LabubaRAT ZM_ Environment Variable C2 Configuration

Duo Tech@duotech

•updated Jul 17, 2026•1•0•2

This rule detects command line execution containing environment variable keys associated with the LabubaRAT malware family (e.g., ZM_ORG, ZM_KEY, ZM_SERVER). These variables are used to configure the malware's communication parameters, polling intervals, and C2 server settings during its execution.