Back to Intelligence

LabubaRAT Rust-Based RAT + PolinRider Supply Chain Infostealer: OTX Pulse Analysis — Enterprise Detection Pack

SA
Security Arsenal Team
October 18, 2026
10 min read

Threat Summary

Two distinct but equally concerning campaigns surfaced in today's OTX telemetry, and both share a common thread: abuse of trusted software supply channels and legitimate-appearing binaries to bypass perimeter defenses.

LabubaRAT (Blackpoint discovery) is a custom, unsigned 64-bit remote access trojan written in Rust. It masquerades as legitimate NVIDIA software — a classic trojanization play targeting environments where NVIDIA drivers, CUDA toolkits, or GPU management utilities are commonplace (developer workstations, ML/AI infrastructure, gaming/media production, engineering). Once enrolled, LabubaRAT provides operators with full remote access: command execution, file operations, screen capture, and SOCKS5 proxying — the latter effectively turning victim machines into anonymization relays for follow-on activity. Its configurable enrollment fields and an internal ZM_ configuration namespace indicate this is a Malware-as-a-Service (MaaS) framework, meaning multiple criminal operators are likely deploying it with per-customer configurations. Attribution remains unknown, but the MaaS economics mean volume will increase.

PolinRider (Socket.dev discovery) is a supply chain infostealer campaign in which operators compromised a legitimate GitHub account and inserted malicious code into development versions of visanduma/nova-two-factor — a Packagist package with over 700,000 downloads. The tradecraft is notable: Git history rewriting to conceal the malicious commits, and payload staging across multiple ecosystems (npm, PyPI, Go modules, Packagist, Chrome extensions). This is a developer-targeting operation whose objective is credential and secret theft at scale — harvesting tokens, API keys, SSH keys, and session material from build machines and developer endpoints, which then enables lateral movement into production environments.

Collective read: defenders face simultaneous pressure on two flanks — end-user workstations (trojanized NVIDIA-themed binaries) and the software build pipeline (poisoned package dependencies). Both campaigns exploit trust in legitimate software provenance, which is precisely what traditional signature- and reputation-based controls fail to catch.

Threat Actor / Malware Profile

LabubaRAT

  • Distribution method: Masquerades as NVIDIA software (fake installers/updaters), likely delivered via malvertising, SEO poisoning, or bundled downloads. Unsigned 64-bit Windows binaries.
  • Payload behavior: Full RAT capability set — remote command execution, file upload/download, screen capture, and SOCKS5 proxying. The proxy capability is a strong indicator of intent to use victims as operational infrastructure.
  • C2 communication: Observed beaconing to pipicka.xyz. Configurable enrollment fields suggest a registration handshake that fingerprints the victim (hostname, OS, operator ID) before tasking begins.
  • Persistence mechanism: Not fully documented in the pulse, but Rust RATs of this class typically use Run keys, scheduled tasks, or service installation. Hunt broadly (see detection section).
  • Anti-analysis techniques: Rust compilation is itself an evasion advantage — large binaries, unfamiliar structure for analysts, poor signature coverage, and limited YARA rule maturity compared to C/C++ malware. The ZM_ config namespace suggests obfuscated or structured embedded configuration that requires extraction tooling.

PolinRider

  • Distribution method: Compromised maintainer GitHub accounts; malicious code committed to dev branches of legitimate packages, concealed via Git history rewriting (force-push / rebase to erase evidence). Propagates when developers pull dependencies via Composer/Packagist and, per the campaign's broader footprint, npm, PyPI, and Go modules.
  • Payload behavior: Infostealer staging — payload fragments pulled at install or runtime, targeting stored credentials, browser sessions, environment variables (CI/CD secrets), and developer tokens.
  • C2 communication: Payload staging via attacker-controlled infrastructure; IOC set is hash-heavy (5 SHA-256s), indicating rapidly mutating payloads rather than static C2 domains.
  • Persistence mechanism: None required in the classic sense — the compromised package itself is re-executed with every build, deploy, or composer install. The dependency is the persistence.
  • Anti-analysis techniques: Git history rewriting defeats naive repo auditing; malicious code inserted only into development versions delays detection because production pins and lockfiles often lag dev branches.

