Hackers Exploit Cross-Platform Noodle RAT for Hidden Access to Windows and Linux Machines

Noodle RAT is a remote access trojan (RAT) that allows threat actors to take control of compromised computers and servers. Its growing prominence stems from its ability to operate across both Windows and Linux platforms, enabling attackers to maintain access as they move through diverse enterprise environments.

The malware has been observed in attacks targeting organizations throughout the Asia-Pacific region, including Thailand, India, Japan, Malaysia, and Taiwan. Once deployed, Noodle RAT can steal files, execute commands remotely, and tunnel network traffic through infected systems, allowing attackers to expand an initial compromise into a broader network intrusion.

Researchers at Check Point have classified Noodle RAT as a distinct malware family rather than a variant of the well-known Gh0st RAT or Rekoobe malware. Also referred to as ANGRYREBEL and Nood RAT, the tool has been associated with Chinese-speaking threat actors since at least 2016.

According to findings shared by Check Point with Cyber Security News, attackers commonly target Windows users through malicious links and compromised legitimate accounts. Linux systems, particularly internet-facing servers, are often infected following exploitation of vulnerabilities or deployment of web shells. Security experts emphasize timely patching, strong account protection measures, and continuous server monitoring to reduce the risk of compromise.

Noodle RAT's Cross-Platform Capabilities

Noodle RAT maintains a consistent command-and-control framework across operating systems while offering platform-specific functionality. This unified architecture allows operators to seamlessly manage infections throughout mixed Windows and Linux environments.

Windows Variant

The Windows version, known as Win.NOODLERAT, functions as a modular backdoor capable of executing directly in memory through shellcode-based loading mechanisms. Malware loaders such as MULTIDROP and MICROLOAD have been linked to the deployment process, minimizing the number of artifacts left on disk and enhancing stealth.

Once active, the malware can:

• Upload and download files
• Execute additional malicious modules
• Operate as a TCP proxy
• Remove itself to evade detection

These capabilities enable attackers to gather sensitive information, establish persistence, and move laterally within targeted networks.

Linux Variant

The Linux version, Linux.NOODLERAT, is primarily geared toward compromising servers. Key capabilities include:

• Launching reverse shells
• Managing and transferring files
• Creating scheduled tasks
• Establishing SOCKS proxy tunnels for traffic relaying

Security researchers note that infections often occur after attackers exploit vulnerable internet-facing systems or deploy web shells, allowing them to install the malware without requiring traditional executable files.

Encrypted Communications and Evasion Techniques

Both versions of Noodle RAT employ encryption to obscure communications and hinder detection efforts.

• The Windows variant uses a combination of RC4, XOR, and proprietary encryption methods.
• The Linux variant relies on HMAC-SHA1 and AES-128-CBC encryption.

Organizations should investigate unusual encrypted outbound traffic, especially when it coincides with suspicious account activity, unfamiliar processes, or unauthorized system changes.

Expanding Threat Landscape

Noodle RAT is no longer considered a niche threat. It has reportedly been used by several threat groups, including Iron Tiger, Calypso APT, Rocke, and Cloud Snooper, highlighting its appeal to both state-sponsored actors and financially motivated cybercriminals.

Evidence suggests the malware continues to evolve. Researchers identified a Linux builder interface featuring Simplified Chinese release notes and management capabilities, indicating active development and the possibility that Noodle RAT is distributed as part of a commercial malware toolkit.

Although the malware shares code and functionality with Gh0st RAT-related plugins on Windows and Rekoobe or Tiny SHell components on Linux, analysts maintain that it represents a separate and distinct malware family.

Persistence and Post-Compromise Activity

Noodle RAT supports a wide range of post-exploitation functions, including:

• System and network reconnaissance
• Data collection and exfiltration
• Credential abuse
• Obfuscation and masquerading techniques

For persistence, attackers may leverage:

Windows

• Registry Run keys
• Startup folders
• Scheduled tasks

Linux

• RC startup scripts
• Cron jobs and scheduled tasks

These mechanisms enable malware operators to maintain access even after system reboots or routine administrative actions.

Defensive Measures

The malware's observed infection methods highlight the importance of securing both endpoints and internet-facing infrastructure. Common entry points include:

• Exploitation of public-facing applications
• Malicious links and phishing campaigns
• Abuse of valid user credentials

To reduce exposure, organizations should:

• Promptly patch internet-facing services and applications
• Remove unnecessary external system exposure
• Detect and eliminate web shells
• Enforce multi-factor authentication (MFA)
• Review dormant and privileged accounts regularly
• Monitor unusual outbound network connections
• Investigate unauthorized scheduled tasks and startup modifications
• Segment critical infrastructure from user networks
• Maintain tested and recoverable backups

Key Takeaways for Security Teams

Noodle RAT demonstrates how modern threat actors are increasingly adopting cross-platform tools that function consistently across Windows and Linux environments. The malware's unified design allows compromised servers and workstations to serve as launch points for broader attacks throughout an organization.

For defenders, effective detection depends on correlating activity across multiple security layers. While initial compromise may begin through a phishing link, stolen credentials, or an exposed application, indicators often emerge later through encrypted network traffic, unexpected proxy activity, or abnormal task scheduling.

By combining threat intelligence with endpoint, server, and network telemetry, security teams can more effectively identify potential Noodle RAT infections, contain compromised systems, and accelerate incident response efforts.