# LabubaRAT: Rust-Based Windows Implant Masquerading as NVIDIA Container Runtime

> Blackpoint Cyber's Adversary Pursuit Group uncovered LabubaRAT, a previously undocumented Rust-based remote access trojan distributed as nvidia-sysruntime.exe that impersonates NVIDIA's Container Runtime Monitor. The implant offers multi-channel C2 (HTTPS polling, WebView2-mimicking traffic, Base32 DNS tunneling), full hands-on-keyboard control, and shows signs of a malware-as-a-service (MaaS) distribution model.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1367
- **ID:** TL-2026-1367
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

LabubaRAT is a Rust-based remote access trojan (RAT) identified by Blackpoint Cyber researchers Sam Decker and Nevan Beal of the Adversary Pursuit Group (APG), publicly detailed on July 14, 2026. The implant is distributed as an unsigned 64-bit Windows executable named nvidia-sysruntime.exe, carrying spoofed PE version metadata referencing NVIDIA Corporation and the NVIDIA Container Toolkit to blend into legitimate GPU-accelerated / containerized environments and evade cursory analyst triage.

Rather than hardcoding operator infrastructure, the binary is configured at runtime via command-line arguments or ZM_-prefixed environment variables (--org/ZM_ORG for the target enterprise workspace, --key/ZM_KEY for C2 API authorization, --server/ZM_SERVER for the C2 destination domain, and --group/ZM_GROUP for campaign/customer tracking, with observed values "rabbit", "sauna", and "vip-chair"). Parameters can also be bundled together and passed Base64-encoded via a single -b flag. This design lets one compiled binary be reused across unrelated campaigns and targets without recompilation, and is a strong indicator LabubaRAT is offered as a malware-as-a-service (MaaS) framework to multiple distinct operators/customers rather than a single actor's bespoke tool.

Once launched, the implant establishes persistence via an HKCU Run registry key (user-level, not requiring elevation) and is self-installable/removable through --install and --uninstall command-line switches. A named mutex, Local\\NVIDIAContainerMonitor_SingleInstance, enforces single-instance execution and doubles as a high-fidelity host artifact for defenders. Enrollment state and runtime configuration are cached locally in a SQLite database, nvctr_sys.db.

LabubaRAT profiles the host extensively before or during operator tasking: hostname, RAM size, CPU model, Windows UAC state, installed browsers (Chrome, Firefox, Edge, Brave), and installed security products (Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec, Trend Micro), giving operators an immediate picture of detection/response risk on the compromised host.

For command-and-control, the implant supports three redundant channels built on Rust's reqwest/tokio async HTTP stack: (1) standard HTTPS polling to the configured C2 domain with bearer-token authorization; (2) a WebView2-based channel that mimics legitimate embedded-browser traffic using JavaScript execution inside the WebView2 runtime, blending with normal application telemetry; and (3) DNS tunneling using Base32-encoded payload chunking across queries, providing a covert fallback channel that survives HTTP(S) egress filtering. Losing any one channel to detection does not deny the operator access to the host.

Observed capabilities once an operator is interactively tasking the implant include arbitrary shell and PowerShell command execution, JavaScript execution via the Windows Script Host / WebView2 engine, screenshot capture through GDI APIs, file upload and download, archive (zip) handling for staging/exfiltration, and SOCKS5 proxy relaying to pivot further into the compromised network using the victim host as an egress point.

Infrastructure observed by Blackpoint APG centers on the C2 domain pipicka[.]xyz, fronting an operator panel that Blackpoint dubbed "LabubaPanel" (based on its page title and a Labubu-themed favicon, which also inspired the malware's public name). A decoded sample deployment configuration referenced organization "luxespa", campaign group "rabbit", and C2 server pipicka[.]xyz. Blackpoint additionally identified three further C2 IP addresses hosted on German infrastructure, all first observed active in early June 2026 -- consistent with the sample's June 17, 2026 PE compile timestamp and suggesting a coordinated infrastructure rollout timed to the binary's build. Rust build-path artifacts embedded in the binary reference a developer/build user "funt".

No CVE is associated with this threat; it is a malware/implant campaign rather than a vulnerability, delivered most likely via social-engineering / trojanized-software lures given the NVIDIA-themed disguise (consistent with fake GPU driver, AI/ML tooling, or gaming-adjacent lures, though the initial-access vector was not directly confirmed in public reporting at time of writing). Given the MaaS indicators, this implant should be treated as a reusable commodity foothold tool likely to recur across unrelated intrusions and threat actors rather than a single campaign's exclusive malware.

## MITRE ATT&CK

- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1059.007 JavaScript
- T1204 User Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1518.001 Security Software Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1518 Software Discovery
- T1016 System Network Configuration Discovery
- T1113 Screen Capture
- T1560 Archive Collected Data
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1071.004 DNS
- T1090.004 Domain Fronting
- T1132.002 Non-Standard Encoding
- T1573 Encrypted Channel
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1587.001 Malware
- T1583.001 Domains
- T1583.004 Server

## Sources

- [LabubaRAT: NVIDIA-Themed Malware Analysis](https://cybersecuritynews.com/labubarat-nvidia-malware/)
- [LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts](https://thehackernews.com/2026/07/labubarat-masquerades-as-nvidia.html)
- [New Rust-Based LabubaRAT Impersonates NVIDIA Software to Hijack Windows Systems](https://www.cryptika.com/new-rust-based-labubarat-impersonates-nvidia-software-to-hijack-windows-systems/)
- [New Rust-based RAT named LabubaRAT impersonates NVIDIA software](https://www.scworld.com/brief/new-rust-based-rat-named-labubarat-impersonates-nvidia-software)
- [LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts (forum mirror)](https://forum.ksec.co.uk/t/labubarat-masquerades-as-nvidia-software-to-control-windows-hosts/16186)
- [Blackpoint Cyber Adversary Pursuit Group](https://blackpointcyber.com/why-blackpoint/adversary-pursuit-group/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1367