LabubaRAT: Rust-Based RAT Masquerades as NVIDIA Container Runtime to Backdoor Windows Hosts — Threadlinqs Intelligence
As of 2026-07-14, LabubaRAT: Rust-Based RAT Masquerades as NVIDIA Container Runtime to Backdoor Windows Hosts is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-1322 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
LabubaRAT is a Rust-based remote access trojan discovered by Blackpoint Cyber researchers Sam Decker and Nevan Beal, deployed via an executable disguised as NVIDIA's container runtime toolkit
LabubaRAT is a newly documented Rust-based remote access trojan reported by Blackpoint Cyber on 2026-07-14. The malware masquerades as legitimate NVIDIA software by using the filename nvidia-sysruntime.exe, impersonating NVIDIA's container runtime toolkit to lower suspicion on Windows endpoints during initial execution and persistence.
Rather than embedding hardcoded C2 infrastructure in the binary, LabubaRAT accepts its operational configuration at runtime via command-line arguments, or alternatively via ZM_-prefixed environment variables, including Base64-encoded configuration strings passed through a --b flag. This design lets operators repoint the implant to different infrastructure per-deployment without recompiling, complicating static signature-based detection and infrastructure-based takedown efforts. Observed deployment configuration decoded from a --b argument included: --org luxespa, --key 8c4e4804f21649e5ddc6a5670f3b3828a43bff304f02f184f9842c2569570f3d, --group rabbit, --server https://pipicka[.]xyz — demonstrating a multi-tenant, group/organization-scoped tasking model consistent with a Malware-as-a-Service (MaaS) framework. Additional supported flags include --org, --key, --group, --server, --device-name, --dns-domain, --dns-resolver, --poll-min-secs, --poll-max-secs, --install, and --uninstall (the latter two toggling autostart persistence).
Observed C2 infrastructure includes the primary domain pipicka[.]xyz (reached over HTTPS) and three associated IP addresses — 191.44.109.130, 87.120.108.18, and 168.222.254.204 — with infrastructure first appearing in early June 2026, aligning with the sample's PE compile timestamp of 2026-06-17 23:16:55 UTC. Runtime configuration is persisted locally in a SQLite database named nvctr_sys.db (plus associated WAL/SHM journal files), implying operators may re-task or reconfigure the implant across multiple sessions. The C2 panel is internally referred to as "LabubaPanel," complete with a Labubu-themed favicon, and the report identifies Malware-as-a-Service (MaaS) indicators — suggesting the tool may be offered to or shared among multiple operators rather than a single dedicated actor. The analyzed sample carries SHA-256 b7443b0ab48d2f5786d1b6f3a580f02621e9ae5a3877ee3a44e01df13d984328 / MD5 d8bf355a198fb5db3ea65cfdfcdfbd19, and its PDB debug path (nvidia_container.pdb) plus an embedded Cargo registry build-username artifact (C:\Users\funt\.cargo\registry\...) indicate the developer's local Rust build environment.
On execution, LabubaRAT performs extensive host reconnaissance: enumerating installed web browsers (Chrome, Firefox, Edge, Brave), fingerprinting installed endpoint security products via registry checks (Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec, Trend Micro, and others), and collecting system details such as hostname, IP address, connection type, installed RAM, CPU model, domain membership, and UAC (User Account Control) configuration state. This profiling lets the operator tailor follow-on tradecraft to the specific defensive stack and privilege posture of the victim before executing further commands.
Operationally, LabubaRAT provides hands-on-keyboard capability through discrete commands: cmd (native shell command execution), powershell (PowerShell execution with timeout handling), javascript (executed via Windows Script Host through wupd_-prefixed temporary script files), screenshot (GDI-based desktop capture returned as Base64), download/upload/delete/mkdir (file and directory operations), archive/unarchive (archive packing and unpacking), and socks5_start/socks5_stop (SOCKS5 proxy tunneling for network pivoting from the compromised host). Communication with its operators is multi-channel, spanning conventional HTTPS polling (using a standard HTTP client with bearer-token authentication, JSON payloads, and spoofed browser-style User-Agent strings mimicking Chrome, Edge, Firef
Weaknesses (CWE)
CWE-506, CWE-494, CWE-77, CWE-78, CWE-311
Target sectors: technology, informationtechnology, cloudaiinfrastructure, generalconsumer
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1059.001, T1059.007, T1059.003, T1204.002, T1569.002, T1547.001, T1036.005, T1027, T1140