LabubaRAT: A Rust Based Remote Access Tool Masquerading as NVIDIA Software

LabubaRAT is a previously undocumented remote access tool written in Rust that disguises itself as NVIDIA software through falsified metadata and runtime artifacts. It creates persistent footholds on compromised systems, allowing hands-on operator activity such as host profiling, security tool detection, command execution, file transfers, screenshot capture, and traffic proxying. The implant communicates via multiple methods including HTTPS polling, WebView2-based communication, and DNS tunneling. Its modular framework uses organization, group, server, and API key parameters indicative of a Malware-as-a-Service platform. The malware stores local state in SQLite databases and provides extensive remote access capabilities including PowerShell and JavaScript execution, SOCKS5 proxy support, and persistence through registry autoruns. Infrastructure analysis shows LabubaPanel branding with command and control servers hosted by German providers.

LabubaRAT enables attackers to maintain persistent remote access to infected hosts, facilitating comprehensive control including command execution, data exfiltration, and network traffic proxying. Its ability to evade detection by masquerading as legitimate NVIDIA software and use multiple communication channels increases its stealth and operational flexibility. The malware's persistence mechanisms and modular design allow sustained unauthorized access and potential lateral movement within targeted environments.

No official patch or remediation is available as this is malware rather than a software vulnerability. Mitigation should focus on detection and removal using updated endpoint protection solutions capable of identifying LabubaRAT indicators such as the provided hashes, IP addresses, and domains. Network monitoring for suspicious HTTPS polling, WebView2 communications, and DNS tunneling may aid detection. Since the malware uses user-level persistence via registry autoruns, reviewing and cleaning autorun entries is recommended. Organizations should verify the authenticity of NVIDIA software installations to prevent masquerading attacks. There is no indication that this malware is currently exploited in the wild, but vigilance is advised.