Cybersecurity researchers have uncovered a previously undocumented Rust-based remote access trojan (RAT) called LabubaRAT, a sophisticated malware strain designed to masquerade as legitimate NVIDIA software while providing attackers with persistent remote access to compromised Windows systems.
According to a report published by Blackpoint Cyber, LabubaRAT is engineered to establish a long-term foothold on infected machines, allowing threat actors to execute commands, transfer files, capture screenshots, and route network traffic through the victim’s device.
Built for Persistent Remote Access
Unlike many conventional remote access trojans, LabubaRAT combines several advanced capabilities into a single malware framework.
Once installed, it can:
- Profile the infected system
- Detect installed security software
- Execute system and PowerShell commands
- Run JavaScript code
- Upload and download files
- Capture screenshots
- Create SOCKS5 proxy connections
- Maintain persistent access to the compromised device
Researchers note that these features provide attackers with extensive control over infected hosts without requiring additional malware components.
Multiple Communication Channels Improve Stealth
One of LabubaRAT’s standout features is its ability to communicate using multiple network protocols.
The malware supports:
- HTTPS
- Microsoft WebView2
- DNS tunneling
Using several communication methods allows attackers to maintain access even if defenders detect and block one of the available channels.
Blackpoint Cyber also found evidence suggesting the malware may be distributed as part of a malware-as-a-service (MaaS) offering, allowing different threat actors to deploy the same toolkit across multiple campaigns.
Disguised as NVIDIA Software
The infection begins with an executable named “nvidia-sysruntime.exe,” which impersonates NVIDIA’s Container Runtime Toolkit to avoid raising suspicion.
Rather than embedding its command-and-control (C2) server information directly into the malware, LabubaRAT accepts configuration settings through command-line arguments when launched.
These settings include:
- Command-and-control server details
- Communication intervals
- Other runtime parameters
Researchers observed one configuration pointing to the domain pipicka[.]xyz.
The malware also supports receiving all configuration data as a single Base64-encoded argument, allowing operators to reuse the same malware binary across different campaigns without recompiling it.
Configuration Stored Locally
After startup, LabubaRAT stores its operational configuration inside a local SQLite database.
It then begins profiling the infected system by collecting detailed information about both the hardware and installed software.
The malware inventories popular web browsers, including:
- Google Chrome
- Mozilla Firefox
- Microsoft Edge
- Brave
It also searches for numerous security solutions, such as:
- Microsoft Defender
- CrowdStrike
- SentinelOne
- Carbon Black
- Sophos
- Malwarebytes
- Bitdefender
- ESET
- Kaspersky
- McAfee
- Symantec
- Trend Micro
In addition, it gathers information such as:
- Hostname
- Installed RAM
- CPU model
- Windows User Account Control (UAC) status
This reconnaissance enables attackers to better understand the target environment and tailor subsequent operations based on the security products detected.
Extensive Post-Compromise Capabilities
Once fully operational, LabubaRAT offers attackers a broad range of remote administration functions.
These include:
- Remote command execution
- PowerShell scripting
- JavaScript execution
- Screenshot collection
- File uploads and downloads
- Archive management
- SOCKS5 proxy support
These capabilities allow operators to move data in and out of compromised environments, pivot network traffic through infected systems, and maintain long-term access without deploying additional payloads.
Malware Named After Its Control Panel
Researchers named the malware LabubaRAT after the “LabubaPanel” branding observed within its command-and-control infrastructure, which also featured a Labubu-themed favicon.
According to Blackpoint Cyber, the malware’s architecture resembles a flexible framework rather than a single-purpose implant.
Its runtime configuration, local data storage, host profiling, multiple communication methods, and modular task execution indicate that it was designed for repeated deployment across numerous victim environments.
Final Thoughts
LabubaRAT represents another example of modern malware shifting toward flexible, reusable frameworks that can support multiple attack campaigns. Its use of runtime configuration, multi-channel communications, and extensive remote administration features makes it a capable post-exploitation tool for cybercriminals.
Researchers believe the malware’s framework-like design and possible malware-as-a-service distribution model could enable wider adoption among threat actors, highlighting the importance of monitoring suspicious processes impersonating legitimate software and strengthening endpoint detection capabilities.
