LabubaRAT poses as NVIDIA software to take remote control of Windows machines

Researchers at Blackpoint Cyber detailed LabubaRAT, a previously undocumented Rust-based remote access trojan that disguises itself as NVIDIA software to blend into target systems. It arrives as an executable impersonating NVIDIA's container runtime, then profiles the host, identifying installed browsers and security products such as Microsoft Defender, CrowdStrike, and SentinelOne. From there it can run commands and scripts, capture screenshots, move files, and proxy traffic, and it communicates over multiple channels, including HTTPS, WebView2, and DNS tunneling, so access survives if one path is blocked. Its command server details are supplied at runtime, letting attackers reuse the same binary across campaigns, and there are signs it is sold as a service.

Check

Watch for executables impersonating NVIDIA components, such as an unexpected nvidia-sysruntime.exe, and hunt for host-profiling behavior and command-and-control over DNS tunneling or WebView2 that endpoint tools may not flag by default.

Affected

Windows environments where an attacker can plant the malware; LabubaRAT gives hands-on remote control, identifies and works around security tools, and maintains access over several channels, making it hard to fully evict.

Fix

Verify NVIDIA and other software against official sources, deploy endpoint detection tuned for host-profiling and multi-channel command-and-control including DNS tunneling, restrict outbound traffic, and investigate unexpected proxy or SOCKS activity from endpoints.