web analytics; the implant supports token impersonation, SOCKS5 tunneling, and a broad command set, with suspected end goals of **ransomware deployment or data theft**. In parallel mobile-focused reporting, Zimperium described **ZeroDayRAT**, a cross-platform Android/iOS spyware-style RAT distributed via social engineering and sideloaded apps, enabling screen capture, keylogging, and credential/file exfiltration, highlighting continued convergence of surveillance and remote-control capabilities across endpoints.
Jun 29, 2026
Rhadamanthys emerged as a fast-growing malware-as-a-service infostealer sold on criminal forums, using aggressive promotion and frequent updates to attract operators. Researchers found it delivered through lures including fake AnyDesk installers and malicious Google Ads, then executed through a multi-stage chain involving packed droppers, shellcode, custom loaders, VM-evasion, API unhooking, and obfuscated command-and-control retrieval. The malware was observed attempting infections beyond broad consumer targeting, including a Canadian government agency and an Indian energy company, while generally avoiding CIS targets. Technical analysis showed Rhadamanthys stealing credentials, cookies, browser data, and information from password managers, VPNs, messaging apps, email clients, FTP tools, gaming platforms, and cryptocurrency wallets. Later versions, including `v0.5.0`, added a plugin architecture, keylogging, spyware-like data collection, Lua and .NET extensions, process injection, raw and indirect syscalls, Heaven’s Gate, and ETW/AMSI bypasses, allowing operators to fetch and run additional modules from C2 infrastructure. Researchers also reconstructed its final payload behavior from memory artifacts, showing how the malware parses Chrome SQL and JSON stores and executes downloaded components via `rundll32` to broaden theft and post-compromise capability.
Aug 15, 2026