LabubaRAT Threat Snapshot

LabubaRAT is a custom 64-bit Rust-based remote access trojan targeting Windows systems. It masquerades as legitimate NVIDIA software to evade detection and offers extensive remote control capabilities including command execution, file operations, screen capture, and SOCKS5 proxying. The malware is part of a malware-as-a-service framework managed via a backend called LabubaPanel hosted on German infrastructure. It uses its own JavaScript execution for delivery and employs evasion techniques such as impersonation of NVIDIA components and abuse of Microsoft build utilities. First observed in July 2026, it is unsigned and designed for persistence and stealth.

• LabubaRAT: A Rust Based Remote Access Tool Masquerading as NVIDIA SoftwareMalware2026-07-14