Noodle RAT

Mentions · 7d0
Mentions · 30d0
All mentions3
First seenAug 27, 2026
Last mentionedSep 16, 2026

Timeline

3 articles · newest first

Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems

Check Point identifies Noodle RAT as a distinct cross-platform Windows/Linux backdoor used by Chinese-speaking actors against Asia-Pacific organizations since 2016.

Cyber Security NewsSep 16, 14:03 UTC · Sep 16, 2026MalwareExploited6 · 2 reads

Chinese-Speaking Hackers Use Noodle RAT Backdoor to Spy on Windows and Linux Systems

Chinese-speaking actors use cross-platform Noodle RAT backdoor to maintain covert access to Windows and Linux systems across Asia-Pacific.

GBHackersSep 16, 12:28 UTC · Sep 16, 2026MalwareExploited2 · 1 read

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Cisco Talos exposes UAT-10147, a Chinese-speaking group using AI tools to automate intrusions, deploy SPECTRE, BadIIS, and rootkits against web servers worldwide.

The Hacker NewsAug 27, 18:33 UTC · Aug 27, 2026Threat actorExploitedCVE-2022-0995 CVE-2021-3156 CVE-2015-5287+87

Related CVEs

by mentions

CVE-2019-18935100%9.8
Unauthenticated .NET Deserialization RCE in Progress Telerik UI for ASP.NET AJAX
published Dec 11, 2019Telerik (Progress) UI for ASP.NET AJAXKEVRansomwarePoC ×4
CVE-2021-2375883%9.8
Unauthenticated .NET Deserialization RCE in Ajax.NET Professional (ajaxpro.2)
published Dec 3, 2021michaelschwarz (ajaxpro.2 project) ajaxpro.2 (package)KEVPoC ×2
CVE-2022-09959%7.8
Out-of-Bounds Write in Linux Kernel watch_queue Enables Local Privilege Escalation
published Mar 25, 2022Linux kernelKEVPoC ×2
CVE-2021-3156100%7.8
Heap-Based Buffer Overflow in Sudo Enables Local Privilege Escalation (CVE-2021-3156)
published Jan 26, 2021SudoKEVPoC ×12
CVE-2022-084793%7.8
Local Privilege Escalation ('Dirty Pipe') in the Linux Kernel
published Mar 10, 2022Linux KernelKEVPoC ×4
CVE-2015-32469%7.4
Race Condition in Red Hat libuser Allows Local Privilege Escalation
published Aug 11, 2015Red Hat libuserKEVPoC
CVE-2022-2792599%7.2
Authenticated Path Traversal File Upload Leading to RCE in Zimbra Collaboration Suite
published Apr 21, 2022Synacor Zimbra Collaboration Suite (ZCS)KEVRansomwarePoC
CVE-2015-52875%—
Local Privilege Escalation via Symlink Attack in Red Hat ABRT
published —Red Hat Automatic Bug Reporting Tool (ABRT)KEV
CVE-2021-2944183%9.8
Nacos: When configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce…
published Apr 27, 2021alibaba nacosPoC ×2
CVE-2021-2944266%7.5
Nacos: The ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the…
published Apr 27, 2021alibaba nacosPoC ×2

Appears with

Iron Tigerthreat actor · 2
MICROLOADmalware · 2
MULTIDROPmalware · 2
Noodle RATproduct · 2
Calypso APTthreat actor · 2
Cisco Talosvendor · 1
Check Pointorganization · 1
PentestGPTmalware · 1
DeepAuditmalware · 1
Cloud Snooperthreat actor · 1
Rekoobeproduct · 1
EfsPotatomalware · 1
Cyberintorganization · 1
Gh0stCringemalware · 1
Rockethreat actor · 1
Trend Microvendor · 1

Entities are extracted by the model from each article. First seen Aug 27, 2026, last mentioned Sep 16, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.