Noodle RAT: A Recipe for Cross Platform Espionage

Introduction to Noodle RAT:

Noodle RAT, also known as ANGRYREBEL or Nood RAT, is a modular remote access trojan (RAT) with dual versions for Windows and Linux, actively used by Chinese-speaking threat actors since at least mid-2016. It was previously misclassified as variants of Gh0st RAT or Rekoobe but is now recognized as a unique backdoor family. Both editions show shared command-and-control (C2) architecture, similar configuration structures, and modular capabilities, reflecting a unified design approach across platforms.

Victimology of Noodle RAT:

Noodle RAT has been leveraged in espionage and cybercrime campaigns targeting entities across the Asia-Pacific region, notably in Thailand, India, Japan, Malaysia, and Taiwan. Groups like Iron Tiger, Calypso APT, Rocke, and Cloud Snooper have deployed it, indicating its appeal among both state-aligned and criminal operators.

Malware Toolset & TTPS of Noodle RAT:

Noodle RAT exhibits advanced capabilities:

• On Windows (Win.NOODLERAT), it operates as an in-memory, modular backdoor loaded via shellcode through loaders like MULTIDROP and MICROLOAD. It supports file upload/download, module execution, functioning as a TCP proxy, and self-deletion.
• The Linux variant (Linux.NOODLERAT) provides reverse shell, file management, task scheduling, and SOCKS tunneling, often installed post-exploit or webshell deployment against exposed Linux servers.
• Both variants use sophisticated encryption:
• Windows uses RC4, XOR, and custom algorithms for C2 traffic and configurations.
• Linux relies on HMAC-SHA1 and AES-128-CBC in its communication.

Further deep analysis reveals:

• Shared code segments with Gh0st RAT plugins (Windows) and Rekoobe / Tiny SHell (Linux), while still forming a distinct family.
• The availability of a builder control panel for Linux versions, with release notes in Simplified Chinese, suggests an actively maintained, possibly commercial malware toolkit.

About Check Point Exposure Management

Check Point Exposure Management is an intelligence-led, validation-driven, remediation-first unified platform that helps security teams move quickly and safely from exposure visibility to exposure reduction. Delivered through a single UI, it brings together threat intelligence, exposure prioritization, Agentic Exposure Validation, and safe remediation so teams can understand risk, prove exploitability, and act from one place.

Noodle RAT TTPs

Noodle RAT IOCs (Sample of 50)