Abyssos RAT Adds RDPWrap Module for Enhanced Remote Access Capabilities
A new modular remote access trojan, Abyssos, has emerged, featuring a novel RDPWrap-related module that expands its ability to control compromised Windows systems via Remote Desktop Protocol.
A new modular remote access trojan (RAT) named Abyssos has been identified, posing a significant threat to Windows environments with its expanding capabilities. Discovered in late June 2026 and still under active development, Abyssos is designed to steal credentials, exfiltrate files, and establish remote viewing sessions. Its modular architecture allows operators to deploy additional functionalities post-compromise, making it a versatile tool for persistent access and data theft.
Researchers at Zscaler have been tracking Abyssos, noting its evolving nature with various evasion techniques and protections designed to hinder analysis and detection. The malware communicates with its command-and-control (C2) server using a custom TCP protocol with AES-GCM encryption. Upon infection, it gathers system details such as computer name, user privileges, Windows version, and public IP address to register the compromised device.
A particularly noteworthy feature of Abyssos is its RDPWRAP-related module. This module, potentially linked to the open-source rdpwrap library, aims to extend an attacker's reach by leveraging the Remote Desktop Protocol (RDP). When commanded by the C2 server, Abyssos deploys this module, often disguised with a randomly generated name in the Windows temporary folder, and executes specific exports. The module itself is encrypted using AES-CBC, adding another layer of obfuscation for security analysts.
While the exact functionality and success rate of the RDPWRAP module in granting unrestricted RDP access are not fully detailed, its inclusion signifies a strategic effort by the developers to broaden the malware's post-compromise utility. This capability complements Abyssos's existing features, which include hidden VNC sessions, screen recording, remote shells, file transfer, and process management, potentially turning a single foothold into a long-term, difficult-to-investigate access point.
The modular design of Abyssos supports a wide array of malicious activities. It can perform file operations like copying, deleting, archiving, uploading, and downloading. Additionally, it can capture clipboard contents, log keystrokes, take screenshots, manage processes, and execute downloaded programs. A unique function allows it to open Chrome with remote debugging enabled, potentially hijacking authenticated browser sessions by loading stolen cookies.
Abyssos can also download modules for more specialized tasks, including keylogging, recovering credentials from Chrome and Firefox, collecting browser cookies, discovering domain controllers, scanning for vulnerabilities, and attempting privilege escalation. This expandable toolkit, combined with its anti-analysis features such as checks for virtual machines and analysis processes, makes Abyssos a formidable and adaptable threat.
Organizations are advised to monitor for unusual remote control behavior, suspicious files in temporary directories, and unexpected encrypted network traffic. The threat of browser cookie theft also highlights the need for robust account security, as simply changing a password may not be sufficient to end an attacker's active session if cookies have been compromised.
Indicators of compromise (IoCs) provided by Zscaler include specific SHA-256 hashes for Abyssos samples (e.g., 52b400c5be1557a8df146f62fde76d906e7e0a92ed76788717ef61c758f315aa) and IP addresses associated with its C2 infrastructure (e.g., 213[.]145.86.42).