IOC Analysis

The indicator set splits cleanly by campaign and demands different operationalization strategies:

File hashes (1 MD5, 6 SHA-256): These are point-in-time artifacts. Push all SHA-256 values to your EDR blocklist and MD5/SHA-256 to any email gateway and proxy that supports hash-based blocking (limited utility there — hashes matter most at the endpoint). For PolinRider, the five SHA-256s represent mutating payloads; expect low detection half-life. Use them for retrospective hunting (did any endpoint ever execute these?) rather than forward-looking blocking alone.

Domain (pipicka.xyz): The LabubaRAT C2. This is your highest-fidelity network indicator. Block at DNS (RPZ/sinkhole), egress proxy, and firewall. A recently-registered, low-reputation .xyz domain should also trigger alerting on any resolution — legitimate business traffic to this domain is essentially nil.

Operational tooling:

  • Hash lookups/enrichment: VirusTotal, Hybrid Analysis, OTX itself for pulse context.
  • Rust binary triage: pestudio, Detect-It-Easy (compiler fingerprinting), strings extraction hunting for ZM_ namespace artifacts.
  • Domain intel: WHOIS/registration age lookup, passive DNS (RiskIQ/SecurityTrails/VirusTotal PDNS) to find historical resolutions and co-hosted infrastructure.
  • Supply chain verification: composer audit, npm audit, Socket.dev scanning, and lockfile diffing against known-good package hashes.

Detection Engineering

YAML
---
title: LabubaRAT Rust RAT Execution Masquerading as NVIDIA Software
description: Detects execution of unsigned binaries using NVIDIA-themed names or paths, consistent with LabubaRAT trojanization tradecraft. LabubaRAT is a 64-bit Rust RAT masquerading as legitimate NVIDIA software.
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|contains:
      - '\nvidia'
      - '\NVIDIA\'
      - '\cuda'
      - '\nvcontainer'
  selection_unsigned:
    Signed: 'false'
  filter_legit_paths:
    Image|startswith:
      - 'C:\Program Files\NVIDIA Corporation\'
      - 'C:\Program Files\NVIDIA GPU Computing Toolkit\'
      - 'C:\Windows\System32\DriverStore\'
  condition: selection_name and selection_unsigned and not filter_legit_paths
falsepositives:
  - Community CUDA builds or developer-compiled NVIDIA tooling in nonstandard paths
level: high
tags:
  - attack.defense_evasion
  - attack.t1036
date: 2026/10/18
---
title: LabubaRAT C2 Beacon to pipicka.xyz
description: Detects DNS resolution or network connection to the known LabubaRAT command-and-control domain pipicka.xyz, which provides SOCKS5 proxying and remote tasking.
logsource:
  category: dns
  product: windows
detection:
  selection:
    QueryName|contains:
      - 'pipicka.xyz'
  condition: selection
falsepositives:
  - Security researchers performing intentional lookups
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
date: 2026/10/18
---
title: PolinRider Supply Chain Payload - Composer Install Spawning Suspicious Child Process
description: Detects PHP/Composer package installation spawning script interpreters or network-capable tools, consistent with PolinRider malicious code execution during dependency resolution in Packagist-compromised packages such as visanduma/nova-two-factor.
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\composer.bat'
      - '\composer.phar'
      - '\php.exe'
      - '\npm.exe'
      - '\node.exe'
      - '\pip.exe'
      - '\python.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\certutil.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate post-install scripts in packages; baseline your build environment and tune by CommandLine
level: high
tags:
  - attack.initial_access
  - attack.t1195.001
  - attack.execution
  - attack.t1059
date: 2026/10/18
KQL — Microsoft Sentinel / Defender
// LabubaRAT + PolinRider combined hunt: C2 beaconing, known payload hashes,
// and package-manager-spawned suspicious child processes (last 7 days)
let C2Domain = "pipicka.xyz";
let Hashes = dynamic(["b7443b0ab48d2f5786d1b6f3a580f02621e9ae5a3877ee3a44e01df13d984328",
  "7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9",
  "b7ede935d4979146b55f12b9eec7c83b61962b478f5dc9b8db251e539ec2abd3",
  "ccb187dc9de0cc7477c9817ae53365d273e121407c0305f863e2ab67c35d6395",
  "139ea03dcddf4aa810d55740be3cf6c92ce7a9f3cbcbbb35440e25b769a87683",
  "515a53291d25d229e1f9fa72e66407e1cfd7e77c91478400b24d5185af68531a"]);
let NetHits = DeviceNetworkEvents
  | where TimeGenerated > ago(7d)
  | where RemoteUrl contains C2Domain
  | summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName;
let HashHits = DeviceProcessEvents
  | where TimeGenerated > ago(7d)
  | where SHA256 in~ (Hashes)
  | summarize Executions=count(), FirstSeen=min(TimeGenerated) by DeviceName, FileName, SHA256, FolderPath;
let SupplyChainHits = DeviceProcessEvents
  | where TimeGenerated > ago(7d)
  | where InitiatingProcessFileName in~ ("composer.bat", "composer.phar", "php.exe", "npm.exe", "node.exe", "pip.exe", "python.exe")
  | where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "curl.exe", "wget.exe", "certutil.exe", "mshta.exe", "rundll32.exe")
  | summarize Count=count(), FirstSeen=min(TimeGenerated) by DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
  | order by FirstSeen desc;
union NetHits, HashHits, SupplyChainHits
PowerShell
# LabubaRAT + PolinRider IOC hunt script — run elevated on endpoints or via RMM/EDR scripting
$ErrorActionPreference = 'SilentlyContinue'
$results = @()

