Don’t Allow the Noodle RAT Threat To Take Over Your Computer
Noodle RAT is a recently discovered, cross-platform malware that has been used by Chinese-speaking threat actors for both espionage and cybercrime. While it was initially thought to be a variant of Gh0st RAT and Rekoobe, it is now recognized as a distinct type of malware.
Table of Contents
Background and Evolution
First identified in July 2016, Noodle RAT, also known as ANGRYREBEL or Nood RAT, has versions for both Windows and Linux systems. Gh0st RAT, which surfaced in 2008, has been a hallmark of Chinese government hackers. Over the years, tools like Gh0st RAT, PlugX, and ShadowPad have been used extensively in cyber campaigns.
Windows Variant
The Windows version of Noodle RAT is an in-memory modular backdoor, used by hacking groups like Iron Tiger and Calypso. It is launched via a loader and supports various commands, including downloading/uploading files, running additional malware, acting as a TCP proxy, and self-deletion. Two loaders, MULTIDROP and MICROLOAD, have been observed in attacks on Thailand and India.
Linux Variant
The Linux counterpart of Noodle RAT is used by different cybercrime and espionage groups linked to China, including Rocke and Cloud Snooper. This variant can launch a reverse shell, download/upload files, schedule executions, and initiate SOCKS tunneling. Attacks typically exploit known security flaws in public-facing applications to breach servers and deploy a web shell for remote access.
Commonalities and Command-and-Control
Despite differences in their commands, both Windows and Linux versions share identical code for command-and-control (C2) communications and similar configuration formats. Further analysis shows that while Noodle RAT reuses plugins from Gh0st RAT and shares code with Rekoobe, it remains a unique piece of malware.
Development and Distribution
Trend Micro's research revealed a control panel and builder for Noodle RAT's Linux variant, with release notes in Simplified Chinese indicating active development and maintenance. The malware is likely developed, maintained, and sold within a complex supply chain in China’s cyber espionage ecosystem, involving private sector firms and state-sponsored actors.
Misclassification and Underrating
Noodle RAT has been misclassified and underrated for years. The China-linked Mustang Panda group has also been linked to spear-phishing campaigns targeting Vietnamese entities, using LNK files to deploy the PlugX malware.
Understanding and mitigating the threat posed by Noodle RAT is crucial for protecting systems from cyber espionage and crime. Recognizing its distinct characteristics and the sophisticated supply chain behind its distribution can help in developing effective defense strategies.
