Abyssos Modular RAT: LLVM-Obfuscated Credential Theft and VNC Access — OTX Pulse Detection Pack

AlienVault OTX pulse data confirms the emergence of Abyssos, a previously undocumented modular remote administration tool (RAT) written in C++ that surfaced in late June 2026 and is now being actively tracked across the threat research community. The pulse — sourced from Zscaler's technical analysis — describes a full-featured intrusion toolkit combining credential theft, file exfiltration, and interactive remote access via VNC, all wrapped in LLVM-based compiler obfuscation designed to frustrate both static analysis engines and human reverse engineers.

While no specific threat actor attribution, targeted industries, or victim geography has been published (TLP:WHITE, actor listed as Unknown), the capability profile is unambiguous: this is an infostealer-class intrusion tool built for sustained hands-on-keyboard access, not a smash-and-grab stealer. The modular architecture means operators can deploy credential theft, exfiltration, or VNC modules selectively per victim — a hallmark of operationally mature tooling typically monetized through initial access brokerage or direct ransomware enablement.

The attack chain implied by the pulse:

1. Initial delivery (vector not yet documented — assume phishing loader or cracked-software bundling until proven otherwise)
2. Execution of an LLVM-obfuscated C++ payload using control flow flattening and string encryption to defeat signature and heuristic detection
3. C2 registration over a custom TCP protocol to the observed infrastructure (213.145.86.42, 209.99.184.223)
4. Module staging — credential harvesting, file collection/exfiltration, and VNC-based interactive session access on operator demand

Security teams should treat any Abyssos detection as a compromised-credential event by default, not merely a malware quarantine ticket.

Threat Actor / Malware Profile

Abyssos — Modular C++ RAT

Distribution method: Not yet documented in the pulse. Given the C++ toolchain and modular design, expect delivery via obfuscated loaders, malvertising droppers, or trojanized software — consistent with how comparable modular RATs (e.g., NetSupport, AsyncRAT variants) are seeded.

Payload behavior:

• Credential theft module — harvests stored credentials (browser stores, credential managers, potentially LSASS-adjacent artifacts) for account takeover and resale
• File exfiltration module — enumerates and stages files of interest for outbound transfer
• VNC remote access module — provides operators an interactive desktop session, enabling hands-on-keyboard activity that bypasses many malware-only detections

C2 communication: Uses a custom TCP protocol rather than standard HTTP(S) beaconing. This evades proxy-based TLS inspection and web-filtering stacks that key on HTTP semantics. The observed C2 IPv4 indicators — 213.145.86.42 and 209.99.184.223 — should be treated as live operator infrastructure. Non-standard outbound TCP from workstations to rare destinations is the primary network-side signal.

Persistence mechanism: Not explicitly enumerated in the pulse. Given the interactive-access design, assume standard Windows persistence (Run keys, scheduled tasks, or service installation) and hunt accordingly until the Zscaler report's specifics are confirmed.

Anti-analysis techniques:

• LLVM-based obfuscation: control flow flattening breaks decompiler graph output; analysts see a single massive dispatcher loop instead of readable function logic
• String encryption: static string extraction yields ciphertext; YARA rules keyed on plaintext strings (mutexes, C2 literals, module names) will fail — pivot to behavioral and network indicators
• These choices indicate the developers expect their samples to be analyzed and engineered specifically against both sandbox detonation and manual reverse engineering

IOC Analysis

The pulse contains 4 indicators across two types:

Operationalization guidance:

• IPv4 indicators are the highest-value detection surface here. Because Abyssos uses a custom TCP protocol and encrypted strings, network egress blocking and retro-hunting on these IPs will catch infections even when the binary itself evades AV. Push both IPs to firewall/proxy block lists, EDR network IOC lists, and SIEM watchlists immediately.
• SHA256 hashes are point-in-time artifacts — a recompiled or re-obfuscated build trivially changes the hash. Use them for retro-hunting (has this exact sample executed anywhere in my fleet?) but do not rely on them as a forward control. Hash matching is trivially operationalized via EDR file reputation lookups, VirusTotal Enterprise retrohunts, or Get-FileHash sweeps (see hunt script below).
• Because string encryption defeats static YARA, SOC teams should pivot to behavioral detections: non-standard outbound TCP from user-context processes, VNC-style screen-access behavior, and credential-store access patterns — exactly what the Detection Engineering section below targets.

