LabubaRAT: Rust-based RAT Disguised as NVIDIA Container Runtime Toolkit — Threadlinqs Intelligence
As of 2026-07-16, LabubaRAT: Rust-based RAT Disguised as NVIDIA Container Runtime Toolkit is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-1401 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
LabubaRAT is a newly documented Rust-based remote access trojan, identified by Blackpoint Cyber's Adversary Pursuit Group (APG), that masquerades as an unsigned NVIDIA Container Runtime component
LabubaRAT is a Rust-compiled (reqwest/hyper/rustls/tokio) remote access trojan first surfaced publicly on 2026-07-15 via Blackpoint Cyber's Adversary Pursuit Group (APG) research, and subsequently corroborated by Help Net Security, The Hacker News, GBHackers, and CyberSecurityNews. The observed sample, nvidia-sysruntime.exe, is an unsigned 64-bit Windows GUI executable that impersonates NVIDIA's Container Runtime Toolkit through version metadata, a PDB path (nvidia_container.pdb), a single-instance mutex (Local\NVIDIAContainerMonitor_SingleInstance), and a local SQLite database (nvctr_sys.db) styled to look like a legitimate NVIDIA component. The build carries a compile timestamp of 2026-06-17 23:16:55 UTC and a Rust cargo build path referencing the developer username "funt".
Unlike malware with hardcoded C2 infrastructure, LabubaRAT is configured at deployment time via command-line arguments (--org, --key, --group, --server, --b, --install, --uninstall) or ZM_-prefixed environment variables, allowing the same compiled binary to be reused across multiple campaigns and operators without recompilation — a strong malware-as-a-service (MaaS) indicator. A Base64-encoded --b parameter packs organization, group, server, and API-key values together; APG decoded one observed deployment to reveal organization "luxespa", group "rabbit", and C2 server pipicka[.]xyz, with associated infrastructure IPs 191.44.109[.]130, 87.120.108[.]18, and 168.222.254[.]204. The C2 infrastructure exposes a panel APG dubbed "LabubaPanel" based on its page title and a Labubu-themed favicon; other observed deployment group tags include room-1, sauna, and vip-chair, consistent with a shared criminal platform serving multiple tenants.
Operationally, LabubaRAT registers the infected host, then accepts operator tasking to execute shell commands (cmd), PowerShell, and JavaScript (via wscript.exe, using a wupd_ execution prefix), capture screenshots, upload/download/delete files, create directories, and archive/unarchive data. It relays traffic through a SOCKS5 proxy and communicates over three independent channels — HTTPS polling, Microsoft Edge WebView2, and DNS tunneling — so an operator can retain access even if one channel is blocked or detected. For persistence it writes a Run-key entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, providing user-level (non-elevated) autostart. Before tasking, it profiles the host: enumerating installed browsers (Chrome, Firefox, Edge, Brave) and installed security products (Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec, Trend Micro) via Windows registry uninstall keys, and collects hostname, CPU/memory specs, domain membership, and UAC elevation state — reconnaissance clearly aimed at gauging EDR/AV coverage and lateral-movement viability before further operator action.
No CVE applies; this is a malware/implant threat rather than a software vulnerability. No attribution to a named threat actor or nation-state has been published; the naming conventions (luxespa, rabbit, room-1, sauna, vip-chair) and configurable multi-tenant architecture point to a criminal MaaS offering rather than a single dedicated operator.
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1204, T1059, T1059, T1059, T1547, T1036, T1518, T1518, T1518, T1082