New Atroposia RAT Uses Hidden Remote Desktop, Vulnerability Scanning and Advanced Persistence

Atroposia is described as a sophisticated new remote access trojan that offers hidden remote desktop access, credential theft, and network manipulation, with its affordability noted at around $200 per month, $500 for three months, or $900 for six months.

According to Varonis, the malware is promoted on underground forums as a plug‑and‑play toolkit, including a hidden remote desktop feature branded as “HRDP Connect” that creates invisible sessions and can enable real‑time surveillance and data access without the victim being aware. The malware also includes persistence mechanisms, a built‑in file manager for remote browsing, a Grabber module for file collection, and fileless exfiltration techniques to minimise on‑disk traces.

It can manipulate network traffic via a DNS hijacking module and employs a built‑in vulnerability scanner to enumerate missing patches and vulnerable software versions after initial compromise. The article, published on 29 October 2025, notes that these capabilities illustrate a broader trend of criminal toolkits being packaged for ease of use and price‑point accessibility in underground marketplaces.