Executive Summary
Blackpoint Cyber's Adversary Pursuit Group (APG) has identified LabubaRAT, an undocumented Rust-based malware designed as a reusable access framework. The malware employs sophisticated masquerading techniques by using NVIDIA Corporation metadata, runtime naming conventions, and themed mutexes to blend into legitimate Windows environments. Its architecture suggests a Malware-as-a-Service (MaaS) model, accepting modular configuration parameters for different organizations and campaigns at runtime.
Technically, LabubaRAT is highly versatile, supporting three distinct communication paths: standard HTTPS polling, WebView2-based communication, and DNS tunneling for fallback. Once established, the implant provides comprehensive remote access capabilities, including shell execution (CMD and PowerShell), JavaScript execution via temporary files, screenshot capture, file manipulation, and SOCKS5 proxy relay functionality.
The discovery of LabubaPanel C2 infrastructure and associated German-hosted IP addresses indicates a coordinated rollout. This threat represents a significant risk due to its ability to bypass standard security controls through its multi-transport communication model and its detailed profiling of installed security software to inform attacker tasking.