Noodle RAT Malware Targets Windows, Linux Systems for Remote Control

Key Takeaways

• Noodle RAT is a sophisticated remote access trojan capable of infecting both Windows and Linux systems.
• This cross-platform capability allows attackers to maintain persistence and pivot across diverse corporate network environments.
• The malware has been observed targeting organizations across the Asia-Pacific region, including Thailand, India, Japan, Malaysia, and Taiwan.
• Noodle RAT, also known as ANGRYREBEL and Nood RAT, has been linked to Chinese-speaking threat actors since at least mid-2016.
• Effective defense requires comprehensive patching, robust account security, and vigilant monitoring for unusual network activity.

A persistent remote access trojan (RAT) known as Noodle RAT has re-emerged as a significant threat, demonstrating its ability to compromise both Windows and Linux operating systems. This dual-platform functionality is particularly concerning as it enables attackers to traverse and control diverse IT infrastructures, extending the reach of an initial breach across an entire network.

Operations involving Noodle RAT have been detected against various organizations throughout the Asia-Pacific region, specifically in countries such as Thailand, India, Japan, Malaysia, and Taiwan. Once established, the malware grants its operators extensive control, allowing them to exfiltrate sensitive files, execute arbitrary commands, and establish proxy connections through compromised systems. This capability transforms an isolated infection into a broader security risk, facilitating deeper network penetration.

Security researchers at Check Point have definitively identified Noodle RAT as a distinct malware family, differentiating it from similar threats like Gh0st RAT or Rekoobe. The malware, also referred to as ANGRYREBEL and Nood RAT, has been active since at least the middle of 2016, with its origins attributed to Chinese-speaking threat groups. Check Point said in a report that threat actors leverage malicious links and compromised legitimate accounts to target Windows users. In the case of Linux, vulnerable servers are typically infected after successful exploitation or the deployment of web shells. Mitigating the impact of such attacks fundamentally relies on diligent patching, strong account protection, and proactive server monitoring.

Cross-Platform Capabilities of Noodle RAT

While Noodle RAT employs different functionalities tailored to each operating system, it maintains a consistent command-and-control (C2) architecture. This unified design simplifies the management of infections across hybrid IT environments.

Windows Variant: Win.NOODLERAT

On Windows systems, Win.NOODLERAT operates as a modular backdoor. It often loads directly into memory via shellcode, utilizing loaders such as MULTIDROP and MICROLOAD to minimize its footprint and evade detection by reducing the number of visible files on disk.

Once activated, the Windows component of Noodle RAT can perform a range of malicious activities. These include uploading and downloading files, deploying additional malicious modules, functioning as a TCP proxy, and self-deletion to erase traces. These capabilities allow attackers to gather intelligence and gain access to further network resources, a common tactic observed in other cross-platform RAT campaigns.

Linux Variant: Linux.NOODLERAT

Conversely, Linux.NOODLERAT is specifically engineered for server environments. Its capabilities include establishing reverse shells, managing files, scheduling tasks, and creating SOCKS tunnels for relaying network traffic. Researchers indicate that this variant frequently follows the exploitation of exposed Linux servers or the prior deployment of web shells, aligning with patterns seen in fileless Linux web shell investigations.

Both the Windows and Linux versions of Noodle RAT incorporate robust encryption mechanisms to secure their communications, making simple inspection difficult. The Windows variant employs a combination of RC4, XOR, and custom encryption, while the Linux version utilizes HMAC-SHA1 and AES-128-CBC. The presence of unusual encrypted outbound network sessions, especially when correlated with suspicious process or user account behavior, should trigger immediate investigation.

Campaign Reach and Defense Strategies

The widespread victimology associated with Noodle RAT underscores its broad appeal and highlights that it is not confined to a single operating system. Various threat groups, including Iron Tiger, Calypso APT, Rocke, and Cloud Snooper, have been observed deploying Noodle RAT. This suggests that the toolkit is attractive to both state-sponsored actors and financially motivated cybercriminals.

Evidence, such as the Linux builder’s control panel and release notes in Simplified Chinese, indicates ongoing development and potentially points to Noodle RAT being a commercially available toolkit. Despite some shared code with Gh0st RAT plugins on Windows and with Rekoobe or Tiny SHell on Linux, researchers maintain that Noodle RAT is a distinct and independent backdoor family.

The malware’s attack techniques encompass data collection and exfiltration via C2 channels, system and file discovery, exploitation of unsecured credentials, masquerading, and obfuscation. It achieves persistence on Windows through Registry Run keys, startup folders, and scheduled tasks, and on Linux via RC scripts and scheduled tasks.

Initial access vectors for Noodle RAT demand heightened vigilance at network perimeters and on endpoints. Common entry methods include the exploitation of public-facing applications, the use of malicious links, and the compromise of legitimate user accounts. It is imperative for administrators to promptly patch all internet-facing services, minimize unnecessary network exposure, and thoroughly investigate any detected web shells, as reinforced by recent reports on Windows and Linux server exploitation.

The unified design of Noodle RAT, despite its platform-specific implementations, serves as a critical reminder for organizations managing mixed operating system environments. Consistent visibility across all systems is crucial, particularly because a compromised server can act as a pivotal stepping stone into the broader corporate network.

Security teams must prioritize the correlation of various indicators. While a suspicious link or an exploited application might be the initial point of entry, subsequent clues can manifest in encrypted network traffic, unexpected proxy activity, or scheduled task alterations. Reviewing the following indicators of compromise (IoCs) in conjunction with endpoint and server telemetry can significantly aid in identifying potential Noodle RAT activity and expediting incident response.

What You Should Do

• Patch Immediately: Ensure all public-facing applications and operating systems are updated with the latest security patches to mitigate known vulnerabilities.
• Strengthen Account Security: Implement multi-factor authentication (MFA) across all accounts, especially for privileged access. Regularly review and revoke access for dormant or unnecessary accounts.
• Monitor Network Traffic: Scrutinize outbound network connections for unusual patterns, particularly encrypted sessions originating from unexpected processes or users.
• Audit Scheduled Tasks and Startup Items: Regularly review scheduled tasks and startup configurations on both Windows and Linux systems for unauthorized entries.
• Isolate Critical Assets: Segment critical servers and sensitive data repositories from general user networks to limit lateral movement in case of a breach.
• Maintain Backups: Implement and regularly test comprehensive backup and recovery procedures to minimize data loss and downtime from successful attacks.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.