LabubaRAT is a custom, unsigned 64-bit Rust-based remote access trojan identified by Blackpoint. It impersonates NVIDIA software to evade detection and provides comprehensive remote access features including command execution, file manipulation, screen capture, and SOCKS5 proxying. The malware includes configurable enrollment fields and an internal configuration namespace, indicating a reusable, multi-tenant malware-as-a-service framework. It is controlled through a backend infrastructure named LabubaPanel, hosted on German providers. The RAT uses its own JavaScript execution for delivery and employs evasion tactics such as masquerading as NVIDIA components and abusing legitimate Microsoft build utilities. It targets Windows operating systems and was first observed in July 2026.

LabubaRAT enables attackers to gain persistent and comprehensive remote control over infected Windows systems. Its capabilities include executing arbitrary commands, manipulating files, capturing the screen, and proxying network traffic via SOCKS5, which can facilitate further network intrusion or data exfiltration. The malware’s evasion techniques and masquerading increase the likelihood of successful infection and persistence. Being part of a malware-as-a-service framework suggests potential widespread distribution and use by multiple threat actors.

No official patch or remediation is available as this is malware rather than a software vulnerability. Mitigation should focus on detection and removal using updated endpoint protection solutions capable of identifying LabubaRAT indicators such as the provided hashes, IP addresses, and domains. Network defenses should monitor for communications with the known LabubaPanel infrastructure. Users should be cautious of software masquerading as NVIDIA components and avoid executing untrusted JavaScript code. Regular threat intelligence updates and endpoint monitoring are recommended to detect and respond to infections.