# New Rust-Based RAT LabubaRAT Disguises Itself as NVIDIA Software to Hijack Windows Systems


Cybersecurity researchers have uncovered a sophisticated remote access trojan (RAT) that impersonates legitimate NVIDIA software to establish persistent control over Windows machines. The malware, codenamed LabubaRAT, combines advanced evasion techniques with modular architecture, suggesting it may be deployed as part of a malware-as-a-service offering targeting both enterprise and individual users.


Discovered and analyzed by researchers at Blackpoint Cyber, LabubaRAT represents a notable evolution in RAT development, featuring runtime configuration capabilities, multi-channel communication, and automated security product detection that allows attackers to adapt their approach based on each target's defensive posture.


## The Threat


LabubaRAT is a Rust-based remote access trojan designed to provide attackers with complete control over compromised Windows hosts. Unlike traditional RATs that embed command-and-control (C2) server information directly into their code, LabubaRAT accepts its configuration through command-line arguments at runtime, enabling a single compiled binary to be reused across multiple campaigns and infrastructure without recompilation.


According to Blackpoint Cyber researchers Sam Decker and Nevan Beal, "LabubaRAT creates a reusable foothold for hands-on activity. Once deployed, it can profile the host, identify security tools, receive operator commands, move files, capture screenshots, and proxy traffic through the affected system."


The malware gets its name from the "LabubaPanel" command-and-control infrastructure associated with the campaign, further reinforced by a Labubu-themed favicon used in the C2 panel—suggesting either a deliberate branding choice or a clue to the threat actor's identity or origin.


## Attack Vector and Initial Compromise


The attack chain begins with a deceptively named executable: nvidia-sysruntime.exe. This filename mimics NVIDIA's legitimate container runtime toolkit, allowing it to blend into target environments where NVIDIA software may already be installed or where administrators might not question its presence.


Once executed, LabubaRAT does not immediately connect to its command server. Instead, it accepts configuration parameters through command-line arguments, which can be provided in two ways:


1. Individual parameters: The attacker specifies the C2 server address (documented examples use "pipicka[.]xyz"), polling intervals, and other settings as separate arguments

2. Encoded payload: Alternatively, all configuration can be supplied as a single Base64-encoded argument, reducing operational visibility


This flexibility has significant implications for attackers: the same binary can be deployed across different organizations, campaigns, and infrastructure without modification, dramatically reducing the effort required to conduct large-scale operations. The configuration is then stored locally in an SQLite database for persistence and consistent operation.


## Intelligent Host Profiling and Evasion


One of LabubaRAT's most notable capabilities is its automated detection of both security tools and common applications. Upon execution, the malware profiles the host to identify:


Security Products:

  • Microsoft Defender
  • CrowdStrike Falcon
  • SentinelOne
  • Carbon Black
  • Sophos
  • Malwarebytes
  • Bitdefender
  • ESET
  • Kaspersky
  • McAfee
  • Symantec
  • Trend Micro

    • Web Browsers:

  • Google Chrome
  • Mozilla Firefox
  • Microsoft Edge
  • Brave

    • System Information:

  • Hostname
  • RAM capacity
  • CPU model
  • Windows User Account Control (UAC) status

    • This reconnaissance phase allows the attacker to make informed decisions about which capabilities to deploy and how to adapt their approach based on the target environment. If high-end endpoint detection and response (EDR) solutions are detected, the operator may adjust tactics; if the host runs only Windows Defender, more aggressive behavior may be acceptable.


    ## Comprehensive Capabilities


    LabubaRAT supports a broad arsenal of capabilities that grant operators near-complete control over compromised systems:


    | Capability | Purpose |

    |---|---|

    | Command Execution | Run arbitrary Windows commands |

    | PowerShell Execution | Execute PowerShell scripts for deep system access |

    | JavaScript Execution | Run malicious scripts in a controlled environment |

    | Screenshot Capture | Monitor user activity and screen content |

    | File Upload/Download | Exfiltrate data or inject additional payloads |

    | Archive Handling | Create and extract compressed files for bulk operations |

    | SOCKS5 Proxy | Route traffic through the compromised host for lateral movement or obfuscation |

    | User-Level Autostart | Maintain persistence across reboots |


    As the researchers noted, "Those capabilities gave the operator enough control to interact with the host, move files in and out of the environment, route traffic through the system, and maintain access without relying on a separate loader or narrowly scoped follow-on tool."


    ## Multi-Channel Communication for Resilience


    LabubaRAT does not rely on a single communication channel to the C2 server. Instead, it supports multiple communication methods:


  • HTTPS: Standard encrypted HTTP traffic, easily blended with legitimate network activity
  • WebView2: Leverages Microsoft's WebView2 component, potentially using browser-like traffic patterns
  • DNS Tunneling: Establishes communication through DNS queries and responses, allowing data exfiltration even in highly restricted network environments

    • This redundancy is critical to the malware's effectiveness. If security teams block or detect HTTPS communication to the C2 server, the attacker can seamlessly switch to DNS tunneling or another available channel without losing access to the compromised system.


