Pesquisadores da Blackpoint Cyber descobriram o LabubaRAT, um novo Cavalo de Troia (RAT) que se disfarça de um aplicativo legítimo da NVIDIA para invadir computadores. Apesar de usar o nome do arquivo "nvidia-sysruntime.exe" para enganar os usuários, a fabricante de placas de vídeo não possui nenhuma relação com o golpe. Desenvolvido na linguagem Rust, o vírus é altamente furtivo. Ele vasculha as defesas do sistema e cria canais ocultos de comunicação com os criminosos. Isso garante aos hackers controle total da máquina à distância, permitindo capturar a tela da vítima, roubar dados sigilosos e executar códigos maliciosos de forma silenciosa.

A previously undocumented remote access tool dubbed LabubaRAT, a Rust-based implant that masquerades as NVIDIA software to compromise Windows systems. The malware uncovered by Blackpoint Cyber’s Adve…

LabubaRAT poses as NVIDIA software, profiles security tools, and uses HTTPS, WebView2, or DNS tunneling to maintain remote access on Windows hosts.

Cybersecurity researchers have flagged a previously undocumented Rust-based remote access trojan (RAT) codenamed LabubaRAT that masquerades as NVIDIA software to blend into target environments. "LabubaRAT creates a reusable foothold for hands-on activity," Blackpoint Cyber researchers Sam Decker and Nevan Beal said in an analysis published today. "Once deployed, it can profile the host,

Pesquisadores de cibersegurança da empresa Blackpoint Cyber descobriram uma **nova ameaça digital batizada de LabubaRAT**. Esse é um vírus que se disfarça de uma ferramenta da fabricante de placas de vídeo NVIDIA para invadir sistemas corporativos, assumir o controle remoto das máquinas e roubar dados. Como o nome já indica, o Labuba é um RAT, ou seja, um Cavalo de Troia de Acesso Remoto. Esse é um tipo de malware comum no mundo do cibercrime e conta com características muito perigosas. Softwares como esse permitem que um**invasor opere o computador da vítima à distância** , com acesso completo aos arquivos e processos do sistema. O que chama a atenção é como o malware é **distribuído por um executável que usa o nome da Nvidia** , chamado “nvidia-sysruntime.exe”. Apesar disso, a Nvidia não possui nenhuma relação direta com esse golpe e seus softwares estão livres de vírus. Os atacantes apenas utilizaram o nome da empresa. **O relatório da Blackpoint não detalha exatamente como o LabubaRAT é distribuído na internet** , somente o seu método de execução e comportamento. Esse nome foi atribuído ao malware por conta da interface de comando utilizada pelos hackers, que exibia o título "LabubaPanel" e a imagem do brinquedo chamado Labubu. Painel dos cibercriminosos literalmente fazia referência aos Labubus (Imagem: Blackpoint Security/reprodução) Uma vez instalado na máquina, o LabubaRAT pode **capturar a tela do usuário, copiar documentos confidenciais, baixar arquivos da rede** e carregar novas ferramentas maliciosas para dentro da máquina. Com as devidas permissões, esse RAT pode até controlar partes do sistema da vítima. ## Dissecando o LabubaRAT Por fora, o LabubaRAT se esconde como uma aplicação da NVIDIA, diretamente relacionada ao Nvidia Container Runtime Monitor. Por dentro, **o programa é construído em Rust** , uma linguagem de programação moderna que gera códigos complexos e rápidos. Essa é uma linguagem presente em diversos malwares recentes. O documento da Blackpoint Cyber cita que diferente de outros vírus, **ele recebe suas instruções no momento em que é ativado, via comandos de texto**. Isso é feito por meio de um script empacotado em um bloco de texto codificado. Dessa forma, o mesmo arquivo pode ser usado em campanhas totalmente diferentes, enganando as defesas do sistema. Após a ativação, o vírus cria um pequeno banco de dados oculto no disco para guardar suas configurações. Antes de agir, ele vasculha o computador em busca de um recurso chamado “estado do controle de usuário” (UAC) e identifica quais navegadores e ferramentas de segurança estão instalados, como softwares da Kaspersky, CrowdStrike, etc. Metadados com temas da Nvidia e resquícios de linguagem Rust entregaram o golpe aos pesquisadores (Imagem: Blackpoint Security/reprodução) **O RAT começa a estabelecer três canais de comunicação com os hackers**. Ele usa tráfego padrão de sites, por meio do protocolo HTTPS, e um canal escondido por meio de processos de navegadores (WebView2). Caso a segurança do sistema bloqueie esses dois, há um terceiro canal feito por meio de requisições falsas de internet. Quando finalmente o atacante resolve rodar seus comandos maliciosos, **o LabubaRAT cria pequenos scripts temporários, escritos em JavaScript, e os executa de forma silenciosa.** Para se manter no sistema após o PC ser desligado, ele se infiltra no registro de inicialização do Windows do próprio usuário. ## Como as empresas podem se proteger? A Blackpoint indica que a a**utilização de sistemas de detecção e resposta pode ser usada** para interceptar programas que afirmam ser empresas, como a Nvidia, mas não possuem certificado digital atrelado. Monitorar e alertar execuções de arquivos desconhecidos também é um passo importante. Como a empresa não cita a distribuição do LabubaRAT e ele se disfarça de app da Nvidia, é fácil assumir que ele está disponível para download em fóruns e anúncios falsos. Para o usuário comum,**é importante baixar arquivos somente no site oficial das fabricantes.** Por falar em malwares, um hacker criou quase 300 repositórios falsos no GitHub para espalhar arquivos maliciosos que se passavam por softwares legítimos. Siga o **TecMundo** no X, Instagram, Facebook e YouTube e assine a nossa newsletter para receber as principais notícias e análises diretamente no seu e-mail.

