LabubaRAT: New Rust-Based Trojan Impersonates NVIDIA Software on Windows

Cybersecurity researchers at Blackpoint Cyber have uncovered a previously undocumented Rust-based remote access trojan dubbed LabubaRAT that masquerades as legitimate NVIDIA software to evade detection on Windows hosts. Identified by researchers Sam Decker and Nevan Beal, the implant creates a persistent foothold for hands-on attacker activity, enabling host profiling, security tool identification, command execution, file transfers, screenshot capture, and traffic proxying through compromised systems. The malware is delivered via an executable named "nvidia-sysruntime.exe," which impersonates NVIDIA's container runtime toolkit to blend into target environments.

LabubaRAT's distinguishing feature is its runtime configurability — rather than hard-coding command-and-control (C2) infrastructure, the binary accepts parameters via command-line arguments, including server details for the C2 endpoint "pipicka[.]xyz" and the polling interval for implant communication. Attackers can also supply these values as a single Base64-encoded argument, allowing the same compiled binary to be reused across different campaigns, organizations, and infrastructure. Researchers noted indications that LabubaRAT is being offered under a malware-as-a-service (MaaS) model. Security teams investigating suspicious NVIDIA-named binaries can use a WHOIS lookup to check related infrastructure and a port scanner to identify any unexpected outbound listeners on compromised hosts.

Once launched, the implant stores its configuration in a local SQLite database and conducts discovery operations to inventory installed web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge, Brave) and security products (Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec, and Trend Micro). It also collects hostname, RAM size, CPU model, and the Windows User Account Control (UAC) state, using this intelligence to tailor subsequent actions based on the defensive tools present. The RAT supports multiple communication channels — HTTPS, WebView2, and DNS tunneling — ensuring redundant C2 connectivity even if one pathway is detected and blocked. Its DNS tunneling capability in particular makes traffic analysis critical; defenders can run a DNS leak test to verify whether queries are being routed through unauthorized resolvers.

LabubaRAT provides operators with an extensive command set, including command execution, PowerShell and JavaScript execution, screenshot capture, file upload and download, archive handling, and SOCKS5 proxy support. According to Blackpoint Cyber, these capabilities grant sufficient control to interact with the host, move files in and out, route traffic through the system, and maintain access without relying on a separate loader or narrowly scoped follow-on tool. The malware's name derives from the "LabubaPanel" title associated with its C2 infrastructure and a Labubu-themed favicon — a branding detail that may help defenders correlate related samples and infrastructure across future campaigns.