LabubaRAT: Rust-Based RAT Masquerades as NVIDIA Container Runtime to Backdoor Windows Hosts

LabubaRAT: Rust-Based RAT Masquerades as NVIDIA Container (TL-2026-1322), also tracked as LabubaRAT, is a high-severity malware campaign, first published 2026-07-14. It has no confirmed attribution, affects Microsoft Windows, maps to 34 MITRE ATT&CK techniques (T1005, T1016, T1021), and is covered by 9 detection rules and 22 indicators of compromise.

Key facts for TL-2026-1322

Threat ID
TL-2026-1322
Also known as
LabubaRAT
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-14
Last reviewed
2026-07-14
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, informationtechnology, cloudaiinfrastructure, generalconsumer
Target regions
Global
Detection rules
9
Indicators of compromise
22

Malware and tooling in LabubaRAT: Rust-Based RAT Masquerades as NVIDIA Container

Malware and tooling: LabubaRAT, LabubaPanel, LabubaRAT (Rust-based RAT)

LabubaRAT is a Rust-based remote access trojan discovered by Blackpoint Cyber researchers Sam Decker and Nevan Beal, deployed via an executable disguised as NVIDIA's container runtime toolkit ("nvidia-sysruntime.exe") to establish a reusable foothold on Windows hosts. The implant accepts runtime C2 configuration via command-line arguments and Base64-encoded strings rather than hardcoded infrastructure, and supports host profiling, command/PowerShell/JavaScript execution, screenshot capture, file operations, and SOCKS5 proxying over HTTPS, WebView2, and DNS tunneling channels.

How LabubaRAT: Rust-Based RAT Masquerades as NVIDIA Container works

LabubaRAT is a newly documented Rust-based remote access trojan reported by Blackpoint Cyber on 2026-07-14. The malware masquerades as legitimate NVIDIA software by using the filename nvidia-sysruntime.exe, impersonating NVIDIA's container runtime toolkit to lower suspicion on Windows endpoints during initial execution and persistence.

Rather than embedding hardcoded C2 infrastructure in the binary, LabubaRAT accepts its operational configuration at runtime via command-line arguments, or alternatively via ZM_-prefixed environment variables, including Base64-encoded configuration strings passed through a --b flag. This design lets operators repoint the implant to different infrastructure per-deployment without recompiling, complicating static signature-based detection and infrastructure-based takedown efforts. Observed deployment configuration decoded from a --b argument included: --org luxespa, --key 8c4e4804f21649e5ddc6a5670f3b3828a43bff304f02f184f9842c2569570f3d, --group rabbit, --server https://pipicka[.]xyz — demonstrating a multi-tenant, group/organization-scoped tasking model consistent with a Malware-as-a-Service (MaaS) framework. Additional supported flags include --org, --key, --group, --server, --device-name, --dns-domain, --dns-resolver, --poll-min-secs, --poll-max-secs, --install, and --uninstall (the latter two toggling autostart persistence).

Observed C2 infrastructure includes the primary domain pipicka[.]xyz (reached over HTTPS) and three associated IP addresses — 191.44.109.130, 87.120.108.18, and 168.222.254.204 — with infrastructure first appearing in early June 2026, aligning with the sample's PE compile timestamp of 2026-06-17 23:16:55 UTC. Runtime configuration is persisted locally in a SQLite database named nvctr_sys.db (plus associated WAL/SHM journal files), implying operators may re-task or reconfigure the implant across multiple sessions. The C2 panel is internally referred to as "LabubaPanel," complete with a Labubu-themed favicon, and the report identifies Malware-as-a-Service (MaaS) indicators — suggesting the tool may be offered to or shared among multiple operators rather than a single dedicated actor. The analyzed sample carries SHA-256 b7443b0ab48d2f5786d1b6f3a580f02621e9ae5a3877ee3a44e01df13d984328 / MD5 d8bf355a198fb5db3ea65cfdfcdfbd19, and its PDB debug path (nvidia_container.pdb) plus an embedded Cargo registry build-username artifact (C:\Users\funt\.cargo\registry\...) indicate the developer's local Rust build environment.

