ANGRYREBEL.LINUX
ANGRYREBEL.LINUX, also referred to as Noodle RAT in the provided reporting, is a Linux remote access trojan/backdoor associated with China-nexus activity. The content links it most directly to UNC6595, and also notes deployment by other China-nexus clusters including UNC3569 as well as broader post-exploitation activity involving UNC6600 and UNC6603. Reported use cases include compromise of Linux-based servers and infrastructure hosted on international virtual private servers (VPS). In one UNC3569 campaign from November 2021, the malware was delivered to Linux servers via an open directory as part of a cloud- and VPS-focused intrusion set. More recent reporting states that UNC6595 abused CVE-2025-55182 (React2Shell) to deploy ANGRYREBEL.LINUX against unpatched React and Next.js workloads, primarily targeting infrastructure hosted on international VPS. The content explicitly characterizes ANGRYREBEL.LINUX as a remote access trojan/backdoor but does not provide deeper technical details on command execution, persistence, or protocol behavior. High-confidence associations in the content are UNC6595, Linux server targeting, VPS-hosted infrastructure targeting, delivery via open directory in at least one UNC3569 campaign, and deployment during exploitation of CVE-2025-55182.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Since exploitation began last week, our team at Google Threat Intelligence Group (GTIG) has been tracking widespread activity as multiple threat clusters race to leverage React2Shell (CVE-2025-55182). | Multiple groups including UNC6600 and UNC6603 are deploying custom backdoors and tunnelers such as MINOCAT, HISONIC, SNOWLIGHT, and ANGRYREBEL.LINUX.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
For Linux-based servers, UNC3569 hosted an open directory server to deliver the ANGRYREBEL.LINUX backdoor.
Multiple groups including UNC6600 and UNC6603 are deploying custom backdoors and tunnelers such as MINOCAT, HISONIC, SNOWLIGHT, and ANGRYREBEL.LINUX.
Multiple groups including UNC6600 and UNC6603 are deploying custom backdoors and tunnelers such as MINOCAT, HISONIC, SNOWLIGHT, and ANGRYREBEL.LINUX.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 techniqueIn November 2021, UNC3569 initiated a campaign targeting servers hosted on major cloud and VPS providers... Several steps and organizations were reportedly involved in the campaign: Chinese cloud configuration tool Bastion, Qianxin VPN software, Communication software Comm100... LiveHelp100
Command and Control
1 techniqueChina-Nexus Espionage: Multiple groups including UNC6600 and UNC6603 are deploying custom backdoors and tunnelers such as MINOCAT, HISONIC, SNOWLIGHT, and ANGRYREBEL.LINUX.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Angryrebel.Linux is a backdoor targeting Linux systems, primarily deployed on international VPS infrastructure for persistent access.
ANGRYREBEL.LINUX is a Remote Access Trojan (RAT) used by UNC6595 to gain persistent access and control over Linux systems compromised via the React2Shell vulnerability.
ANGRYREBEL.LINUX, also known as Noodle RAT, is a Linux backdoor used for persistent access and espionage.
ANGRYREBEL.LINUX, also known as Noodle RAT, is a Linux backdoor used for persistent access and control, deployed by UNC6595.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.