LabubaRAT: Rust-Based Windows Implant Masquerading as NVIDIA Container Runtime

LabubaRAT: Rust-Based Windows Implant Masquerading as NVIDIA (TL-2026-1367), also tracked as LabubaRAT, is a high-severity malware campaign, first published 2026-07-15. It has no confirmed attribution, affects Microsoft Windows (64-bit), maps to 27 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-1367

Threat ID
TL-2026-1367
Also known as
LabubaRAT, nvidia-sysruntime.exe implant
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-15
Last reviewed
2026-07-15
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
all sectors opportunistic maas commodity tooling
Target regions
Global
Detection rules
9
Indicators of compromise
16

Malware and tooling in LabubaRAT: Rust-Based Windows Implant Masquerading as NVIDIA

Malware and tooling: LabubaRAT

Blackpoint Cyber's Adversary Pursuit Group uncovered LabubaRAT, a previously undocumented Rust-based remote access trojan distributed as nvidia-sysruntime.exe that impersonates NVIDIA's Container Runtime Monitor. The implant offers multi-channel C2 (HTTPS polling, WebView2-mimicking traffic, Base32 DNS tunneling), full hands-on-keyboard control, and shows signs of a malware-as-a-service (MaaS) distribution model.

How LabubaRAT: Rust-Based Windows Implant Masquerading as NVIDIA works

LabubaRAT is a Rust-based remote access trojan (RAT) identified by Blackpoint Cyber researchers Sam Decker and Nevan Beal of the Adversary Pursuit Group (APG), publicly detailed on July 14, 2026. The implant is distributed as an unsigned 64-bit Windows executable named nvidia-sysruntime.exe, carrying spoofed PE version metadata referencing NVIDIA Corporation and the NVIDIA Container Toolkit to blend into legitimate GPU-accelerated / containerized environments and evade cursory analyst triage.

Rather than hardcoding operator infrastructure, the binary is configured at runtime via command-line arguments or ZM_-prefixed environment variables (--org/ZM_ORG for the target enterprise workspace, --key/ZM_KEY for C2 API authorization, --server/ZM_SERVER for the C2 destination domain, and --group/ZM_GROUP for campaign/customer tracking, with observed values "rabbit", "sauna", and "vip-chair"). Parameters can also be bundled together and passed Base64-encoded via a single -b flag. This design lets one compiled binary be reused across unrelated campaigns and targets without recompilation, and is a strong indicator LabubaRAT is offered as a malware-as-a-service (MaaS) framework to multiple distinct operators/customers rather than a single actor's bespoke tool.

Once launched, the implant establishes persistence via an HKCU Run registry key (user-level, not requiring elevation) and is self-installable/removable through --install and --uninstall command-line switches. A named mutex, Local\\NVIDIAContainerMonitor_SingleInstance, enforces single-instance execution and doubles as a high-fidelity host artifact for defenders. Enrollment state and runtime configuration are cached locally in a SQLite database, nvctr_sys.db.

LabubaRAT profiles the host extensively before or during operator tasking: hostname, RAM size, CPU model, Windows UAC state, installed browsers (Chrome, Firefox, Edge, Brave), and installed security products (Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec, Trend Micro), giving operators an immediate picture of detection/response risk on the compromised host.

For command-and-control, the implant supports three redundant channels built on Rust's reqwest/tokio async HTTP stack: (1) standard HTTPS polling to the configured C2 domain with bearer-token authorization; (2) a WebView2-based channel that mimics legitimate embedded-browser traffic using JavaScript execution inside the WebView2 runtime, blending with normal application telemetry; and (3) DNS tunneling using Base32-encoded payload chunking across queries, providing a covert fallback channel that survives HTTP(S) egress filtering. Losing any one channel to detection does not deny the operator access to the host.

Observed capabilities once an operator is interactively tasking the implant include arbitrary shell and PowerShell command execution, JavaScript execution via the Windows Script Host / WebView2 engine, screenshot capture through GDI APIs, file upload and download, archive (zip) handling for staging/exfiltration, and SOCKS5 proxy relaying to pivot further into the compromised network using the victim host as an egress point.

Infrastructure observed by Blackpoint APG centers on the C2 domain pipicka[.]xyz, fronting an operator panel that Blackpoint dubbed "LabubaPanel" (based on its page title and a Labubu-themed favicon, which also inspired the malware's public name). A decoded sample deployment configuration referenced organization "luxespa", campaign group "rabbit", and C2 server pipicka[.]xyz. Blackpoint additionally identified three further C2 IP addresses hosted on German infrastructure, all first observed active in early June 2026 -- consistent with the sample's June 17, 2026 PE compile timestamp and suggesting a coordinated infrastructure rollout timed to the binary's build. Rust build-path artifacts embedded in the binary reference a developer/build user "funt".

