LabubaRAT File Deletion or Directory Creation via nvidia-sysruntime.exe

Duo Tech@duotech

•updated Jul 17, 2026•1•0•1

Detects file creation or deletion activity performed by nvidia-sysruntime.exe, the process name used by LabubaRAT, consistent with its RAT tasking module supporting delete and mkdir actions on the local filesystem.