LabubaRAT Impersonates NVIDIA Software

A sophisticated Rust-based remote access trojan, identified as LabubaRAT, is currently circulating with a deceptive camouflage strategy. By masquerading as NVIDIA software, the malware aims to bypass standard security filters and remain undetected within target environments.

Tactical Disguise and Execution

The attack chain initiates through an executable named nvidia-sysruntime.exe, which falsely presents itself as part of NVIDIA's container runtime toolkit. Unlike conventional malware that embeds command-and-control (C2) instructions directly into its binary, this tool utilizes dynamic runtime configuration. Operators can supply server details—specifically targeting pipicka[.]xyz—and define polling intervals through command-line arguments or via a single Base64-encoded string.

Because those values were provided at launch, the same compiled binary could be reused with different infrastructure, organizations, or campaign groupings instead of relying on a hard-coded server.

— Blackpoint Cyber researchers Sam Decker and Nevan Beal

Adaptive Communication Protocols

The implant prioritizes operational resilience through support for multiple communication methods, including HTTPS, WebView2, and DNS tunneling. This redundancy allows attackers to maintain access even if specific network pathways are identified and subsequently blocked by security teams. Upon deployment, the malware performs extensive reconnaissance, storing host-specific configuration data within a local SQLite database to ensure continuous operation.

Host Profiling and Surveillance

Before executing primary objectives, LabubaRAT inventories the compromised host to assess both its hardware specifications and its security posture. The malware specifically identifies the presence of numerous security products, including Google Chrome, Mozilla Firefox, Microsoft Edge, Brave, Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec, and Trend Micro. Beyond software auditing, the RAT gathers hardware-level data such as RAM size, CPU model, and the Windows User Account Control (UAC) state.

• Executable name: nvidia-sysruntime.exe
• Primary C2 domain: pipicka[.]xyz
• Communication methods: HTTPS, WebView2, and DNS tunneling

Operational Implications

The architecture of LabubaRAT suggests a shift toward modular, framework-like malware development. Because the tool does not rely on a separate loader, it provides operators with a comprehensive suite of capabilities, including file management, screenshot capture, SOCKS5 proxy support, and the ability to execute PowerShell or JavaScript commands. For organizations, the presence of this tool highlights the importance of scrutinizing processes that mimic legitimate hardware drivers or system runtimes. The capability to profile security tools before acting suggests that threat actors are increasingly optimizing their tactics based on the specific defenses installed on a target machine, potentially leading to more tailored and evasive compromise strategies.