No CVE is associated with this threat; it is a malware/implant campaign rather than a vulnerability, delivered most likely via social-engineering / trojanized-software lures given the NVIDIA-themed disguise (consistent with fake GPU driver, AI/ML tooling, or gaming-adjacent lures, though the initial-access vector was not directly confirmed in public reporting at time of writing). Given the MaaS indicators, this implant should be treated as a reusable commodity foothold tool likely to recur across unrelated intrusions and threat actors rather than a single campaign's exclusive malware.

MITRE ATT&CK techniques used in TL-2026-1367

Collection

T1005 Data from Local System; T1113 Screen Capture; T1560 Archive Collected Data

Discovery

T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1082 System Information Discovery; T1518 Software Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1059.001 PowerShell; T1059.007 JavaScript; T1204 User Execution

Command and Control

T1071.001 Web Protocols; T1071.004 DNS; T1090.004 Domain Fronting; T1102 Web Service; T1132.002 Non-Standard Encoding; T1573 Encrypted Channel

discovery

T1518.001 Security Software Discovery

Persistence

T1547.001 Registry Run Keys / Startup Folder

Initial Access

T1566 Phishing

Resource Development

T1583.001 Domains; T1583.004 Server; T1587.001 Malware

Affected products and versions in LabubaRAT: Rust-Based Windows Implant Masquerading as NVIDIA

  • Microsoft — Windows (64-bit)
    Vulnerable versions: all supported 64-bit Windows versions running the unsigned binary

Remediation for LabubaRAT: Rust-Based Windows Implant Masquerading as NVIDIA

Immediate actions

  • Block DNS resolution and egress to pipicka[.]xyz at the perimeter and DNS resolver layer
  • Hunt for the mutex Local\\NVIDIAContainerMonitor_SingleInstance across endpoint fleets via EDR
  • Hunt for the file nvctr_sys.db and any process named nvidia-sysruntime.exe not signed by NVIDIA Corporation
  • Search HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run for entries launching nvidia-sysruntime.exe or referencing Base64-encoded -b command-line arguments
  • Inspect outbound DNS logs for high-entropy, Base32-patterned subdomain queries indicative of DNS tunneling
  • Inspect proxy/TLS logs for WebView2 process (msedgewebview2.exe) or nvidia-sysruntime.exe originating unexpected outbound HTTPS sessions with bearer-auth headers

Workarounds

  • Restrict WebView2 runtime installation/execution on endpoints where it is not required by an approved application
  • Enforce network-layer DNS tunneling detection/blocking (e.g., DNS security service) to neutralize the fallback C2 channel even if HTTPS/WebView2 channels are blocked

Longer-term hardening

  • Deploy application allowlisting / code-signing enforcement so unsigned binaries claiming NVIDIA identity cannot execute, since the sample is unsigned despite spoofed vendor metadata
  • Deploy EDR behavioral detection for user-level HKCU Run-key persistence combined with SOCKS5 proxy or DNS-tunneling network behavior
  • Monitor for reuse of this MaaS builder against other spoofed vendor identities (AMD, Intel, other GPU/AI tooling) given the configurable --org/--group model
  • Establish threat-hunting playbooks for ZM_-prefixed environment variables as a LabubaRAT-family artifact independent of binary hash

Timeline of LabubaRAT: Rust-Based Windows Implant Masquerading as NVIDIA

  • LabubaRAT C2 infrastructure (pipicka[.]xyz and three additional German-hosted IPs) becomes active in early June 2026, per Blackpoint Cyber APG telemetry.
  • The analyzed nvidia-sysruntime.exe sample is compiled, per its PE timestamp, aligning with the coordinated early-June infrastructure rollout and indicating a build-then-deploy operational cadence of roughly two weeks.
  • A mirror/discussion thread of the Blackpoint Cyber findings is posted to the ksec.co.uk community forum, extending community awareness of the IOC set.
  • Cryptika Cybersecurity publishes an independent writeup on LabubaRAT impersonating NVIDIA software to hijack Windows systems, republishing the core IOC set (pipicka[.]xyz, nvidia-sysruntime.exe, mutex).
  • SC World publishes a brief on the newly named Rust-based LabubaRAT impersonating NVIDIA software, corroborating the Blackpoint APG attribution.
  • The Hacker News publishes "LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts," summarizing the Blackpoint Cyber findings for a broader audience and confirming the MaaS distribution model assessment.
  • Blackpoint Cyber researchers Sam Decker and Nevan Beal (Adversary Pursuit Group) publish the original technical analysis of LabubaRAT, including the decoded "luxespa"/"rabbit"/pipicka[.]xyz sample configuration.
  • Threadlinqs Intelligence documents LabubaRAT as an active malware campaign (TL-2026-1367) for SOC detection coverage.
  • Cyber Security News publishes independent coverage of LabubaRAT, cited as the hunt source for this threat record.

Sources cited for LabubaRAT: Rust-Based Windows Implant Masquerading as NVIDIA

Threats related to LabubaRAT: Rust-Based Windows Implant Masquerading as NVIDIA

Detection coverage for TL-2026-1367

As of 2026-07-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1367 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats