LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts

Blackpoint Cyber researchers describe LabubaRAT, a Rust-based remote access trojan masquerading as an NVIDIA container runtime (nvidia-sysruntime.exe). The sample accepts runtime configuration (including a Base64 option) rather than hard-coded C2, stores settings in SQLite, inventories browsers and security products, and supports HTTPS, WebView2 and DNS tunneling. Its capabilities include command/PowerShell/JS execution, file upload/download, screenshot capture, archive handling, and SOCKS5 proxying; operators can reuse the same binary across different infrastructures, and an example C2 domain observed is "pipicka.xyz".