    ## Signs of Malware-as-a-Service Distribution


    Several technical indicators suggest that LabubaRAT may be offered as a malware-as-a-service (MaaS) platform rather than deployed by a single threat actor:


  • The framework-like structure with runtime configuration capabilities suggests it's designed for multiple operators
  • The reusable binary architecture reduces operational friction and lowers the barrier to entry for less sophisticated threat actors
  • The modular capability set allows operators to select and deploy only the features they need for specific campaigns
  • The "LabubaPanel" branding indicates a dedicated C2 infrastructure designed to support multiple simultaneous operations

    • MaaS offerings have become increasingly common in the cybercriminal ecosystem, allowing less technically sophisticated actors to launch sophisticated attacks by renting access to established malware platforms.


    ## Implications for Organizations


    The discovery of LabubaRAT highlights several concerning trends in modern malware development:


    Evasion Over Detection: Modern RATs prioritize the ability to adapt to defensive environments rather than using brute-force persistence mechanisms. LabubaRAT's security tool detection allows attackers to modify behavior based on what they find, creating a moving target for defenders.


    Modularity and Reusability: The shift toward runtime configuration and framework-based architectures means that threat actors can rapidly customize and deploy malware across diverse targets without maintaining separate code branches.


    Supply Chain Risk: The use of legitimate software names (NVIDIA in this case) to disguise malicious payloads exploits the trust placed in well-known vendors. Organizations may inadvertently allow the execution of malicious code if it masquerades as legitimate software.


    ## HackWire Analysis


    LabubaRAT represents a significant step forward in RAT sophistication, but the real concern is not the malware itself—it's the operational model behind it. The framework-like architecture, runtime configuration, and multi-channel communication design suggest that this isn't a one-off threat actor's tool; it's a professionally maintained platform being offered to a broader ecosystem of attackers.


    What makes this particularly dangerous is the democratization of sophistication. Five years ago, building a RAT with EDR detection, multiple C2 channels, and modular capabilities required expertise and resources. Today, that functionality can be rented. This lowers the barrier to entry for less sophisticated threat actors, meaning organizations can no longer assume that unsophisticated targeting indicates unsophisticated attackers.


    The security product detection capability is especially concerning because it reveals attackers' strategic thinking: they're not just trying to avoid detection—they're profiling your defenses and adjusting their behavior accordingly. An organization with CrowdStrike deployed will face different attack tactics than one with only Windows Defender. This suggests that defenders need to move beyond assuming all attacks will behave identically; instead, they should assume attackers will adapt to their specific defensive posture.


    The use of NVIDIA branding is likely not coincidental. As organizations accelerate AI deployments and GPU utilization, NVIDIA software is becoming more common in enterprise environments. Masquerading as legitimate NVIDIA tools creates plausible deniability and reduces friction when the malicious executable is encountered during security reviews or policy enforcement.


    For incident responders and threat hunters, the runtime configuration mechanism is a double-edged sword: it makes the malware harder to detect via static analysis, but it also means that command-line argument forensics and process monitoring become critical detection vectors. Monitoring for instances of nvidia-sysruntime.exe with unusual command-line arguments should be a priority for incident response teams.


    — HackWire Editorial


    ## Recommendations for Defenders


    Organizations should take the following steps to protect against LabubaRAT and similar threats:


    ### Immediate Actions

  • Monitor process execution: Implement detection rules for suspicious use of nvidia-sysruntime.exe, particularly with command-line arguments containing Base64-encoded strings or suspicious server addresses
  • Review EDR visibility: Ensure your endpoint detection and response solution is actively monitoring PowerShell, JavaScript execution engines, and process creation events
  • DNS monitoring: Deploy DNS filtering to detect unusual DNS query patterns that might indicate DNS tunneling communication

    • ### Medium-Term Measures

  • Software whitelisting: Consider application whitelisting to prevent execution of unsigned or untrusted executables, even if they carry legitimate software names
  • Network segmentation: Implement network segmentation to limit lateral movement capabilities of compromised hosts
  • Credential hygiene: Assume breach and implement zero-trust principles, particularly for sensitive systems

    • ### Long-Term Strategy

  • Behavior-based detection: Invest in behavioral analysis tools that can detect the reconnaissance and profiling phase of malware execution, before operator tasking begins
  • Security awareness: Train employees to be skeptical of software execution, even from apparently legitimate sources
  • Threat intelligence sharing: Participate in threat intelligence communities to identify new variants and distribution methods

    • ## Related Coverage


  • Read more in our [Tools](https://www.hackwire.news/category/tools) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)