LabubaRAT: A Rust-Based Remote Access Framework
LabubaRAT is a newly identified Rust-based remote access trojan (RAT) that masquerades as NVIDIA software to compromise Windows systems worldwide. Built as a reusable Malware-as-a-Service framework, LabubaRAT accepts flexible command-and-control configuration at runtime, profiles security tools and browsers on infected hosts, and gives operators broad remote access capabilities.
A1 Malware: LabubaRAT Platform: Windows (64-bit) Region: Worldwide TA2026200A1Summary
Overview
LabubaRAT was first seen in June 2026 and has since been observed targeting Windows (64-bit) systems worldwide. The malware disguises itself as NVIDIA software, specifically impersonating the NVIDIA Container Runtime Toolkit, to infect Windows computers while evading casual inspection.
Once installed, LabubaRAT inventories the browsers present on the infected host, including Google Chrome, Mozilla Firefox, Microsoft Edge, and Brave. It also profiles installed endpoint security products, checking for Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec, and Trend Micro.
Unlike traditional remote access trojans that hardcode their command-and-control server, LabubaRAT accepts configuration at startup, allowing attackers to reuse the same malware binary across multiple targets and campaigns. The malware profiles infected computers to identify security tools and browsers before awaiting operator commands, indicating LabubaRAT was purpose-built as a reusable remote access framework designed for Malware-as-a-Service deployments.
Attack Details
#1 — Masquerading and Persistence
LabubaRAT is a new Rust-based remote access trojan designed for Windows systems. The malware disguises itself as NVIDIA software by using a fake executable named nvidia-sysruntime.exe, complete with fabricated NVIDIA metadata and a legitimate-looking debug path. Instead of relying on a hardcoded command-and-control server, it accepts configuration details through command-line arguments or environment variables at startup. Once installed, LabubaRAT stores its settings in a local SQLite database. It achieves persistence by adding itself to the Windows startup registry, typically using encoded configuration strings to keep the command line less conspicuous.
#2 — Flexible Configuration and Host Profiling
LabubaRAT uses a flexible configuration system that accepts settings such as organization name, API key, group designation, and server address as separate arguments or as a single Base64 string. This approach allows the same LabubaRAT binary to be reused across different targets and campaigns without modification. Before waiting for operator commands, the malware profiles the infected computer, gathering basic details like hostname, CPU model, and RAM, then checking what browsers and security software are installed. LabubaRAT looks for popular antivirus solutions, including Microsoft Defender, CrowdStrike, SentinelOne, and others by examining the Windows registry.
#3 — Remote Access Capabilities and Infrastructure
Notably, LabubaRAT itself does not include credential-stealing or network-spreading capabilities — those actions are left to the operator, who can use the malware's built-in remote access features to run additional tools as needed. The malware communicates over multiple channels: standard HTTPS requests with authentication tokens, embedded Microsoft Edge components, or DNS tunneling with encoded commands. LabubaRAT supports file transfers, screenshot capture, shell and PowerShell execution, JavaScript through Windows Script Host, and the ability to act as a network proxy. Three additional server IP addresses in Germany share the same control panel interface, suggesting LabubaRAT was deployed across multiple locations starting in early June 2026, indicating it was built as reusable infrastructure for multiple campaigns.
Recommendations
Enforce Signed-Binary Policy for Vendor-Themed Executables
Alert on unsigned executables that carry vendor version metadata claiming NVIDIA, Intel, AMD, or similar trusted origin, particularly when they execute from user-writable paths, temporary directories, or outside standard Program Files locations.
Detect Base64-Encoded Command Lines Paired with Persistence
Build detections for HKCU\Software\Microsoft\Windows\CurrentVersion\Run entries that launch binaries with long Base64-like command-line arguments, especially where the decoded value reveals configuration fields such as --org, --key, --group, --server, --dns-domain, or --dns-resolver.
Hunt for Local Enrollment Artifacts
Search endpoints for the SQLite database nvctr_sys.db (and matching -wal and -shm files), the single-instance mutex Local\NVIDIAContainerMonitor_SingleInstance, and stored keys such as server_url, device_token, dns_domain, and polling interval values.
Monitor Unusual Parents for Shell and Script Execution
Alert on uncommon parent processes spawning cmd.exe, powershell.exe, wscript.exe, or cscript.exe; flag temporary files with a wupd_ prefix; and monitor for screen-capture GDI API sequences (GetDC, CreateCompatibleBitmap, BitBlt, GetDIBits) originating from non-graphics processes.
Strengthen Windows Script Host Coverage
Where possible, disable or restrict Windows Script Host on endpoints that do not require it, and where restriction is not feasible, enable Script Block and Module Logging equivalents for wscript.exe and cscript.exe so JScript execution matches the visibility available for PowerShell.
Segment and Monitor for SOCKS5 Relay Behavior
Apply network segmentation so that endpoints cannot arbitrarily initiate outbound tunnels to internet infrastructure, and detect SOCKS5 handshake patterns and long-lived outbound sessions from workstations that should not act as proxies.
Indicators of Compromise (IOCs)
| Type | Value |
|---|---|
| SHA256 | b7443b0ab48d2f5786d1b6f3a580f02621e9ae5a3877ee3a44e01df13d984328 |
| MD5 | d8bf355a198fb5db3ea65cfdfcdfbd19 |
| Filename | nvidia-sysruntime.exe, nvctr_sys.db |
| File Path | nvidia_container.pdb, C:\Users\funt\.cargo\registry\ |
| Mutex | Local\NVIDIAContainerMonitor_SingleInstance |
| URL | hxxps[:]//pipicka[.]xyz |
| IPv4 | 191[.]44[.]109[.]130, 87[.]120[.]108[.]18, 168[.]222[.]254[.]204 |
MITRE ATT&CK TTPs
T1059.003T1059.001T1059.007T1547.001T1027.013T1036.005T1140T1518.001T1012T1082T1016T1113T1560T1071.001T1071.004T1132.001T1573T1090T1105T1568References & Patch Links
What Next?
At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.
Book a Demo of HiveProTA2026200 © 2026 All Rights are Reserved by Hive Pro • www.hivepro.com 
.svg)