LabubaRAT, a previously undocumented Rust-based remote access tool (RAT) masquerading as NVIDIA software and enabling post-compromise operations on Windows systems, has been discovered by Blackpoint Cyber.
According to researchers, LabubaRAT “creates a reusable support for hands-on activities.” Once deployed, it can profile the host, identify installed security tools, receive operator commands, transfer files, capture screenshots, and route network traffic through the affected system.
Blackpoint Cyber named the malware LabubaRAT after discovering a “LabubaPanel” title and a Labubu-style favicon on the associated command-and-control (C2) infrastructure.
Table of Contents
Configuration created for reuse
Instead of hard-coding its infrastructure into the binary, LabubaRAT receives its configuration at startup via command line arguments or appropriate environment variables.
Operators can specify the command and control server, organization, group tag, and API key at runtime. These values determine how the malware connects to its infrastructure and how often it checks for new commands. Instead of specifying each parameter individually, operators can also package them into a single Base64-encoded configuration block that the malware decodes during execution.
“Because these values were provided at launch, the same compiled binary could be reused with different infrastructures, organizations, or campaign groupings, rather than relying on a hard-coded server,” the researchers noted.
After registering with its command and control server, the malware stores local state in a SQLite database named nvctr_sys.db and supports communication via HTTPS polling, Microsoft Edge WebView2 and DNS tunneling. Multiple communication paths help maintain connectivity when a channel is unavailable.
The RAT supported HTTPS, WebView2 and DNS-based communication paths (Source: Blackpoint Cyber)
A complete remote access toolkit
Analysis of the example revealed a comprehensive set of remote access features, including command execution, PowerShell and JavaScript execution, screenshot capture, file uploads and downloads, archive management, and SOCKS5 proxy support.
The malware can also establish persistence by creating a Windows Run registry key that allows it to start automatically after a reboot.
“These capabilities gave the operator enough control to interact with the host, move files in and out of the environment, route traffic through the system, and maintain access without relying on a separate loader or narrow follow-on tool,” they added.
Disguised as NVIDIA software
The entry point for the attack chain is an executable file called nvidia-sysruntime.exe, an unsigned 64-bit binary that mimics NVIDIA’s container runtime toolkit.
“Its version information supported the NVIDIA theme with references to NVIDIA Corporation, NVIDIA Container Runtime Monitor, and NVIDIA Container Toolkit, so at first glance the file looks like NVIDIA software.”
Before receiving operator commands, LabubaRAT profiles the vulnerable host by scanning for installed browsers such as Chrome, Firefox, Edge and Brave, while simultaneously searching for endpoint security products such as Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Bitdefender and several others via the Windows Registry uninstall keys.
The malware also collects hostname, CPU and memory details, domain membership, and User Account Control (UAC) status to give operators an overview of the environment before taking further action.
“LabubaRAT is more than a renamed binary with fake NVIDIA metadata. The sample combined runtime configuration, local state, host profiling, multiple communication paths, and operator tasks in a complete remote access tool. Its design allowed the same compiled agent to be pointed at different infrastructures, assigned to different groups, and managed via a panel-assisted workflow without requiring a new build for each deployment,” the researchers concluded.
The framework-like architecture suggests that LabubaRAT was designed to be reused across multiple operations, although Blackpoint did not classify it as a malware-as-a-service offering.
The company has shared indicators of compromise to help defenders identify and detect LabubaRAT activity.
https://www.helpnetsecurity.com/2026/07/15/labubarat-rust-malware-nvidia-disguise/
