# LabubaRAT: Rust-based RAT Disguised as NVIDIA Container Runtime Toolkit

> LabubaRAT is a newly documented Rust-based remote access trojan, identified by Blackpoint Cyber's Adversary Pursuit Group (APG), that masquerades as an unsigned NVIDIA Container Runtime component (nvidia-sysruntime.exe). It provides command execution, PowerShell/JavaScript execution, screenshot capture, file transfer, SOCKS5 proxying, and HKCU Run-key persistence, communicating via HTTPS polling, Microsoft Edge WebView2, and DNS tunneling, with runtime-configurable, malware-as-a-service style deployment infrastructure.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1401
- **ID:** TL-2026-1401
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

LabubaRAT is a Rust-compiled (reqwest/hyper/rustls/tokio) remote access trojan first surfaced publicly on 2026-07-15 via Blackpoint Cyber's Adversary Pursuit Group (APG) research, and subsequently corroborated by Help Net Security, The Hacker News, GBHackers, and CyberSecurityNews. The observed sample, nvidia-sysruntime.exe, is an unsigned 64-bit Windows GUI executable that impersonates NVIDIA's Container Runtime Toolkit through version metadata, a PDB path (nvidia_container.pdb), a single-instance mutex (Local\NVIDIAContainerMonitor_SingleInstance), and a local SQLite database (nvctr_sys.db) styled to look like a legitimate NVIDIA component. The build carries a compile timestamp of 2026-06-17 23:16:55 UTC and a Rust cargo build path referencing the developer username "funt".

Unlike malware with hardcoded C2 infrastructure, LabubaRAT is configured at deployment time via command-line arguments (--org, --key, --group, --server, --b, --install, --uninstall) or ZM_-prefixed environment variables, allowing the same compiled binary to be reused across multiple campaigns and operators without recompilation — a strong malware-as-a-service (MaaS) indicator. A Base64-encoded --b parameter packs organization, group, server, and API-key values together; APG decoded one observed deployment to reveal organization "luxespa", group "rabbit", and C2 server pipicka[.]xyz, with associated infrastructure IPs 191.44.109[.]130, 87.120.108[.]18, and 168.222.254[.]204. The C2 infrastructure exposes a panel APG dubbed "LabubaPanel" based on its page title and a Labubu-themed favicon; other observed deployment group tags include room-1, sauna, and vip-chair, consistent with a shared criminal platform serving multiple tenants.

Operationally, LabubaRAT registers the infected host, then accepts operator tasking to execute shell commands (cmd), PowerShell, and JavaScript (via wscript.exe, using a wupd_ execution prefix), capture screenshots, upload/download/delete files, create directories, and archive/unarchive data. It relays traffic through a SOCKS5 proxy and communicates over three independent channels — HTTPS polling, Microsoft Edge WebView2, and DNS tunneling — so an operator can retain access even if one channel is blocked or detected. For persistence it writes a Run-key entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, providing user-level (non-elevated) autostart. Before tasking, it profiles the host: enumerating installed browsers (Chrome, Firefox, Edge, Brave) and installed security products (Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec, Trend Micro) via Windows registry uninstall keys, and collects hostname, CPU/memory specs, domain membership, and UAC elevation state — reconnaissance clearly aimed at gauging EDR/AV coverage and lateral-movement viability before further operator action.

No CVE applies; this is a malware/implant threat rather than a software vulnerability. No attribution to a named threat actor or nation-state has been published; the naming conventions (luxespa, rabbit, room-1, sauna, vip-chair) and configurable multi-tenant architecture point to a criminal MaaS offering rather than a single dedicated operator.

## MITRE ATT&CK

- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1518 Software Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1482 Domain Trust Discovery
- T1069 Permission Groups Discovery
- T1071 Application Layer Protocol
- T1572 Protocol Tunneling
- T1102 Web Service
- T1090 Proxy
- T1113 Screen Capture
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1041 Exfiltration Over C2 Channel

## Sources

- [LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software](https://www.helpnetsecurity.com/2026/07/15/labubarat-rust-malware-nvidia-disguise/)
- [LabubaRAT: A Rust Based Remote Access Tool Masquerading as NVIDIA Software](https://blackpointcyber.com/blog/labubarat-a-rust-based-remote-access-tool-masquerading-as-nvidia-software/)
- [LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts](https://thehackernews.com/2026/07/labubarat-masquerades-as-nvidia.html)
- [LabubaRAT Rust Malware Masquerades as NVIDIA Software to Backdoor Windows Systems](https://gbhackers.com/labubarat-rust-malware/)
- [New Rust-Based LabubaRAT Impersonates NVIDIA Software to Hijack Windows Systems](https://cybersecuritynews.com/labubarat-nvidia-malware/)
- [New LabubaRAT Masquerades as NVIDIA Software to Execute Commands and Proxy Malicious Traffic](https://cyberpress.org/labubarat-abuses-nvidia-branding/)
- [Fake NVIDIA Software Distributes Rust-Based LabubaRAT](https://www.technadu.com/fake-nvidia-software-distributes-new-labubarat-malware-to-hijack-windows-pcs/631186/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1401