LabubaRAT Poses as NVIDIA Software to Hand Operators Full Control of Windows Hosts
Do Son 
At a Glance
| Malware family | LabubaRAT (previously undocumented) |
| Threat actor | Unattributed; no group named |
| Targets | Windows hosts; no victim count published |
| Delivery vector | Not documented in the report |
| Key capabilities | Shell, PowerShell and JavaScript execution, screenshots, file transfer, SOCKS5 proxy |
| Source | Blackpoint Cyber Adversary Pursuit Group (APG) |
TL;DR
Blackpoint Cyber’s Adversary Pursuit Group has documented LabubaRAT, a new implant written in Rust. The binary poses as an NVIDIA container runtime component, but it profiles hosts, runs commands, moves files, and proxies traffic. Researchers derived the name from a panel title and a Labubu-themed favicon on the control server.
Delivery
APG has not published how the sample reaches victims. The report analyzes the implant itself rather than an intrusion, so no delivery vector, victim count, or campaign scope appears in it. What the researchers do describe is the disguise. The file carries NVIDIA Corporation metadata and names itself after container runtime tooling.
That masquerade is thin under inspection. The executable is unsigned, and its Rust build paths expose a developer username. Its compile timestamp lands in mid-June 2026, which matches when related servers first appeared. APG calls LabubaRAT “a Rust based remote access tool masquerading as NVIDIA software.”
Infection Chain
LabubaRAT carries no hardcoded server address. Instead, an operator supplies the organization, group tag, server URL, and API key at launch. Each value works as a command-line switch or as an environment variable under a shared prefix. A separate option packs all of it into one encoded block, which keeps the visible autostart command short.
Once running, the implant enforces a single instance through a mutex named after NVIDIA’s container monitor. It then stores enrollment data and events in a local SQLite database, again using an NVIDIA-style filename. Persistence is optional and stays at user level through the current-user Run key.
Host Profiling Before Tasking
Registration sends the operator a picture of the machine. The agent collects hostname, CPU model, RAM, IP address, domain, and UAC state. It also inventories browsers, covering Chrome, Firefox, Edge, and Brave.
Security tooling matters most to the operator. The implant reads uninstall registry paths and Defender settings, then matches product names against a long list. That list includes Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Bitdefender, ESET, Kaspersky, and others. Consequently, an operator knows which controls guard a host before issuing any tasking.
Command and Control and Data Movement
Three transports give operators options. Standard HTTPS polling handles registration and tasking, with bearer authentication and rotating browser-style User-Agent strings. A second path runs through an embedded Microsoft Edge WebView2 context, so traffic resembles ordinary browser activity. A third path tunnels tasking data through encoded DNS queries, complete with chunking and timeout handling.
Tasking itself is straightforward. Commands cover shell and PowerShell execution, plus a JavaScript route that runs through Windows Script Host. That second scripting path matters where PowerShell logging is stronger than Script Host coverage. Screenshots use common Windows graphics APIs and return as encoded image data.
File handling extends to download, upload, delete, directory creation, and archive packing. Bundling files before transfer makes exfiltration tidier than one-by-one uploads. Separately, SOCKS5 relay commands turn the compromised host into a traffic proxy back to operator infrastructure.
Signs of a Service, Not a One-Off
The organization and group model points somewhere larger. Sample group names in the help text suggest a backend built to sort agents across tenants or campaigns. APG pivoted from the control panel’s structure and found three more servers on German providers sharing the same layout. Blackpoint therefore suggests LabubaRAT may operate as a malware-as-a-service platform, though it stops short of confirming that.
Defense and Detection Guidance
Signature hunting will struggle here, since the same binary points anywhere its operator chooses. Behavior offers better ground. Look for unsigned executables claiming NVIDIA identity, especially outside legitimate NVIDIA install paths. Mutex and SQLite artifacts using container-monitor naming are useful pivots too.
Watch for Windows Script Host running temporary scripts, since defenders often instrument PowerShell far more closely. Monitor outbound DNS for high query volume against a single domain, which betrays tunneling. Finally, audit current-user Run entries for encoded arguments, and treat unexpected SOCKS5 relays as an incident.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
