Noodle RAT

Noodle RAT, also known as ANGRYREBEL or Nood RAT, is a new strain of malware that has been active since at least 2018. This malicious software, used by Chinese-speaking groups for espionage or cybercrime, was introduced in a Botconf 2024 presentation by Trend Micro Research. The Windows version of Noodle RAT has connections to Gh0st RAT, a malware strain developed by the C. Rufus Security Team in China, whose code leaked in 2008. Noodle RAT is a relatively simple backdoor deployed in two versions: a Windows one called Win.NOODLERAT and a Linux one called Linux.NOODLERAT. In 2024, samples of Noodle RAT were found uploaded on Virus Total, indicating its probable ongoing usage. A technical analysis by Trend Micro's threat intelligence team revealed the initialization process, communication with command and control (C2) servers, backdoor control methods, and features of the C2 server for both versions of Noodle RAT. Despite some similarities with Rekoobe or Tiny SHell, Linux.NOODLERAT's unique code led Trend Micro to classify it as a distinct malware family. Since 2020, Noodle RAT has been utilized in espionage campaigns targeting countries such as Thailand, India, Japan, Malaysia, and Taiwan. An ELF backdoor reported in these campaigns was identified by Trend Micro's threat intelligence team as a new malware strain, which they named Noodle RAT. Given its continued detection and evolving capabilities, cybersecurity experts warn of its potential threat to both individual users and organizations.