Back Feeds.4Sysops

LabubaRAT malware masquerades as NVIDIA software to target Windows systems

Feeds.4Sysops •IT News • July 14, 2026

A newly discovered Rust-based remote access trojan named LabubaRAT is targeting Windows environments by impersonating legitimate NVIDIA system components. The malware uses the filename nvidia-sysruntime.exe and includes NVIDIA-themed metadata to evade detection by administrators and security tools. This implant functions as a comprehensive framework for persistent access, allowing attackers to profile hosts and identify installed security products. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

LabubaRAT: New Rust-based RAT Masquerades as NVIDIA Software to Target Windows Systems A new remote access trojan (RAT) named LabubaRAT has been discovered, written in Rust and designed to impersonate NVIDIA software. The malware disguises itself as 'nvidia-sysruntime.exe' to evade detection and establish persistent access on Windows systems. It profiles the host to identify installed security products and gathers system information. LabubaRAT supports various communication methods, including HTTPS and DNS tunneling, making it resilient against disruption. Evidence suggests it may be offered as malware-as-a-service (MaaS). The malware was identified by multiple cybersecurity firms, including Blackpoint Cyber’s Adversary Pursuit Group (APG). As of now, there are no known patches or mitigations available. 5 sources 65

Extracted Entities

LabubaRAT malware masquerades as NVIDIA software to target Windows systems

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)