Chinese-Speaking Hackers Use Noodle RAT Backdoor to Spy on Windows and Linux Systems
Chinese-speaking actors use cross-platform Noodle RAT backdoor to maintain covert access to Windows and Linux systems across Asia-Pacific.
Noodle RAT (also ANGYREBEL/Nood RAT) has been active since at least mid-2016 and was long misidentified as Gh0st RAT or Rekoobe variants until Trend Micro and Cyberint classified it as a distinct multi-platform family. The Windows build (Win.NOODLERAT) is an in-memory modular shellcode backdoor delivered via MULTIDROP and MICROLOAD loaders, while the Linux build supports reverse shells, SOCKS tunneling, and cron persistence after web shell or public-facing service exploitation. It has appeared in intrusions in Thailand, India, Japan, Malaysia, and Taiwan and is linked to Iron Tiger, Calypso APT, Rocke, and Cloud Snooper campaigns spanning espionage and cybercrime. Recently discovered Linux builders 1.0.1 and 1.0.2 indicate the toolkit remains actively maintained.
- Windows build is a modular in-memory shellcode backdoor; Linux build offers reverse shells and SOCKS tunneling
- Linked to Iron Tiger, Calypso APT, Rocke, and Cloud Snooper campaigns across espionage and crime
- Linux builders 1.0.1 and 1.0.2 and Simplified Chinese release notes indicate active maintenance
- C2 traffic uses RC4, XOR, HMAC-SHA1, and AES-128-CBC across TCP, SSL, or HTTP
- Defenders urged to hunt web shells, cron persistence, and unexpected Oleview.exe execution
- ATT&CK
- T1505.003 Web ShellT1053.003 CronT1090 ProxyT1036.005 Match Legitimate Name or LocationT1219 Remote Access Software
- Vendors
- Trend Micro
- Products
- Noodle RAT
- Threat actors
- Iron TigerCalypso APT
- Malware
- Noodle RATMULTIDROPMICROLOAD
- Organizations
- Cyberint
From the original article
3 min read at gbhackers.com
Chinese-speaking threat actors are continuing to rely on Noodle RAT, a cross-platform remote access trojan designed to maintain covert access to compromised Windows workstations and Linux servers. Also tracked as ANGRYREBEL and Nood RAT, the malware has been active since at least mid-2016 but was long mistaken for variants of Gh0st RAT, Rekoobe, and other […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.