LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts
Summary: Blackpoint Cyber researchers Sam Decker and Nevan Beal documented a previously undocumented Rust-based RAT called LabubaRAT that masquerades as NVIDIA software, delivered as an executable named "nvidia-sysruntime.exe" impersonating NVIDIA's container runtime toolkit. The implant takes its command-and-control configuration at launch through command-line arguments, including the server "pipicka[.]xyz" and polling interval, stores it in a local SQLite database, then inventories installed browsers and security products such as Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, Sophos, Malwarebytes, Bitdefender, ESET, Kaspersky, McAfee, Symantec, and Trend Micro.
What you should know: Because the C2 values are supplied at runtime rather than hard-coded, the same compiled binary can be reused against different organizations and infrastructure, and its HTTPS, WebView2, and DNS tunneling channels mean closing one path does not end the operator's access.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026