Abyssos: Technical Analysis of a New Modular RAT
Zscaler, Monday, August 10th, 2026
Zscaler ThreatLabz analyses Abyssos, a modular C++ RAT using LLVM-based obfuscation and a custom TCP protocol.
Zscaler ThreatLabz details Abyssos, a new modular remote administration tool written in C++ that it first identified in late June 2026.
The RAT supports credential theft, file exfiltration and remote access via VNC, and downloads additional modules from its command-and-control server to extend capabilities.
Abyssos is under active development, with multiple version numbers and different obfuscation passes intended to improve evasion, and ThreatLabz assesses it uses different intermediate representation passes, most likely via a publicly available LLVM obfuscator such as Pluto, to thwart binary analysis. The malware communicates over a custom TCP protocol and supports a range of network commands.