On execution, LabubaRAT performs extensive host reconnaissance: enumerating installed web browsers (Chrome, Firefox, Edge, Brave), fingerprinting installed endpoint security products via registry checks (Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec, Trend Micro, and others), and collecting system details such as hostname, IP address, connection type, installed RAM, CPU model, domain membership, and UAC (User Account Control) configuration state. This profiling lets the operator tailor follow-on tradecraft to the specific defensive stack and privilege posture of the victim before executing further commands.

Operationally, LabubaRAT provides hands-on-keyboard capability through discrete commands: cmd (native shell command execution), powershell (PowerShell execution with timeout handling), javascript (executed via Windows Script Host through wupd_-prefixed temporary script files), screenshot (GDI-based desktop capture returned as Base64), download/upload/delete/mkdir (file and directory operations), archive/unarchive (archive packing and unpacking), and socks5_start/socks5_stop (SOCKS5 proxy tunneling for network pivoting from the compromised host). Communication with its operators is multi-channel, spanning conventional HTTPS polling (using a standard HTTP client with bearer-token authentication, JSON payloads, and spoofed browser-style User-Agent strings mimicking Chrome, Edge, Firefox, Opera, and macOS Chrome), an embedded WebView2 browser component (using JavaScript fetch() calls and window.chrome.webview.postMessage() to blend C2 traffic with legitimate browser-engine network activity and enable JavaScript execution in an actual browser context), and DNS tunneling using Base32-encoded DNS queries with payload chunking and timeout handling as a covert fallback channel usable even in environments that block direct outbound HTTPS to unknown hosts.

Persistence is established at the user level via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry Run key, using the --install flag, with the Base64-encoded --b configuration blob packed into the Run value to obscure the visible command line from casual inspection — consistent with a foothold tool designed for stealth and long-dwell access rather than immediate destructive impact. A named mutex, Local\NVIDIAContainerMonitor_SingleInstance, enforces single-instance execution on a given host.

No CVE is associated with this malware family — it is a novel implant, not tied to an exploited vulnerability, and initial access is presumed to occur via social-engineering / trojanized-download vectors typical of fake or repackaged legitimate software (masquerading), though the precise initial delivery mechanism (e.g., malvertising, phishing, or fake driver-download sites) was not detailed in the initial disclosure. Given NVIDIA GPU/AI tooling's broad footprint on both consumer gaming rigs and enterprise/cloud AI infrastructure, a lure masquerading as NVIDIA container runtime software plausibly targets developers, ML engineers, and IT administrators managing GPU-accelerated container workloads, in addition to general Windows users who might encounter the fake executable via unofficial download sources.

MITRE ATT&CK techniques used in TL-2026-1322

Collection

T1005 Data from Local System; T1113 Screen Capture; T1560 Archive Collected Data

Discovery

T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1482 Domain Trust Discovery; T1518 Software Discovery; T1518.001 Security Software Discovery

Lateral Movement

T1021 Remote Services

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.007 JavaScript; T1204.002 Malicious File; T1569.002 Service Execution

Command and Control

T1071.001 Web Protocols; T1071.004 DNS; T1090.001 Internal Proxy; T1095 Non-Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel

Persistence

T1547.001 Registry Run Keys / Startup Folder

Initial Access

T1566 Phishing

Resource Development

T1583.001 Domains; T1587.001 Malware

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in LabubaRAT: Rust-Based RAT Masquerades as NVIDIA Container

  • Microsoft — Windows
    Vulnerable versions: All supported Windows desktop/workstation versions

Remediation for LabubaRAT: Rust-Based RAT Masquerades as NVIDIA Container

Immediate actions

  • Block network access to and monitor DNS/HTTPS traffic destined for pipicka[.]xyz and IPs 191.44.109.130, 87.120.108.18, 168.222.254.204
  • Search endpoints for the process/file name nvidia-sysruntime.exe outside of legitimate NVIDIA installation directories, and for SHA-256 b7443b0ab48d2f5786d1b6f3a580f02621e9ae5a3877ee3a44e01df13d984328 / MD5 d8bf355a198fb5db3ea65cfdfcdfbd19
  • Hunt for WebView2 host processes spawned by unexpected parent binaries or from user-writable directories
  • Inspect command-line arguments of nvidia-named processes for Base64-encoded strings passed via a --b flag or ZM_-prefixed environment variables
  • Hunt for anomalous DNS query volume/entropy (Base32-encoded subdomains) consistent with DNS tunneling on endpoints
  • Search for the local SQLite artifact nvctr_sys.db (and its WAL/SHM files) and wupd_-prefixed temporary script files dropped for JavaScript execution
  • Audit HKCU\Software\Microsoft\Windows\CurrentVersion\Run for Base64-encoded or otherwise obfuscated autostart values
  • Isolate and forensically image any host where LabubaRAT execution is confirmed and rotate credentials used on that host

