Cybersecurity researchers have identified a previously undocumented Rust-based remote access Trojan (RAT) codenamed LabubaRAT masquerading as NVIDIA software to blend into target environments.
“LabubaRAT creates a reusable foothold for practical activities,” Blackpoint cyber researchers Sam Decker and Nevan Beal said in an analysis published today. “Once deployed, it can profile the host, identify security tools, receive operator commands, move files, capture screenshots, and route traffic through the affected system.”
The implant also supports multiple communication methods, including HTTPS, WebView2, and DNS tunneling, allowing attackers to maintain access to compromised hosts even if a path is detected and blocked. There are some indications that LabubuRAT is being offered under a Malware-as-a-Service (MaaS) model.
The starting point of the attack chain is an executable file called “nvidia-sysruntime.exe,” which masquerades as NVIDIA’s container runtime toolkit. Instead of hard-coding its command-and-control (C2) information, the example accepts run-time configuration via command-line arguments.
This allows the campaign operator to define various parameters that are crucial for establishing communication with the remote server, including the server details (“pipicka[.]xyz”) and the polling interval used by the implant. Alternatively, the attacker can provide these individual values in the form of a single Base64 encoded argument.
“Because these values were provided at launch, the same compiled binary could be reused with different infrastructures, organizations, or campaign groupings rather than relying on a hard-coded server,” the researchers noted.
The configuration is then stored in a local SQLite database and subsequently performs discovery operations to inventory the list of web browsers and security products installed on the host, specifically checking for the presence of Google Chrome, Mozilla Firefox, Microsoft Edge, Brave, Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec and Trend Micro.
Additionally, the hostname, RAM size, CPU model, and Windows User Account Control (UAC) status are collected to prepare the environment for the next stage, as some RAT functions may be dictated by the security tools present on the system.
Once launched, LabubaRAT supports a variety of features such as: B. Command execution, PowerShell execution, JavaScript execution, screenshot capture, file upload and download, archive management and SOCKS5 proxy support.
“These capabilities gave the operator enough control to interact with the host, move files in and out of the environment, route traffic through the system, and maintain access without relying on a separate loader or narrow follow-up tool,” Blackpoint Cyber said.
The malware is a play on the title “LabubaPanel,” which is associated with C2 infrastructure and a Labubu-style favicon.
“The example combined runtime configuration, local state, host profiling, multiple communication paths and operator tasks into a complete remote access tool,” Blackpoint Cyber said. “The malware provided an operator with a convenient way to register hosts, understand the environment around each agent, execute commands, move files, capture screenshots, proxy traffic, and maintain user-level autostart.”
“The LabubaPanel branding provided the clearest external naming clue, but the more important result is the framework-like structure behind it: a Rust-based RAT designed to configure, register, and operate across multiple deployments.”
https://thehackernews.com/2026/07/labubarat-masquerades-as-nvidia.html