Detection Engineering

---
title: Abyssos RAT C2 Communication to Known Infrastructure
id: 4a1b7c2e-8f3d-4e5a-9b6c-abyssosc2001
status: experimental
description: Detects outbound network connections to known Abyssos modular RAT C2 IP addresses using its custom TCP protocol.
author: Security Arsenal Threat Intelligence
date: 2026/08/11
references:
    - https://www.zscaler.com/blogs/security-research/abyssos-technical-analysis-new-modular-rat
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp:
            - 213.145.86.42
            - 209.99.184.223
    condition: selection
falsepositives:
    - Legitimate traffic to these hosts is unlikely; investigate any match as high priority
level: critical
tags:
    - attack.command_and_control
    - attack.t1095
---
title: Suspicious Non-Browser Process Accessing Browser Credential Stores
id: 5c2d8e3f-9a4b-4c6d-8e7f-abyssoscred002
status: experimental
description: Detects non-browser processes reading browser credential databases (Login Data, cookies, key4.db), consistent with Abyssos credential theft module behavior.
author: Security Arsenal Threat Intelligence
date: 2026/08/11
logsource:
    category: file_event
    product: windows
detection:
    selection_paths:
        TargetFilename|contains:
            - '\AppData\Local\Google\Chrome\User Data\'
            - '\AppData\Local\Microsoft\Edge\User Data\'
            - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
    selection_files:
        TargetFilename|endswith:
            - '\Login Data'
            - '\Cookies'
            - '\key4.db'
            - '\logins.json'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
    condition: selection_paths and selection_files and not filter_browsers
falsepositives:
    - Legitimate password managers and backup agents accessing browser profiles
level: high
tags:
    - attack.credential_access
    - attack.t1555.003
---
title: Potential Unauthorized VNC or Remote Access Server Execution
id: 7e3f9a4b-1c5d-4e7f-9a8b-abyssosvnc003
status: experimental
description: Detects execution of VNC-related binaries or unsigned processes listening on common VNC ports, consistent with Abyssos VNC remote access module deployment.
author: Security Arsenal Threat Intelligence
date: 2026/08/11
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\vncserver.exe'
            - '\winvnc.exe'
            - '\tvnserver.exe'
            - '\ultravnc.exe'
    selection_cli:
        CommandLine|contains:
            - '-rfbport'
            - 'vnc'
            - ':5900'
    filter_admin_paths:
        Image|startswith:
            - 'C:\Program Files\uvnc bvba\'
            - 'C:\Program Files\TightVNC\'
    condition: (selection_img or selection_cli) and not filter_admin_paths
falsepositives:
    - IT-administered VNC deployments; tune filters to approved installation paths
level: high
tags:
    - attack.command_and_control
    - attack.t1219

// Abyssos RAT hunt: known C2 IPs + suspicious credential-store access + VNC-like listeners
let c2_ips = dynamic(["213.145.86.42", "209.99.184.223"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in (c2_ips)
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessSHA256;
let CredAccess = DeviceFileEvents
| where TimeGenerated > ago(30d)
| where FileName in~ ("Login Data", "key4.db", "logins.json", "Cookies")
| where FolderPath has_any ("Chrome\\User Data", "Edge\\User Data", "Firefox\\Profiles")
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe")
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessSHA256;
let VNCListen = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where ActionType == "ListeningConnection"
| where LocalPort in (5900, 5901, 5800)
| project TimeGenerated, DeviceName, LocalPort, InitiatingProcessFileName, InitiatingProcessFolderPath;
union NetworkHits, CredAccess, VNCListen
| order by TimeGenerated desc

