Loading story…
Researchers have identified LabubaRAT, a previously undocumented Rust-based remote access trojan that masquerades as NVIDIA software on Windows systems using an executable named nvidia-sysruntime.exe. The malware impersonates NVIDIA's container runtime toolkit to reduce suspicion, then establishes a flexible foothold by accepting command-and-control settings such as server address and polling interval at launch instead of hardcoding them into the binary.
LabubaRAT stores its configuration in a local SQLite database and profiles compromised hosts by collecting browser, security product, and system details to guide follow-on activity. The malware supports remote command execution, file transfer, screenshot capture, SOCKS5 proxying, and communications over HTTPS, WebView2, and DNS tunneling; researchers also linked its infrastructure to LabubaPanel branding and assessed that its reusable design may indicate a malware-as-a-service operation.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers identified a new Rust-based remote access trojan called LabubaRAT that masquerades as NVIDIA software using an executable named "nvidia-sysruntime.exe." Reporting said the malware supports host profiling, command execution, file transfer, screenshot capture, SOCKS5 proxying, and communications over HTTPS, WebView2, and DNS tunneling.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourceblackpointcyber.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have detailed a **PureRAT** campaign targeting Windows systems with a multi-stage, largely fileless infection chain that begins with a malicious `.lnk` shortcut. The shortcut launches PowerShell and an obfuscated VBScript loader, which retrieves a PNG image carrying a hidden Base64-encoded PE payload via steganography and loads it directly into memory. The malware then applies several defense-evasion techniques, including anti-analysis checks for **VMware** and **QEMU**, **UAC bypass** through `cmstp.exe`, and **process hollowing** into `msbuild.exe`, while additional components are protected with .NET Reactor and decrypted in memory with **TripleDES**. Once active, PureRAT fingerprints the infected host by collecting details on security tools, hardware, privileges, OS configuration, webcam presence, idle time, and possible cryptocurrency wallet artifacts, then connects to command-and-control infrastructure including `crixup[.]com` and `instantservices1[.]ddnsguru[.]com:1917` linked to `178[.]16[.]52[.]58`. Operators can deploy modular capabilities such as **keylogging**, **remote desktop access**, environmental monitoring, and broader remote control, while persistence is maintained through scheduled tasks and registry run keys. Published reporting and threat research describe the malware as a high-severity RAT and include indicators of compromise such as domains, an IP address, and multiple SHA-256 hashes to support detection and response.
Jun 29, 2026
Security researchers reported several unrelated **remote access trojan (RAT)** delivery campaigns using different initial access vectors and lures. Seqrite Labs described “**Operation Covert Access**,” a spear‑phishing operation targeting Argentina’s judiciary with a ZIP attachment containing a convincing court-resolution decoy; execution is triggered by a malicious `LNK` masquerading as a PDF, which launches hidden PowerShell to fetch additional stages from a GitHub repository, culminating in a custom **Rust-based RAT** that attempts to blend in by renaming itself (e.g., `msedge_proxy.exe`). Separately, AhnLab Security Intelligence Center reported South Korea-focused activity distributing **RemcosRAT** through illegal online gambling-related tools and trojanized *VeraCrypt* installers, using embedded malicious VBS scripts and a multi-stage chain that ultimately deploys a RAT capable of surveillance and data theft (e.g., keylogging, screenshot/webcam/mic capture, credential/data harvesting). Another campaign documented by ReliaQuest abused **LinkedIn private messages** to deliver a bundled legitimate application alongside a malicious DLL for **DLL sideloading**, enabling RAT deployment under the guise of a trusted process; the reporting emphasized that social platforms can serve as effective phishing channels beyond email and that the technique is portable to other commonly used business messaging platforms.
Jun 29, 2026
Researchers documented two separate but related **LNK-driven intrusion chains** that used shortcut files as the initial lure to fetch additional malware from attacker-controlled infrastructure. In one campaign targeting organizations in the **Arabian Gulf region**, a China-nexus threat actor used a Middle East conflict-themed ZIP archive containing an LNK file that downloaded a malicious CHM file and ultimately deployed a **PlugX** backdoor. The infection chain progressed through a second LNK, a TAR archive, DLL sideloading, and a shellcode loader before installing PlugX with persistence under a fake Microsoft Display Broker path and service name. The malware used RC4-encrypted components, API hooking, reflective DLL loading, corrupted PE headers, and support for **TCP, HTTPS, UDP, and DoH** communications, with a decrypted command-and-control endpoint at `91.193.17[.]117:443` and plugins for keylogging, shell access, screen capture, registry, service, and network operations. A second investigation exposed a live **LNK-to-DLL-to-.NET RAT** operation staged from an open Apache directory on `wildishadventure[.]com/secure9/` and `171.22.182[.]231/secure9/`, where researchers recovered weaponized LNK files, custom DLL downloaders, backup files, and a final payload named `RemoteMgmt.Agent.exe`. That chain abused the legacy `ActiveXObject('htmlfile')` technique to force Windows to retrieve DLLs over UNC paths, then delivered a custom .NET 4.8 remote access trojan that supported command execution, token-based authentication, JSON-over-raw-TCP C2 over port 443, reconnect-based persistence, and logging to `%TEMP%\rmgmt_agent.log`. Operational security failures including exposed directory indexing, `.old` backups, test builds, and unstripped internal names allowed investigators to reconstruct the malware’s development workflow and identify infrastructure spanning **BlueVPS**, **Namecheap**, and **Cloudflare**.
Jun 29, 2026