Noodle RAT Malware Evolves for Cross-Platform Control of Windows and Linux Systems
The Noodle RAT, also known as ANGRYREBEL, is a sophisticated remote-access trojan that has resurfaced with enhanced capabilities to target both Windows and Linux environments, expanding its reach across the Asia-Pacific region.
The Noodle RAT, a versatile remote-access trojan also identified as ANGRYREBEL, has re-emerged with a significant focus on cross-platform compatibility, enabling threat actors to maintain control over both Windows and Linux systems within compromised networks. This evolution is particularly concerning as it allows a single malware family to pursue victims across diverse operating system environments, amplifying the potential for lateral movement and data exfiltration.
Recent analyses by Check Point researchers highlight the malware's deployment against organizations throughout the Asia-Pacific region, including targets in Thailand, India, Japan, Malaysia, and Taiwan. The RAT's capabilities allow attackers to steal sensitive files, execute arbitrary commands, and reroute network traffic through infected systems, thereby transforming an initial foothold into a broader network compromise.
Distinguishing itself from other RAT families like Gh0st RAT or Rekoobe, Noodle RAT has been associated with Chinese-speaking threat groups since at least mid-2016. The malware's operational methods vary by platform: Windows users are typically targeted through malicious links or compromised valid accounts, while exposed Linux servers are often infected via exploitation or the placement of web shells.
The Windows variant, known as Win.NOODLERAT, operates as a modular backdoor. It can execute in memory after being loaded via shellcode, often utilizing loaders like MULTIDROP and MICROLOAD to minimize its on-disk footprint. Once active, it provides functionalities to upload and download files, deploy additional modules, act as a TCP proxy, and self-delete, facilitating comprehensive data gathering and network reconnaissance.
On the Linux side, Linux.NOODLERAT is engineered for server-side operations. It offers features such as reverse shell capabilities, file management, task scheduling, and the creation of SOCKS tunnels for relaying network traffic. Its deployment often follows the exploitation of vulnerable Linux servers or the successful installation of web shells, mirroring trends observed in fileless Linux web shell investigations.
To evade detection and analysis, both variants employ distinct encryption mechanisms for their command-and-control communications. The Windows version utilizes a combination of RC4, XOR, and custom encryption algorithms, while the Linux variant relies on HMAC-SHA1 and AES-128-CBC. The presence of unfamiliar encrypted outbound sessions, especially when correlated with suspicious process or account activity, should be a significant red flag for security teams.
The broad range of threat groups employing Noodle RAT, including Iron Tiger, Calypso APT, Rocke, and Cloud Snooper, suggests its appeal to both state-sponsored actors and financially motivated cybercriminals. The Linux builder's control panel and release notes in Simplified Chinese further indicate ongoing development and potential commercial distribution, underscoring its persistent threat.
Defending against Noodle RAT requires a multi-layered approach. Administrators are urged to promptly patch internet-facing services, minimize unnecessary exposure, and actively investigate potential web shell compromises. Implementing multi-factor authentication, regularly reviewing privileged and dormant accounts, and monitoring for unusual network traffic and system modifications are crucial. Maintaining robust backups and segmenting critical servers can also mitigate the impact of a successful breach.