New Cross-Platform Malware 'Noodle RAT' Targets Windows and Linux Systems

A new cross-platform remote access trojan called Noodle RAT (also ANGRYREBEL/Nood RAT) has been identified and attributed to Chinese-speaking threat groups and criminal operators. Present since at least 2016, it has Windows and Linux variants with modular in-memory/backdoor capabilities—file transfer, remote execution, SOCKS/TCP proxying, reverse shells—and shared C2/config formats. Loaders (MULTIDROP, MICROLOAD) and exploitation of public-facing application vulnerabilities have been observed in attacks against targets in countries including Thailand and India. Trend Micro recovered a Linux control panel and builder with Simplified Chinese notes, suggesting active development and commercial availability within a Chinese cyber supply chain.