# Abyssos RAT IOC Hunt Script - Run elevated on suspected endpoints or via remote sweep
$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# 1. Check active/historical network connections to known Abyssos C2 IPs
$c2IPs = @('213.145.86.42','209.99.184.223')
$netconns = Get-NetTCPConnection | Where-Object { $c2IPs -contains $_.RemoteAddress }
foreach ($c in $netconns) {
    $proc = Get-Process -Id $c.OwningProcess
    $report += [PSCustomObject]@{Check='C2 Connection'; Finding="$($proc.ProcessName) (PID $($c.OwningProcess)) -> $($c.RemoteAddress):$($c.RemotePort) [$($c.State)]"}
}

# 2. Hunt for known Abyssos payload hashes across common staging paths
$hashes = @(
  '52b400c5be1557a8df146f62fde76d906e7e0a92ed76788717ef61c758f315aa',
  'ca94d95413210a2a325155740eb8a5c58627ad5c4e704478621e7fc8165fe173'
)
$searchPaths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA", "$env:ProgramData", "$env:USERPROFILE\Downloads")
foreach ($p in $searchPaths) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
        if ($hashes -contains $h) {
            $report += [PSCustomObject]@{Check='Malicious Hash'; Finding="$($_.FullName) [$h]"}
        }
    }
}

# 3. Check common persistence locations for suspicious entries
$runKeys = @(
  'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
  'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($rk in $runKeys) {
    Get-ItemProperty $rk | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' -and ($_.Value -match 'AppData|Temp|ProgramData') } | ForEach-Object {
            $report += [PSCustomObject]@{Check='Persistence - Run Key'; Finding="$rk :: $($_.Name) = $($_.Value)"}
        }
    }
}
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike '\Microsoft\*' -and $_.Actions.Execute -match 'AppData|Temp' } | ForEach-Object {
    $report += [PSCustomObject]@{Check='Persistence - Scheduled Task'; Finding="$($_.TaskName) -> $($_.Actions.Execute)"}
}

# 4. Check for unexpected VNC-style listeners
Get-NetTCPConnection -State Listen | Where-Object { $_.LocalPort -in 5800,5900,5901 } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    $report += [PSCustomObject]@{Check='VNC Listener'; Finding="Port $($_.LocalPort) owned by $($proc.ProcessName) ($($proc.Path))"}
}

if ($report.Count -eq 0) { Write-Output "[+] No Abyssos indicators found on $env:COMPUTERNAME" }
else { $report | Format-Table -AutoSize; $report | Export-Csv -Path ".\abyssos_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation }

Response Priorities

Immediate (0–4 hours)

• Block both C2 IPs (213.145.86.42, 209.99.184.223) at the firewall, proxy, DNS sinkhole, and EDR network layer. Because the custom TCP protocol bypasses HTTP inspection, IP-level egress blocking is the control that matters.
• Retro-hunt all egress logs (30 days) for any connection to those IPs — a single hit is a confirmed compromise, not a false positive candidate.
• Sweep endpoints for the two published SHA256 hashes via EDR file reputation and the PowerShell hunt script above.
• Isolate any host showing matches pending forensic triage.

Within 24 Hours

• Treat every confirmed Abyssos detection as a credential compromise. The credential theft module means any interactive or stored credential on the affected host is burned: force resets for the affected users' domain accounts, revoke active sessions/refresh tokens (Entra ID, Okta, VPN), and invalidate browser-synced credentials.
• Audit authentication logs for the affected identities for anomalous logins (impossible travel, new devices, MFA fatigue patterns) — assume resale or reuse of harvested credentials is already underway.
• Check for VNC listeners on ports 5800/5900/5901 across the fleet; interactive access means the operator may have already moved laterally from the initial victim.

Within 1 Week

• Harden against the delivery vector: since the initial access method is unconfirmed, close the most probable gaps — block executable content in email, restrict unsigned binary execution via application control (WDAC/AppLocker), and alert on binaries executing from user-writable paths (AppData, Temp).
• Deploy the Sigma rules above to your SIEM and tune VNC allowlists to sanctioned IT tooling only.
• Review egress architecture: Abyssos' custom TCP protocol demonstrates that HTTP-only inspection is a blind spot. Ensure your egress filtering alerts on any non-standard outbound TCP to rare external destinations from workstations.
• Add LLVM-obfuscated-sample handling to your IR runbook: string-based YARA will fail against this family; lean on behavioral EDR telemetry and network indicators instead.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub