A Decade-Old Backdoor Gets a Fresh Look

Researchers at Check Point have documented renewed activity from Noodle RAT, a remote access trojan capable of running on both Windows and Linux systems, giving attackers a single malware family that can follow victims across mixed operating environments rather than being confined to one platform. The tool has surfaced in operations against organizations across the Asia-Pacific region, with reported activity touching Thailand, India, Japan, Malaysia, and Taiwan.

What makes the research notable is the classification work behind it. Analysts concluded that Noodle RAT, also tracked under the names ANGRYREBEL and Nood RAT, is a distinct malware family in its own right rather than merely a rebranded variant of the well-known Gh0st RAT or Rekoobe toolkits, despite sharing some code lineage with both. The malware has been linked to Chinese-speaking threat actors since at least mid-2016, making it very much a known quantity that continues to evolve rather than a brand-new threat.

Two Platforms, One Playbook

Noodle RAT’s cross-platform design gives operators different technical capabilities depending on the target operating system, while keeping a broadly similar command-and-control approach across both, a structure that simplifies managing infections across an organization’s mixed server and endpoint estate.

On Windows, the implant known as Win.NOODLERAT functions as a modular backdoor capable of running entirely in memory after being loaded via shellcode, with loaders tracked as MULTIDROP and MICROLOAD associated with the delivery process. That in-memory approach reduces the number of files left behind for defenders to find. Once active, the Windows variant can upload and download files, load additional modules on demand, function as a TCP proxy to reach other internal resources, and remove itself when finished, a feature set aimed squarely at quiet, sustained access rather than smash-and-grab theft.

The Linux counterpart, Linux.NOODLERAT, is built specifically for server-side access. It can open a reverse shell, manage files on the compromised host, schedule tasks for persistence, and establish SOCKS tunnels to relay network traffic through the infected server. Researchers note this variant typically shows up after a server has already been exploited or had a web shell planted, rather than serving as the initial foothold itself.

Encrypted Communications on Both Sides

Both versions take care to obscure their network traffic from casual inspection, though they use different techniques to do it. The Windows implant relies on a combination of RC4, XOR, and custom encryption schemes, while the Linux version uses HMAC-SHA1 alongside AES-128-CBC. For defenders, unfamiliar encrypted outbound sessions from either Windows or Linux hosts, particularly when paired with odd process behavior or unexplained account activity, are worth flagging for closer review.

A Toolkit Shared Across Multiple Threat Groups

Perhaps the most striking finding is just how many distinct threat groups appear to be using Noodle RAT. Check Point’s research ties deployments to Iron Tiger, Calypso APT, Rocke, and Cloud Snooper, a mix that spans state-aligned espionage operators and financially motivated criminal groups. That breadth suggests the malware may function as something closer to a shared or even commercially available toolkit rather than the exclusive property of a single crew, a theory bolstered by the presence of a Linux builder with a control panel and release notes written in Simplified Chinese, both signs of active, ongoing development.

How Attackers Get In

The initial access techniques observed alongside Noodle RAT deployments are largely familiar: exploitation of public-facing applications, malicious links sent to Windows users, and abuse of valid account credentials. On the Linux side, infections tend to follow exploitation of exposed servers or the planting of web shells rather than direct social engineering. Once inside, the malware favors well-worn persistence mechanisms, Windows Registry Run keys, startup folders, and scheduled tasks on Windows; RC scripts and cron-style scheduled tasks on Linux, alongside techniques for discovering files and system details, harvesting unsecured credentials, and masquerading its presence to blend in with legitimate processes.

Defensive Priorities

Given the dual-platform nature of the threat, organizations with mixed Windows and Linux environments should treat visibility gaps between the two as a real risk rather than an inconvenience. Recommended steps include:

• Urgently patching internet-facing applications and reducing unnecessary exposure of public-facing services.
• Actively hunting for web shells on Linux servers rather than assuming perimeter defenses alone will catch them.
• Enforcing multi-factor authentication broadly and reviewing privileged or dormant accounts for signs of abuse.
• Monitoring for unusual outbound connections, unexpected scheduled tasks, and unauthorized startup changes on both platforms.
• Segmenting critical servers away from general user networks and maintaining tested, offline backups to limit the blast radius of any single compromise.

Noodle RAT’s resurgence is less a story about a brand-new threat than a reminder that well-established malware families continue to be refined, shared, and redeployed years after their initial discovery. For organizations managing sprawling, heterogeneous infrastructure, consistent monitoring across every operating system in the environment remains one of the few reliable defenses against a toolkit built specifically to move comfortably between them.