# LabubaRAT: Rust-Based RAT Masquerades as NVIDIA Container Runtime to Backdoor Windows Hosts

> LabubaRAT is a Rust-based remote access trojan discovered by Blackpoint Cyber researchers Sam Decker and Nevan Beal, deployed via an executable disguised as NVIDIA's container runtime toolkit ("nvidia-sysruntime.exe") to establish a reusable foothold on Windows hosts. The implant accepts runtime C2 configuration via command-line arguments and Base64-encoded strings rather than hardcoded infrastructure, and supports host profiling, command/PowerShell/JavaScript execution, screenshot capture, file operations, and SOCKS5 proxying over HTTPS, WebView2, and DNS tunneling channels.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1322
- **ID:** TL-2026-1322
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

LabubaRAT is a newly documented Rust-based remote access trojan reported by Blackpoint Cyber on 2026-07-14. The malware masquerades as legitimate NVIDIA software by using the filename nvidia-sysruntime.exe, impersonating NVIDIA's container runtime toolkit to lower suspicion on Windows endpoints during initial execution and persistence.

Rather than embedding hardcoded C2 infrastructure in the binary, LabubaRAT accepts its operational configuration at runtime via command-line arguments, or alternatively via ZM_-prefixed environment variables, including Base64-encoded configuration strings passed through a --b flag. This design lets operators repoint the implant to different infrastructure per-deployment without recompiling, complicating static signature-based detection and infrastructure-based takedown efforts. Observed deployment configuration decoded from a --b argument included: --org luxespa, --key 8c4e4804f21649e5ddc6a5670f3b3828a43bff304f02f184f9842c2569570f3d, --group rabbit, --server https://pipicka[.]xyz — demonstrating a multi-tenant, group/organization-scoped tasking model consistent with a Malware-as-a-Service (MaaS) framework. Additional supported flags include --org, --key, --group, --server, --device-name, --dns-domain, --dns-resolver, --poll-min-secs, --poll-max-secs, --install, and --uninstall (the latter two toggling autostart persistence).

Observed C2 infrastructure includes the primary domain pipicka[.]xyz (reached over HTTPS) and three associated IP addresses — 191.44.109.130, 87.120.108.18, and 168.222.254.204 — with infrastructure first appearing in early June 2026, aligning with the sample's PE compile timestamp of 2026-06-17 23:16:55 UTC. Runtime configuration is persisted locally in a SQLite database named nvctr_sys.db (plus associated WAL/SHM journal files), implying operators may re-task or reconfigure the implant across multiple sessions. The C2 panel is internally referred to as "LabubaPanel," complete with a Labubu-themed favicon, and the report identifies Malware-as-a-Service (MaaS) indicators — suggesting the tool may be offered to or shared among multiple operators rather than a single dedicated actor. The analyzed sample carries SHA-256 b7443b0ab48d2f5786d1b6f3a580f02621e9ae5a3877ee3a44e01df13d984328 / MD5 d8bf355a198fb5db3ea65cfdfcdfbd19, and its PDB debug path (nvidia_container.pdb) plus an embedded Cargo registry build-username artifact (C:\Users\funt\.cargo\registry\...) indicate the developer's local Rust build environment.

On execution, LabubaRAT performs extensive host reconnaissance: enumerating installed web browsers (Chrome, Firefox, Edge, Brave), fingerprinting installed endpoint security products via registry checks (Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec, Trend Micro, and others), and collecting system details such as hostname, IP address, connection type, installed RAM, CPU model, domain membership, and UAC (User Account Control) configuration state. This profiling lets the operator tailor follow-on tradecraft to the specific defensive stack and privilege posture of the victim before executing further commands.

Operationally, LabubaRAT provides hands-on-keyboard capability through discrete commands: cmd (native shell command execution), powershell (PowerShell execution with timeout handling), javascript (executed via Windows Script Host through wupd_-prefixed temporary script files), screenshot (GDI-based desktop capture returned as Base64), download/upload/delete/mkdir (file and directory operations), archive/unarchive (archive packing and unpacking), and socks5_start/socks5_stop (SOCKS5 proxy tunneling for network pivoting from the compromised host). Communication with its operators is multi-channel, spanning conventional HTTPS polling (using a standard HTTP client with bearer-token authentication, JSON payloads, and spoofed browser-style User-Agent strings mimicking Chrome, Edge, Firefox, Opera, and macOS Chrome), an embedded WebView2 browser component (using JavaScript fetch() calls and window.chrome.webview.postMessage() to blend C2 traffic with legitimate browser-engine network activity and enable JavaScript execution in an actual browser context), and DNS tunneling using Base32-encoded DNS queries with payload chunking and timeout handling as a covert fallback channel usable even in environments that block direct outbound HTTPS to unknown hosts.

Persistence is established at the user level via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry Run key, using the --install flag, with the Base64-encoded --b configuration blob packed into the Run value to obscure the visible command line from casual inspection — consistent with a foothold tool designed for stealth and long-dwell access rather than immediate destructive impact. A named mutex, Local\NVIDIAContainerMonitor_SingleInstance, enforces single-instance execution on a given host.

No CVE is associated with this malware family — it is a novel implant, not tied to an exploited vulnerability, and initial access is presumed to occur via social-engineering / trojanized-download vectors typical of fake or repackaged legitimate software (masquerading), though the precise initial delivery mechanism (e.g., malvertising, phishing, or fake driver-download sites) was not detailed in the initial disclosure. Given NVIDIA GPU/AI tooling's broad footprint on both consumer gaming rigs and enterprise/cloud AI infrastructure, a lure masquerading as NVIDIA container runtime software plausibly targets developers, ML engineers, and IT administrators managing GPU-accelerated container workloads, in addition to general Windows users who might encounter the fake executable via unofficial download sources.

## MITRE ATT&CK

- T1566 Phishing
- T1059.001 PowerShell
- T1059.007 JavaScript
- T1059.003 Windows Command Shell
- T1204.002 Malicious File
- T1569.002 Service Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1070.004 File Deletion
- T1685 Disable or Modify Tools
- T1518.001 Security Software Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1518 Software Discovery
- T1069 Permission Groups Discovery
- T1016 System Network Configuration Discovery
- T1482 Domain Trust Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071.001 Web Protocols
- T1071.004 DNS
- T1090.001 Internal Proxy
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1102 Web Service
- T1095 Non-Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1021 Remote Services
- T1583.001 Domains
- T1587.001 Malware

## Sources

- [LabubaRAT Masquerades as NVIDIA Software](https://thehackernews.com/2026/07/labubarat-masquerades-as-nvidia.html)
- [LabubaRAT: A Rust-Based Remote Access Tool Masquerading as NVIDIA Software](https://blackpointcyber.com/blog/labubarat-a-rust-based-remote-access-tool-masquerading-as-nvidia-software/)
- [Blackpoint Cyber - Managed Detection and Response Platform](https://blackpointcyber.com/)
- [NVIDIA Container Toolkit (legitimate project impersonated by LabubaRAT)](https://github.com/NVIDIA/nvidia-container-toolkit)
- [NVIDIA Container Toolkit - NGC Catalog (official distribution source)](https://catalog.ngc.nvidia.com/orgs/nvidia/teams/k8s/containers/container-toolkit)
- [BeaconBeagle C2 configuration search: pipicka.xyz (no matches at time of research)](https://beaconbeagle.com/api/v1/configs/search?domain=pipicka.xyz)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1322