Workarounds

  • Restrict execution of unsigned executables named similarly to NVIDIA components via application control policy
  • Block outbound traffic to pipicka[.]xyz and its associated IPs at the perimeter firewall/DNS sinkhole pending full IOC list expansion

Longer-term hardening

  • Deploy application allowlisting to prevent execution of unsigned or improperly-signed binaries impersonating trusted vendor names
  • Enforce code-signing verification for GPU driver / container runtime installers before execution
  • Deploy EDR behavioral detection tuned to Rust-compiled implant behaviors (host/security-product enumeration, WebView2 abuse, SOCKS5 proxy setup, mutex creation)
  • Educate developers/ML engineers on verifying NVIDIA container toolkit downloads only from official NVIDIA sources (catalog.ngc.nvidia.com, github.com/NVIDIA)
  • Implement network egress filtering and DNS monitoring to detect and block tunneling-based C2 channels
  • Maintain and update SQLite artifact / local-config hunting playbooks for RAT triage
  • Monitor for non-browser processes issuing HTTPS requests with spoofed browser User-Agent strings and bearer-token authentication headers

Weaknesses (CWE) in LabubaRAT: Rust-Based RAT Masquerades as NVIDIA Container

CWE-506, CWE-494, CWE-77, CWE-78, CWE-311

Timeline of LabubaRAT: Rust-Based RAT Masquerades as NVIDIA Container

  • LabubaRAT C2 infrastructure (pipicka[.]xyz and associated IPs) begins appearing in early June 2026, per Blackpoint Cyber's infrastructure timeline.
  • Analyzed nvidia-sysruntime.exe sample (SHA-256 b7443b0ab48d2f5786d1b6f3a580f02621e9ae5a3877ee3a44e01df13d984328) shows a PE compile timestamp of 2026-06-17 23:16:55 UTC, aligning with the appearance of C2 infrastructure.
  • Harness HUNT phase flags LabubaRAT for detection-engineering coverage due to novel family status, multi-channel C2, and hands-on-keyboard capability despite absence of CVE/CVSS or confirmed attribution.
  • Researchers document user-level persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run using the --install flag, and identify the single-instance mutex Local\NVIDIAContainerMonitor_SingleInstance.
  • C2 panel identified as "LabubaPanel," featuring a Labubu-themed favicon, with indicators suggesting a Malware-as-a-Service delivery model.
  • Blackpoint Cyber decodes an observed --b configuration blob revealing --org luxespa, --key <64-char token>, --group rabbit, and --server https://pipicka[.]xyz, evidencing a multi-tenant organization/group tasking model.
  • Researchers document LabubaRAT's use of command-line-supplied, Base64-encoded configuration (--b flag) or ZM_-prefixed environment variables in place of hardcoded C2 details, along with local SQLite-based configuration storage (nvctr_sys.db).
  • C2 domain pipicka[.]xyz and associated IPs 191.44.109.130, 87.120.108.18, and 168.222.254.204 identified as infrastructure associated with LabubaRAT operations.
  • The Hacker News publishes coverage of LabubaRAT, detailing its multi-channel C2 (HTTPS, WebView2, DNS tunneling) and host-profiling capabilities.
  • Blackpoint Cyber researchers Sam Decker and Nevan Beal publicly disclose LabubaRAT, a Rust-based RAT masquerading as NVIDIA's container runtime toolkit, in a detailed technical blog post.

Sources cited for LabubaRAT: Rust-Based RAT Masquerades as NVIDIA Container

Threats related to LabubaRAT: Rust-Based RAT Masquerades as NVIDIA Container

Detection coverage for TL-2026-1322

As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1322 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats