LabubaRAT is a newly identified Rust-based remote access trojan (RAT) that masquerades as NVIDIA software to compromise Windows systems worldwide. Built as a reusable Malware-as-a-Service framework, LabubaRAT accepts flexible command-and-control configuration at runtime, profiles security tools and browsers on infected hosts, and gives operators broad remote access capabilities.
Section 01
Summary
Overview
LabubaRAT was first seen in June 2026 and has since been observed targeting Windows (64-bit) systems worldwide. The malware disguises itself as NVIDIA software, specifically impersonating the NVIDIA Container Runtime Toolkit, to infect Windows computers while evading casual inspection.
Once installed, LabubaRAT inventories the browsers present on the infected host, including Google Chrome, Mozilla Firefox, Microsoft Edge, and Brave. It also profiles installed endpoint security products, checking for Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec, and Trend Micro.
Unlike traditional remote access trojans that hardcode their command-and-control server, LabubaRAT accepts configuration at startup, allowing attackers to reuse the same malware binary across multiple targets and campaigns. The malware profiles infected computers to identify security tools and browsers before awaiting operator commands, indicating LabubaRAT was purpose-built as a reusable remote access framework designed for Malware-as-a-Service deployments.
Section 02
Attack Details
#1 — Masquerading and Persistence
LabubaRAT is a new Rust-based remote access trojan designed for Windows systems. The malware disguises itself as NVIDIA software by using a fake executable named nvidia-sysruntime.exe, complete with fabricated NVIDIA metadata and a legitimate-looking debug path. Instead of relying on a hardcoded command-and-control server, it accepts configuration details through command-line arguments or environment variables at startup. Once installed, LabubaRAT stores its settings in a local SQLite database. It achieves persistence by adding itself to the Windows startup registry, typically using encoded configuration strings to keep the command line less conspicuous.
#2 — Flexible Configuration and Host Profiling
LabubaRAT uses a flexible configuration system that accepts settings such as organization name, API key, group designation, and server address as separate arguments or as a single Base64 string. This approach allows the same LabubaRAT binary to be reused across different targets and campaigns without modification. Before waiting for operator commands, the malware profiles the infected computer, gathering basic details like hostname, CPU model, and RAM, then checking what browsers and security software are installed. LabubaRAT looks for popular antivirus solutions, including Microsoft Defender, CrowdStrike, SentinelOne, and others by examining the Windows registry.
#3 — Remote Access Capabilities and Infrastructure
Notably, LabubaRAT itself does not include credential-stealing or network-spreading capabilities — those actions are left to the operator, who can use the malware's built-in remote access features to run additional tools as needed. The malware communicates over multiple channels: standard HTTPS requests with authentication tokens, embedded Microsoft Edge components, or DNS tunneling with encoded commands. LabubaRAT supports file transfers, screenshot capture, shell and PowerShell execution, JavaScript through Windows Script Host, and the ability to act as a network proxy. Three additional server IP addresses in Germany share the same control panel interface, suggesting LabubaRAT was deployed across multiple locations starting in early June 2026, indicating it was built as reusable infrastructure for multiple campaigns.
