Noodle RAT is a modular remote access trojan with distinct Windows and Linux versions, used since at least mid-2016 by Chinese-speaking threat actors. It has been involved in espionage and cybercrime campaigns targeting multiple Asia-Pacific countries. The malware features shared command-and-control infrastructure and modular capabilities, with the Windows variant operating as an in-memory backdoor and the Linux variant providing reverse shell and proxy functionalities. Multiple threat groups have deployed Noodle RAT, which appears to be actively maintained and possibly commercially available.
