Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems

Noodle RAT is a remote-access trojan that gives attackers control of compromised computers and servers. Its renewed visibility matters because it runs on both Windows and Linux, allowing one malware family to follow victims across corporate networks.

The tool has appeared in operations against organisations across Asia-Pacific, including Thailand, India, Japan, Malaysia and Taiwan. Operators can steal files, run commands and route traffic through a victim system, expanding an initial breach into a wider network risk.

Check Point analysts identified the malware as a distinct family, rather than simply another version of Gh0st RAT or Rekoobe. Also known as ANGRYREBEL and Nood RAT, it has been linked to Chinese-speaking threat actors since at least mid-2016.

Check Point said in a report shared with Cyber Security News (CSN) that the attackers can use malicious links and valid accounts against Windows users, while exposed Linux servers may be infected after exploitation or web-shell placement. Patching, account protection and server monitoring are central to limiting harm.

Hackers Use Cross-Platform Noodle RAT

Noodle RAT gives operators different tools on each operating system but retains a similar command-and-control design. That shared approach helps manage infections across mixed environments.

On Windows, Win.NOODLERAT works as a modular backdoor that can run in memory after loading through shellcode. Loaders known as MULTIDROP and MICROLOAD have been associated with this process, reducing visible files.

Once active, the Windows implant can upload and download files, run extra modules, act as a TCP proxy and delete itself. Those functions let an attacker collect information and reach other resources, a pattern also seen in cross-platform RAT attacks affecting several operating systems.

Linux.NOODLERAT is designed for server-side access. It can open a reverse shell, manage files, schedule tasks and create SOCKS tunnels that relay network traffic. Researchers say it often follows exploitation or web-shell deployment against exposed Linux servers, echoing fileless Linux web shell investigations.

Both versions protect communications from simple inspection. The Windows variant uses RC4, XOR and custom encryption, while Linux uses HMAC-SHA1 and AES-128-CBC. Unfamiliar encrypted outbound sessions warrant investigation when paired with suspicious process or account behaviour.

Campaign reach and defense

The reported victimology shows why Noodle RAT is not a single-platform problem. Threat groups including Iron Tiger, Calypso APT, Rocke and Cloud Snooper have deployed it, suggesting the toolkit appeals to state-aligned operators and financially motivated criminals.

The Linux builder’s control panel and Simplified Chinese release notes point to ongoing development and possibly a commercial toolkit.

Shared code with Gh0st RAT plugins on Windows and with Rekoobe or Tiny SHell on Linux adds confusion, but researchers assess Noodle RAT as a separate backdoor family.

Its techniques include data collection and exfiltration over command-and-control channels, discovery of files and system details, unsecured credentials, masquerading and obfuscation. It can persist through Windows Registry Run keys, startup folders and scheduled tasks, or Linux RC scripts and scheduled tasks.

The initial-access methods demand attention at the edge and on endpoints. Exploitation of public-facing applications, malicious links and valid accounts are associated with the activity.

Administrators should urgently patch internet-facing services, remove unnecessary exposure and investigate web shells, as Windows Linux server exploitation reporting also illustrates.

Defenders should enforce multifactor authentication, review privileged and dormant accounts, and monitor unusual outbound connections, scheduled tasks and startup changes. Separating critical servers from user networks and maintaining tested backups can limit the impact of a compromise.

The Windows and Linux variants reflect a unified design despite platform-specific functions. The findings remind organisations that mixed operating-system estates need consistent visibility, especially where an infected server can become a stepping stone into the wider business.

For security teams, the practical priority is correlation. A suspicious link or exposed application may be the entry point, but clues can emerge later in encrypted traffic, unexpected proxy behaviour or task scheduling.

Reviewing the indicators below alongside endpoint and server telemetry can help scope potential Noodle RAT activity and speed the response.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC