Noodle RAT: A Recipe for Cross Platform Espionage

Noodle RAT is a modular remote access trojan with distinct Windows and Linux versions, used since at least mid-2016 by Chinese-speaking threat actors. It has been involved in espionage and cybercrime campaigns targeting multiple Asia-Pacific countries. The malware features shared command-and-control infrastructure and modular capabilities, with the Windows variant operating as an in-memory backdoor and the Linux variant providing reverse shell and proxy functionalities. Multiple threat groups have deployed Noodle RAT, which appears to be actively maintained and possibly commercially available.

• Fake Software Installers Disable Windows Update and Weaken Microsoft DefenderMalware2026-09-03
• Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incidentMalware2026-07-16
• The Crown Prince, NezhaMalware2026-07-03
• An unknown actor distributes malicious VBS scripts via WhatsAppMalware2026-06-22
• RONINGLOADER: DragonBreath's New Path to PPL AbuseMalware2025-11-19