# --- 1. Known malicious file hashes ---
$hashes = @(
  'b7443b0ab48d2f5786d1b6f3a580f02621e9ae5a3877ee3a44e01df13d984328',
  '7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9',
  'b7ede935d4979146b55f12b9eec7c83b61962b478f5dc9b8db251e539ec2abd3',
  'ccb187dc9de0cc7477c9817ae53365d273e121407c0305f863e2ab67c35d6395',
  '139ea03dcddf4aa810d55740be3cf6c92ce7a9f3cbcbbb35440e25b769a87683',
  '515a53291d25d229e1f9fa72e66407e1cfd7e77c91478400b24d5185af68531a'
)
$searchPaths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA", "$env:USERPROFILE\Downloads", "C:\ProgramData")
foreach ($p in $searchPaths) {
  Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
    if ($hashes -contains $h) {
      $results += [pscustomobject]@{Type='MaliciousHash'; Path=$_.FullName; Detail=$h}
    }
  }
}

# --- 2. Unsigned NVIDIA-themed executables in nonstandard paths (LabubaRAT masquerade) ---
$nvSuspects = Get-ChildItem -Path "$env:APPDATA","$env:LOCALAPPDATA","$env:TEMP","$env:USERPROFILE\Downloads","C:\ProgramData" -Recurse -File -Include '*nvidia*','*nvcontainer*','*cuda*' -ErrorAction SilentlyContinue
foreach ($f in $nvSuspects) {
  $sig = Get-AuthenticodeSignature $f.FullName
  if ($sig.Status -ne 'Valid') {
    $results += [pscustomobject]@{Type='UnsignedNvidiaMasquerade'; Path=$f.FullName; Detail=$sig.Status}
  }
}

# --- 3. Persistence artifacts: Run keys and scheduled tasks referencing suspicious paths ---
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($rk in $runKeys) {
  Get-ItemProperty $rk | ForEach-Object {
    $_.PSObject.Properties | Where-Object { $_.Value -match 'nvidia|cuda|Temp|AppData' } | ForEach-Object {
      $results += [pscustomobject]@{Type='SuspiciousRunKey'; Path=$rk; Detail="$($_.Name) = $($_.Value)"}
    }
  }
}
Get-ScheduledTask | Where-Object { ($_.Actions.Execute -match 'Temp|AppData') -and ($_.TaskName -match 'nv|upd|svc') } | ForEach-Object {
  $results += [pscustomobject]@{Type='SuspiciousScheduledTask'; Path=$_.TaskName; Detail=$_.Actions.Execute}
}

