LabubaRAT ZM_-Prefixed Environment Variable Configuration

Kaung Khant Ko@kaungkhantko

•updated Jul 15, 2026•1•0•3

This rule detects the execution of processes containing environment variables prefixed with 'ZM_' (e.g., ZM_SERVER, ZM_ORG, ZM_KEY, ZM_GROUP, ZM_DEVICE_NAME). These specific environment variables are characteristic of the LabubaRAT malware family, which utilizes them for C2 configuration and device identification during process startup.