![\"LabubaRAT](\"https:\/\/www.newsbeep.com\/il\/wp-content\/uploads\/2026\/07\/LabubaRAT_NVIDIA_malware.webp\" "\\"The")
<\/p>\nLabubaRAT, a previously undocumented Rust-based remote access tool (RAT) masquerading as NVIDIA software that enables post-compromise operations on Windows systems, has been uncovered by Blackpoint Cyber.<\/p>\n
According to researchers, LabubaRAT creates \u201ca reusable foothold for hands-on activity.\u201d Once deployed, it can profile the host, identify installed security tools, receive operator commands, transfer files, capture screenshots, and proxy network traffic through the affected system.<\/p>\n
Blackpoint Cyber named the malware LabubaRAT after discovering a \u201cLabubaPanel\u201d title and a Labubu-themed favicon on its associated command-and-control (C2) infrastructure.<\/p>\n
Configuration built for reuse<\/p>\n
Rather than hardcoding its infrastructure into the binary, LabubaRAT receives its configuration at launch through command-line arguments or matching environment variables.<\/p>\n
Operators can specify the command-and-control server, organization, group tag, and API key at runtime. Those values determine how the malware connects to its infrastructure and how frequently it checks in for new commands. Instead of supplying each parameter individually, operators can also package them into a single Base64-encoded configuration block that the malware decodes during execution.<\/p>\n
\u201cBecause those values were provided at launch, the same compiled binary could be reused with different infrastructure, organizations, or campaign groupings instead of relying on a hardcoded server,\u201d the researchers noted.<\/p>\n
After enrolling with its command-and-control server, the malware stores local state in a SQLite database named nvctr_sys.db and supports communication over HTTPS polling, Microsoft Edge WebView2, and DNS tunneling. Multiple communication paths help maintain connectivity if one channel becomes unavailable.<\/p>\n
<\/p>\n
The RAT supported HTTPS, WebView2, and DNS based communication paths (Source: Blackpoint Cyber)<\/p>\n
A full remote access toolkit<\/p>\n
Analysis of the sample revealed a comprehensive remote access capability set, including command execution, PowerShell and JavaScript execution, screenshot capture, file uploads and downloads, archive handling, and SOCKS5 proxy support. <\/p>\n
The malware can also establish persistence by creating a Windows Run registry key, allowing it to launch automatically after a reboot.<\/p>\n
\u201cThose capabilities gave the operator enough control to interact with the host, move files in and out of the environment, route traffic through the system, and maintain access without relying on a separate loader or narrowly scoped follow-on tool,\u201d they added.<\/p>\n
Disguised as NVIDIA software<\/p>\n
The entry point for the attack chain is an executable named nvidia-sysruntime.exe, an unsigned 64-bit binary that impersonates NVIDIA\u2019s container runtime toolkit.<\/p>\n
\u201cIts version information reinforced the NVIDIA theme with references to NVIDIA Corporation, NVIDIA Container Runtime Monitor, and NVIDIA Container Toolkit, making the file look like NVIDIA software at a glance.\u201d <\/p>\n
Before receiving operator commands, LabubaRAT profiles the compromised host by checking for installed browsers such as Chrome, Firefox, Edge, and Brave, while also scanning for endpoint security products including Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Bitdefender, and several others through Windows registry uninstall keys.<\/p>\n
The malware also collects the hostname, CPU and memory details, domain membership, and User Account Control (UAC) status to provide operators with an overview of the environment before additional actions are taken.<\/p>\n
\u201cLabubaRAT is more than a renamed binary with fake NVIDIA metadata. The sample combined runtime configuration, local state, host profiling, multiple communication paths, and operator tasking into a complete remote access tool. Its design allowed the same compiled agent to be pointed at different infrastructure, assigned to different groups, and managed through a panel-backed workflow without requiring a new build for each deployment,\u201d researchers concluded<\/a>.<\/p>\n The framework-like architecture suggests LabubaRAT was designed for reuse across multiple operations, although Blackpoint stopped short of attributing it to a malware-as-a-service offering.<\/p>\n The company has shared indicators of compromise to help defenders identify and detect LabubaRAT activity.<\/p>\n","protected":false},"excerpt":{"rendered":"LabubaRAT, a previously undocumented Rust-based remote access tool (RAT) masquerading as NVIDIA software that enables post-compromise operations on…\n","protected":false},"author":2,"featured_media":542888,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[246985,21414,85,46,21416,125],"class_list":["post-542887","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-blackpoint-cyber","tag-cybercrime","tag-il","tag-israel","tag-malware","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/542887","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/comments?post=542887"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/542887\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media\/542888"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media?parent=542887"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/categories?post=542887"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/tags?post=542887"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}