# --- 4. Active or recent connections to LabubaRAT C2 ---
$c2 = Resolve-DnsName 'pipicka.xyz' -ErrorAction SilentlyContinue
if ($c2) {
  foreach ($ip in ($c2 | Where-Object {$_.IPAddress}).IPAddress) {
    $conns = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq $ip }
    foreach ($c in $conns) {
      $proc = (Get-Process -Id $c.OwningProcess).ProcessName
      $results += [pscustomobject]@{Type='C2Connection'; Path=$proc; Detail="$($c.LocalAddress):$($c.LocalPort) -> $ip:$($c.RemotePort) [$($c.State)]"}
    }
  }
}

# --- 5. PolinRider: check for compromised Packagist package in vendor dirs ---
Get-ChildItem -Path "C:\","$env:USERPROFILE" -Recurse -Directory -Filter 'nova-two-factor' -ErrorAction SilentlyContinue | ForEach-Object {
  $results += [pscustomobject]@{Type='PolinRiderPackage'; Path=$_.FullName; Detail='visanduma/nova-two-factor present — verify version against known-good lockfile'}
}

if ($results.Count -gt 0) { $results | Format-Table -AutoSize; $results | Export-Csv "$env:TEMP\ioc_hunt_results.csv" -NoTypeInformation }
else { Write-Output "[+] No indicators found on this host." }

Response Priorities

Immediate (0–4 hours)

  • Block pipicka.xyz at DNS (sinkhole), web proxy, and egress firewall; alert on any historical resolution in the last 30 days via DNS logs.
  • Push all six SHA-256 hashes and the MD5 to the EDR blocklist; run the PowerShell hunt script (or equivalent EDR sweep) across endpoints, prioritizing developer workstations and any machine with NVIDIA drivers/GPU workloads.
  • Freeze new installs/updates of visanduma/nova-two-factor; query artifact repositories and lockfiles for any pull of the package in the last 14 days.
  • Isolate any host with a confirmed hash hit or C2 connection; capture memory before remediation (Rust RAT config may only be resident in memory).

24 Hours (Credential & Identity Response)

  • PolinRider is credential-stealing malware. Any developer or CI/CD system that installed a compromised package version must be treated as fully compromised: rotate all credentials, tokens, and secrets present on that machine — GitHub PATs, SSH keys, cloud API keys, npm/PyPI/Packagist tokens, browser-stored passwords, and CI/CD environment variables.
  • Audit GitHub/GitLab audit logs for any organization accounts showing anomalous pushes, force-pushes, or history rewrites — PolinRider's own entry vector was a compromised maintainer account.
  • Review IdP sign-in logs for sessions originating from unusual ASNs (LabubaRAT's SOCKS5 proxying means stolen sessions may replay from victim IPs — flag impossible-travel and residential-proxy sign-ins).
  • Enforce phishing-resistant MFA (FIDO2) on all developer accounts if not already in place.

1 Week (Architecture Hardening)

  • Software supply chain controls: pin dependencies with lockfiles and hash verification (composer.lock integrity checks, npm ci with --ignore-scripts where feasible); deploy a dependency firewall/proxy (e.g., Socket, JFrog Xray, Nexus Firewall) that blocks packages on behavioral analysis rather than CVE data alone.
  • Build isolation: run dependency installation and builds in ephemeral, credential-scoped containers; never expose production secrets to dev-branch builds.
  • Application control: enforce code-signing policy (WDAC/AppLocker) blocking unsigned executables in user-writable directories — directly counters LabubaRAT's unsigned-binary masquerade.
  • Egress control: default-deny outbound for server/build segments; alert on any new low-reputation domain resolution across the fleet (TLD-level heuristics for .xyz and similar from non-browser processes).
  • Git integrity monitoring: alert on force-pushes and history rewrites to protected repositories across the organization.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

darkwebotx-pulsedarkweb-aptlabubaratpolinridersupply-chain-attackrust-ratinfostealer

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action