NoodleRAT

NoodleRAT is a malware family used as a backdoor by multiple Chinese-speaking espionage and cybercrime clusters. It has both Windows and Linux variants, with the Linux branch implemented as an ELF backdoor and the Windows branch appearing in multiple command-structure clusters. Reported users include groups associated with espionage activity such as Iron Tiger, Calypso APT, Cloud Snooper, and Shadow-Earth-053, as well as financially motivated operators including Rocke and UAT-10147. Victim sectors linked to observed deployments include government, defense, technology, transportation, critical infrastructure, higher education, media, gaming, and cloud-facing internet services, with activity concentrated in Asia but also observed more broadly.

NoodleRAT is typically deployed after initial compromise rather than serving as the first-stage payload. Observed intrusion chains place it on vulnerable internet-exposed servers after exploitation of public-facing applications and web infrastructure, including Microsoft Exchange, IIS, and React-based server environments. In Linux intrusions it has been installed after attackers obtained remote code execution and, in some cases, root privileges through local privilege-escalation exploits. It has also been observed alongside other post-exploitation tooling such as ShadowPad, SPECTRE, Meterpreter, QuasarRAT, tunneling utilities, and web shells.

The malware’s core function is persistent remote access and operator-controlled post-compromise activity. Documented capabilities include reverse shell access, file upload and download, recursive directory listing, module execution, scheduled execution, and SOCKS or TCP proxying to relay traffic through compromised hosts. Windows variants support a structured command protocol with distinct clusters that differ in command identifiers and feature completeness; one documented cluster includes a self-delete function while another lacks it, suggesting both shared and more exclusive builds in circulation. Linux samples have been observed copying themselves to temporary locations, spoofing process names by overwriting process arguments, decrypting embedded configuration data, and then establishing outbound command-and-control communications.

Operationally, NoodleRAT fits the pattern of a shared post-exploitation backdoor rather than a tool exclusive to a single actor. Its use across espionage and cybercrime operations indicates broad availability within Chinese-speaking intrusion ecosystems. In cloud and server-centric environments, especially Linux-heavy workloads, it represents a notable threat because it enables durable access, remote tasking, file transfer, and traffic tunneling after exploitation of exposed services.