LabubaRAT Rust Malware Masquerades as NVIDIA Software to Backdoor Windows Systems

Gbhackers •Mayura Kathir • July 15, 2026

A previously undocumented Rust-based remote access trojan, dubbed LabubaRAT, which masquerades as legitimate NVIDIA software to establish persistent access on Windows systems. The malware was identified by the company’s Adversary Pursuit Group (APG) and appears designed as a reusable, panel-managed framework rather than a single-purpose payload. The observed sample, named nvidia-sysruntime.exe, impersonates an NVIDIA Container […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

LabubaRAT: New Rust-based RAT Masquerades as NVIDIA Software to Target Windows Systems A new remote access trojan (RAT) named LabubaRAT has been discovered, written in Rust and designed to impersonate NVIDIA software. The malware disguises itself as 'nvidia-sysruntime.exe' to evade detection and establish persistent access on Windows systems. It profiles the host to identify installed security products and gathers system information. LabubaRAT supports various communication methods, including HTTPS and DNS tunneling, making it resilient against disruption. Evidence suggests it may be offered as malware-as-a-service (MaaS). The malware was identified by multiple cybersecurity firms, including Blackpoint Cyber’s Adversary Pursuit Group (APG). As of now, there are no known patches or mitigations available. 5 sources 65

Extracted Entities

LabubaRAT Rust Malware Masquerades as NVIDIA Software to Backdoor Windows Systems

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)