LabubaRAT: Rust-Based Windows Implant Masquerading as NVIDIA Container Runtime — Threadlinqs Intelligence
As of 2026-07-15, LabubaRAT: Rust-Based Windows Implant Masquerading as NVIDIA Container Runtime is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 16 indicators of compromise.
Threat ID: TL-2026-1367 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Blackpoint Cyber's Adversary Pursuit Group uncovered LabubaRAT, a previously undocumented Rust-based remote access trojan distributed as nvidia-sysruntime.exe that impersonates NVIDIA's Container
LabubaRAT is a Rust-based remote access trojan (RAT) identified by Blackpoint Cyber researchers Sam Decker and Nevan Beal of the Adversary Pursuit Group (APG), publicly detailed on July 14, 2026. The implant is distributed as an unsigned 64-bit Windows executable named nvidia-sysruntime.exe, carrying spoofed PE version metadata referencing NVIDIA Corporation and the NVIDIA Container Toolkit to blend into legitimate GPU-accelerated / containerized environments and evade cursory analyst triage.
Rather than hardcoding operator infrastructure, the binary is configured at runtime via command-line arguments or ZM_-prefixed environment variables (--org/ZM_ORG for the target enterprise workspace, --key/ZM_KEY for C2 API authorization, --server/ZM_SERVER for the C2 destination domain, and --group/ZM_GROUP for campaign/customer tracking, with observed values "rabbit", "sauna", and "vip-chair"). Parameters can also be bundled together and passed Base64-encoded via a single -b flag. This design lets one compiled binary be reused across unrelated campaigns and targets without recompilation, and is a strong indicator LabubaRAT is offered as a malware-as-a-service (MaaS) framework to multiple distinct operators/customers rather than a single actor's bespoke tool.
Once launched, the implant establishes persistence via an HKCU Run registry key (user-level, not requiring elevation) and is self-installable/removable through --install and --uninstall command-line switches. A named mutex, Local\\NVIDIAContainerMonitor_SingleInstance, enforces single-instance execution and doubles as a high-fidelity host artifact for defenders. Enrollment state and runtime configuration are cached locally in a SQLite database, nvctr_sys.db.
LabubaRAT profiles the host extensively before or during operator tasking: hostname, RAM size, CPU model, Windows UAC state, installed browsers (Chrome, Firefox, Edge, Brave), and installed security products (Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec, Trend Micro), giving operators an immediate picture of detection/response risk on the compromised host.
For command-and-control, the implant supports three redundant channels built on Rust's reqwest/tokio async HTTP stack: (1) standard HTTPS polling to the configured C2 domain with bearer-token authorization; (2) a WebView2-based channel that mimics legitimate embedded-browser traffic using JavaScript execution inside the WebView2 runtime, blending with normal application telemetry; and (3) DNS tunneling using Base32-encoded payload chunking across queries, providing a covert fallback channel that survives HTTP(S) egress filtering. Losing any one channel to detection does not deny the operator access to the host.
Observed capabilities once an operator is interactively tasking the implant include arbitrary shell and PowerShell command execution, JavaScript execution via the Windows Script Host / WebView2 engine, screenshot capture through GDI APIs, file upload and download, archive (zip) handling for staging/exfiltration, and SOCKS5 proxy relaying to pivot further into the compromised network using the victim host as an egress point.
Infrastructure observed by Blackpoint APG centers on the C2 domain pipicka[.]xyz, fronting an operator panel that Blackpoint dubbed "LabubaPanel" (based on its page title and a Labubu-themed favicon, which also inspired the malware's public name). A decoded sample deployment configuration referenced organization "luxespa", campaign group "rabbit", and C2 server pipicka[.]xyz. Blackpoint additionally identified three further C2 IP addresses hosted on German infrastructure, all first observed active in early June 2026 -- consistent with the sample's June 17, 2026 PE compile timestamp and suggesting a coordinated infrastructure rollout timed to the binary's build. Rust build-path artifacts embedded in the binary reference a developer/build user "funt".
No CVE is a
Target sectors: all sectors opportunistic maas commodity tooling
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 16 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1059, T1059.001, T1059.007, T1204, T1547.001, T1036, T1036.005, T1027, T1518.001