A previously undocumented remote access tool dubbed LabubaRAT, a Rust-based implant that masquerades as NVIDIA software to compromise Windows systems. The malware uncovered by Blackpoint Cyber’s Adversary Pursuit Group (APG) is distributed as nvidia-sysruntime.exe uses fake vendor metadata and runtime artifacts to blend into legitimate environments while granting operators full hands-on control over infected hosts. The unsigned 64-bit executable presents itself as NVIDIA’s Container Runtime Monitor, complete with spoofed version information referencing NVIDIA Corporation and the NVIDIA Container Toolkit . It reinforces this identity through a single-instance mutex named Local\NVIDIAContainerMonitor_SingleInstance and a local SQLite database, nvctr_sys.db , that stores enrollment data and runtime state. Despite the NVIDIA branding, compile artifacts including a PE timestamp of June 17, 2026, and Rust build paths referencing a “funt” user—expose its true nature as a remote access framework rather than legitimate software. NVIDIA themed metadata and Rust artifacts exposed the sample’s masquerade.   (Image Source: Blackpointcyber) Detailed forensic data, tactical indicators of compromise, and full infrastructure maps are available in the technical write-up for LabubaRAT : A Rust-Based Remote Access Tool Masquerading as NVIDIA Software, Blackpoint Cyber said . Rust-Based LabubaRAT Unlike malware with hardcoded command-and-control (C2) infrastructure, LabubaRAT accepts runtime configuration via command-line arguments or matching ZM_ -prefixed environment variables, letting operators define the organization, group, server, and API key at launch. A Base64-encoded –b parameter packs these values together, which APG decoded to reveal an observed deployment using the organization “luxespa,” group “rabbit,” and C2 server pipicka[.]xyz . This design lets a single compiled binary serve multiple campaigns or customers, a Malware-as-a-Service-style structure further suggested by example group names like “sauna” and “vip-chair” found in the embedded help text. The weaponization of multiple evasion profiles and flexible parameters mirrors how modern actors use compromised software packages to establish rapid footprints within corporate pipelines. The –b value decoded into the runtime configuration used by the agent. (Image Source: Blackpointcyber) Configuration Field CLI Argument Flag Environment Variable Vector Operational Intent Organization Target --org ZM_ORG Assigns the targeted enterprise workspace Authentication Token --key ZM_KEY Passes the unique API key for C2 authorization C2 Destination --server ZM_SERVER Establishes the target remote server domain Campaign Group --group ZM_GROUP Tracks specific campaign tiers (e.g., “rabbit”) LabubaRAT supports three distinct methods to reach its C2 infrastructure: standard HTTPS polling using Rust libraries like reqwest and tokio , WebView2-based communication that mimics browser traffic through embedded JavaScript, and DNS tunneling with Base32-encoded payload chunking. This redundancy gives operators resilient access even if one channel is blocked or detected. Once enrolled, the implant profiles the host—collecting hardware specs, installed browsers, antivirus products, and domain information—before awaiting operator tasking. Supported commands include shell and PowerShell execution, JavaScript execution via Windows Script Host, screenshot capture through GDI APIs, file upload/download, archive handling, and SOCKS5 proxy relaying. User-level persistence is achieved through an HKCU Run key, configurable via –install and –uninstall flags. Operators routinely turn to these robust execution flows, pairing them with malicious automation scripts to enumerate high-value networks in minutes. The SQLite schema defined local storage for configuration, device state, and event tracking.  (Image Source: Blackpointcyber) The malware’s name derives from its C2 panel, which displayed a “LabubaPanel” title and a Labubu-themed favicon. Pivoting from this panel structure, APG identified three additional C2 IP addresses hosted on German infrastructure, all appearing since early June 2026, a timing that aligns with the sample’s compile date and suggests a coordinated rollout. Blackpoint recommends security teams hunt for unsigned binaries claiming NVIDIA identity, scrutinize Base64-encoded command-line arguments tied to autorun entries, and search for nvctr_sys.db artifacts. Monitoring outbound traffic for browser-spoofed User-Agents paired with bearer authentication, WebView2 requests, or high-entropy DNS queries can also help flag LabubaRAT activity before operators establish full control. Attackers Move in Seconds. Defenses Take Hours! Blackpoint Built the Answer – Attend a Free Webinar on AI SOC Agent to contain a live attack. The post New Rust-Based LabubaRAT Impersonates NVIDIA Software to Hijack Windows Systems appeared first on Cyber Security News .

