LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software
Researchers have identified a new Rust-based malware called LabubaRAT that masquerades as NVIDIA software to infiltrate Windows systems. The malware uses a flexible, configuration-based approach to command-and-control, allowing attackers to maintain persistent access.
Why it matters
This discovery highlights evolving tactics in malware development, specifically the use of legitimate software branding to bypass security detection.
LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software LabubaRAT, a previously undocumented Rust-based remote access tool (RAT) masquerading as NVIDIA software that enables post-compromise operations on Windows systems, has been uncovered by Blackpoint Cyber.
According to researchers, LabubaRAT creates “a reusable foothold for hands-on activity.” Once deployed, it can profile the host, identify installed security tools, receive operator commands, transfer files, capture screenshots, and proxy network traffic through the affected system.
Blackpoint Cyber named the malware LabubaRAT after discovering a “LabubaPanel” title and a Labubu-themed favicon on its associated command-and-control (C2) infrastructure.
Rather than hardcoding its infrastructure into the binary, LabubaRAT receives its configuration at launch through command-line arguments or matching environment variables.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in