Noodle RAT
Noodle RAT is a backdoor/RAT with both Windows and Linux variants. It is also known as ANGRYREBEL and Nood RAT, and Google Threat Intelligence Group referenced the Linux variant as Angryrebel.Linux RAT. Unit 42 observed its deployment and assessed it as likely used by Chinese-speaking groups engaged in espionage or cybercrime. The malware has been seen in post-exploitation activity alongside tools such as XMRig, Linux Cobalt Strike beacons, web shells disguised as React file managers, and EtherRAT.
High-confidence reporting in the provided content links Noodle RAT to exploitation of React2Shell (CVE-2025-55182), where in at least one case the vulnerability facilitated distribution of a Linux version of Noodle RAT. Google Threat Intelligence Group linked that React2Shell-to-Noodle RAT attack chain to UNC6595. Separate reporting also places Noodle RAT in a broader China-aligned intrusion set tracked by Trend Micro as SHADOW-EARTH-053, which targeted government and defense organizations across South, East, and Southeast Asia, as well as Poland. In that campaign, attackers primarily exploited internet-facing Microsoft Exchange and IIS vulnerabilities, used Godzilla web shells for persistence and command execution, and in at least one case used React2Shell to distribute Linux Noodle RAT.
Targeting and victimology directly associated in the content are government and defense sectors in countries including Pakistan, Thailand, Malaysia, India, Myanmar, Sri Lanka, Taiwan, and Poland. The content does not provide specific Noodle RAT command-and-control indicators, file hashes, or other concrete IOCs beyond its aliases and its observed association with React2Shell exploitation and China-linked intrusion activity.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In at least one case, the weaponization of the React2Shell (CVE-2025-55182) is said to have facilitated the distribution of a Linux version of Noodle RAT (aka ANGRYREBEL and Nood RAT).
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In at least one case, the weaponization of the React2Shell (CVE-2025-55182) is said to have facilitated the distribution of a Linux version of Noodle RAT (aka ANGRYREBEL and Nood RAT).
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
3 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
1 technique
Stealth
Command and Control
4 techniques
Command and Control
"downloaders to retrieve payloads from attacker command and control (C2) infrastructure" and multiple C2 endpoints; KSwapDoor uses mesh routing and encryption
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan whose Linux variant was distributed in at least one intrusion through exploitation of React2Shell.
Remote Access Trojan (RAT) used for remote control and persistence, deployed after exploitation of CVE-2025-55182.
Cross-platform (Windows/Linux) backdoor/RAT suspected to be used by Chinese-speaking groups for espionage or cybercrime; observed deployed during post-exploitation activity following CVE-2025-55182 exploitation.
Cross-platform (Windows/Linux) backdoor/RAT associated with Chinese-speaking operators; used for remote access post-compromise.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.