A newly discovered Rust-based RAT called LabubaRAT disguises itself as NVIDIA software to compromise Windows hosts.

A previously undocumented Rust-based remote access trojan, dubbed LabubaRAT, which masquerades as legitimate NVIDIA software to establish persistent access on Windows.

LabubaRAT, a previously undocumented Rust-based remote access tool (RAT) masquerading as NVIDIA software that enables post-compromise operations on Windows systems, has been uncovered by Blackpoint Cyber. According to researchers, LabubaRAT creates “a reusable foothold for hands-on activity.” Once deployed, it can profile the host, identify installed security tools, receive operator commands, transfer files, capture screenshots, and proxy network traffic through the affected system. Blackpoint Cyber named the malware LabubaRAT after discovering a “LabubaPanel” title and …

Cybersecurity researchers have flagged a previously undocumented Rust-based remote access trojan (RAT) codenamed LabubaRAT that masquerades as NVIDIA software to blend into target environments. "LabubaRAT creates a reusable foothold for hands-on activity," Blackpoint Cyber researchers Sam Decker and Nevan Beal said in an analysis published today. "Once deployed, it can profile the host,

Introduction: When Trusted Brands Become the Perfect Disguise Cybercriminals continue to evolve their tactics, and one of their most effective strategies remains abusing the names of globally trusted technology companies. Security researchers have now uncovered a sophisticated remote access trojan (RAT) named LabubaRAT, a Rust-based malware family that disguises itself as legitimate NVIDIA software to deceive users and security teams alike.

Introduction: A New Malware Framework Built for Long-Term Control Cybersecurity researchers have uncovered a previously unknown remote access trojan (RAT) called LabubaRAT, a sophisticated malware implant written in the Rust programming language and designed to hide behind the appearance of legitimate NVIDIA software. Unlike traditional malware that relies on fixed infrastructure and simple attack methods, LabubaRAT appears to be built as a flexible remote control platform, giving attackers the ability to maintain access, collect intelligence, execute commands, and move deeper into compromised environments.

Simple Steps To Eliminate Malicious Application LabubaRAT is a type of malicious software called a Remote Access Trojan (RAT). It is written in the Rust programming language and is designed to secretly give attackers control of an infected computer. To avoid suspicion, it disguises itself as legitimate NVIDIA software by using the filename “nvidia-sysruntime.exe” and In order to remove LabubaRAT Malware, you should run a complete system scan with a reputable antivirus program and remove any detected threats.

A previously undocumented remote access tool dubbed LabubaRAT, a Rust-based implant that masquerades as NVIDIA software to compromise Windows systems.

A newly discovered Rust-based RAT called LabubaRAT disguises itself as NVIDIA software to compromise Windows hosts.

LabubaRAT operates by impersonating NVIDIA's container runtime toolkit, using an executable named "nvidia-sysruntime.exe."

LabubaRAT poses as NVIDIA software, profiles security tools, and uses HTTPS, WebView2, or DNS tunneling to maintain remote access on Windows hosts.

Groups Conversations All groups and messages Sign in Technical - Malware Conversations About Privacy • Terms     LabubaRAT: A Rust Based Remote Access Tool Masquerading as NVIDIA Software 0 views Eyal Estrin unread, 11:13 AM (27 minutes ago)    to https://blackpointcyber.com/blog/labubarat-a-rust-based-remote-access-tool-masquerading-as-nvidia-software/ Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

Cybersecurity researchers have flagged a previously undocumented Rust-based remote access trojan (RAT) codenamed LabubaRAT that masquerades as NVIDIA software to blend into target environments. "LabubaRAT creates a reusable foothold for hands-on activity," Blackpoint Cyber researchers Sam Decker and Nevan Beal said in an analysis published today. "Once deployed, it can profile the host,

At a Glance Malware family LabubaRAT (previously undocumented) Threat actor Unattributed; no group named Targets Windows hosts; no victim count published Delivery vector Not documented in the report Key capabilities Shell, PowerShell and JavaScript execution, screenshots, file transfer, SOCKS5 proxy Source Blackpoint Cyber Adversary Pursuit Group (APG) TL;DR Blackpoint Cyber's Adversary Pursuit Group has documented LabubaRAT, a new implant written in…

NVIDIAソフトウェアになりすましてWindowsシステムへの侵害後活動を可能にする、Rust製の未検出リモートアクセスツール(RAT)「LabubaRAT」が、Blackpoint Cyberによって発見されました。 研究者らによると、LabubaRATは「再利用可能な足がかりとなる侵入拠点」を作