[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcyRYTc5fI5CYIu8D0qINs32cojKA1t52kOJCkbSJIzI":3},{"article":4,"iocs":45,"watch_terms":53,"solutions":54,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"bdf6cd1c-319c-414e-822b-2de5a07a2152","LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts","labubarat-masquerades-as-nvidia-software-to-control-windows-hosts-bb4925","Cybersecurity researchers have flagged a previously undocumented Rust-based remote access trojan (RAT) codenamed LabubaRAT that masquerades as NVIDIA software to blend into target environments. \"LabubaRAT creates a reusable foothold for hands-on activity,\" Blackpoint Cyber researchers Sam Decker and Nevan Beal said in an analysis published today. \"Once deployed, it can profile the host,","A new remote access trojan (RAT) named LabubaRAT, written in Rust, has been discovered impersonating NVIDIA software to infiltrate Windows systems. It functions as a malware-as-a-service, allowing attackers to profile hosts, execute commands, exfiltrate data, and proxy traffic. LabubaRAT employs multiple communication methods, including HTTPS, WebView2, and DNS tunneling, to maintain persistence and evade detection.","New Rust-based RAT, LabubaRAT, impersonates NVIDIA software to gain Windows host access.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Flabubarat-masquerades-as-nvidia.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjpSmSwv3hz6LMJIQCrVej_pophE9XNTZyveEV1GctCyQMSNoac_Mx3CfmAHLgYkpDkymvscLLY71u2Kq-7z-7bDemSeKHryPVH3h7FNxw9e64D3jTeoLOzmWW305j1Rctz5kdiwFV29lFNqo33TUZMGWCaZqtyKNPYARGtrrhZ0Bsc4LMLXhnRgzKXjKYb\u002Fs1600\u002FNVIDIA-rat.jpg","2026-07-14T16:52:37+00:00","2026-07-14T18:00:17.90458+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"nvidia-sysruntime.exe","product",{"name":21,"type":22},"NVIDIA","vendor",{"name":24,"type":25},"Rust","technology",{"name":27,"type":22},"Blackpoint Cyber",{"name":29,"type":19},"Google Chrome",{"name":31,"type":19},"Mozilla Firefox","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,40],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,50],{"type":47,"value":48,"context":49},"domain","pipicka[.]xyz","Command and control server domain",{"type":36,"value":51,"context":52},"LabubaRAT","Name of the remote access trojan",[21,27,18],{"controls":55,"vendors":139},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":86,"name":87,"problem":88,"products":89},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"slug":115,"name":116,"problem":117,"products":118},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[119,126,133],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":115,"product_name":123,"url":124,"description":125},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":127,"product_name":130,"url":131,"description":132},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":134,"product_name":135,"url":137,"description":138},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":155},"labubarat-disguises-itself-as-nvidia-software-to-hijack-windows-systems","LabubaRAT Disguises Itself as NVIDIA Software to Hijack Windows Systems","LabubaRAT exploits users' trust in legitimate software brands like NVIDIA to trick victims into executing a malicious remote access trojan. By masquerading as trusted software, attackers bypass user skepticism and potentially weak application controls, gaining full command-and-control over compromised hosts. The malware's use of multiple evasion techniques — including DNS tunneling, HTTPS, and WebView2 — makes it difficult to detect with standard security tools. This highlights how social engineering combined with advanced obfuscation can render both users and security tooling ineffective if not properly configured and trained against such threats.",[145,146,147,148,149,150,151,152,153,154],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AT-2: Security Awareness Training","NIST SP 800-53 AU-12: Audit Record Generation","MITRE ATT&CK T1036: Masquerading","MITRE ATT&CK T1071.004: DNS Application Layer Protocol","MITRE ATT&CK T1059: Command and Scripting Interpreter",{}]