LabubaRAT Malware Disguised as NVIDIA Software Targets Windows Systems

LabubaRAT Malware Disguised as NVIDIA Software Targets Windows Systems

What Happened — Researchers at Blackpoint Cyber uncovered a new Rust‑based remote‑access tool, LabubaRAT, that masquerades as an NVIDIA container‑runtime executable. The binary can be launched with a configurable, Base64‑encoded payload, connects to C2 over HTTPS, WebView2 or DNS tunneling, and provides full remote‑access capabilities (command execution, PowerShell, file transfer, screenshot capture, SOCKS5 proxy, and persistence via a Run‑key).

Why It Matters for Compliance & Audit Readiness

• The attack illustrates how malicious code can bypass traditional software‑inventory checks, stressing the need for SOC 2‑aligned access‑control policies and continuous endpoint monitoring.
• Evidence of control effectiveness (e.g., logs of executable hash verification, privileged‑access reviews) becomes critical audit artifacts to demonstrate that “least‑privilege” and “software‑origin verification” controls are operating.
• Security Awareness Training, a core SOC 2 control, helps users recognize spoofed binaries and reduces the likelihood of execution.

Who Is Affected — Any organization that runs Windows workstations or servers, especially those that allow users to download and execute third‑party utilities (technology, SaaS, finance, healthcare, etc.).

Recommended Actions

• Enforce strict application‑allow‑list policies (e.g., Windows Defender Application Control) and log hash‑based approvals.
• Integrate endpoint detection & response (EDR) telemetry into your continuous‑compliance dashboard to capture anomalous process launches and DNS‑tunneling activity.
• Refresh Security Awareness Training to include examples of masqueraded binaries and the importance of verifying publisher signatures.

Technical Notes

• LabubaRAT is delivered as an unsigned nvidia‑sysruntime.exe binary; it receives its C2 configuration at runtime via command‑line arguments or environment variables, enabling reuse of the same binary across campaigns.
• Communication channels: HTTPS polling, Microsoft Edge WebView2, and DNS tunneling; persistence via a Run‑key and local SQLite DB (nvctr_sys.db).

Source: Help Net Security