Loading story…
Chinese-nexus threat actors have been observed leveraging the open-source Nezha server monitoring tool as part of a sophisticated attack campaign targeting web servers, primarily in East and Southeast Asia. The campaign, first identified by Huntress in August 2025, involves the exploitation of publicly exposed and vulnerable web applications, with a particular focus on phpMyAdmin panels. Attackers initiate the compromise by exploiting these panels, often setting the interface language to simplified Chinese, and then proceed to execute a series of SQL commands to enable general query logging. Through a technique known as log poisoning or log injection, the adversaries inject a one-liner PHP web shell into the server logs, which are deliberately configured to be saved with a .php extension, allowing remote code execution via HTTP requests. Once the web shell is established, the attackers use AntSword, a popular web shell management tool, to gain interactive control over the compromised server. With this foothold, they deploy the Nezha agent, which is typically a legitimate tool for server monitoring but in this context is repurposed to maintain persistent access and facilitate further malicious activity. The Nezha agent connects to an external command-and-control server, enabling the attackers to issue commands and monitor the infected systems covertly. Subsequently, the attackers deploy Gh0st RAT, a well-known remote access trojan, to exfiltrate data and expand their control. Analysis indicates that over 100 victim machines have been compromised in this campaign, with the majority located in Taiwan, Japan, South Korea, and Hong Kong, though similar tactics have been observed globally. The use of open-source and otherwise legitimate tools like Nezha and AntSword allows the attackers to blend in with normal network activity and evade detection by security products. This campaign underscores the growing trend of threat actors abusing publicly available tools for malicious purposes, reducing their development costs and increasing operational stealth. The technical proficiency of the attackers is evident in their ability to chain together multiple tools and techniques, from initial access to persistence and lateral movement. Security researchers emphasize the importance of securing public-facing web applications and monitoring for unusual use of legitimate administrative tools. The campaign represents the first public reporting of Nezha being used in this manner, highlighting the evolving threat landscape and the need for vigilance against the weaponization of open-source software. Organizations are advised to audit their web applications, restrict access to administrative panels, and monitor for signs of log poisoning and unauthorized tool deployment. The incident serves as a reminder that even benign tools can become potent weapons in the hands of skilled adversaries.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Huntress publicly disclosed technical details of the campaign, including the use of log poisoning, AntSword, Nezha, Defender exclusions, and Gh0st RAT, and released indicators of compromise such as file names and paths. The report assessed the activity as likely linked to China-nexus actors but did not formally attribute it to a specific group.
In at least one investigated case, Huntress isolated the affected system and removed the web shell, Nezha agent, and Gh0st RAT payload. This response followed the attackers' use of Nezha to facilitate persistence and further malicious activity.
The campaign grew to affect over 100 machines, with victims primarily located in Taiwan, Japan, South Korea, and Hong Kong. Reporting indicates the number of affected entities was still increasing as the activity continued.
Huntress said the intrusion campaign was first detected in August 2025. The attackers exploited exposed, unauthenticated phpMyAdmin instances, abused MariaDB general query logging to create a web shell, deployed AntSword and the Nezha agent, and then delivered a Gh0st RAT variant.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
8 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesocprime.com
Open sourcescworld.com
Open sourcetherecord.media
Open sourcecsoonline.com
Open sourcedarkreading.com
Open sourcethehackernews.com
Open sourcehuntress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at Ontinue have identified that the open-source Nezha server monitoring tool, originally intended for legitimate IT administration, is being exploited by sophisticated threat actors as a Remote Access Trojan (RAT). Attackers are leveraging Nezha’s legitimate features—such as system health monitoring, command execution, file transfer, and interactive terminal sessions—to gain persistent, undetected access to compromised systems. The tool’s popularity and benign reputation, with nearly 10,000 GitHub stars and zero detections on VirusTotal, allow it to evade traditional security solutions, making it an attractive option for malicious actors. Investigations revealed that attackers deploy Nezha using a bash script containing Chinese-language status messages and configuration details pointing to a command and control server hosted on Alibaba Cloud. The deployment is silent, granting SYSTEM/root level access across a wide range of platforms, including Windows, Linux, macOS, and even home routers. This approach has enabled the compromise of hundreds of endpoints, demonstrating the scale and effectiveness of this technique. The incident highlights the growing trend of repurposing legitimate open-source tools for stealthy post-exploitation activities.
Jun 29, 2026
Palo Alto Networks Unit 42 reported a **previously undocumented Chinese threat actor**, tracked as **CL-UNK-1068**, conducting a multi-year intrusion campaign (observed since at least 2020) against high-value organizations across **South, Southeast, and East Asia**. Targeted sectors include **aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications**, with Unit 42 assessing **moderate-to-high confidence** that the primary objective is **cyber espionage** (while not fully ruling out criminal motives). The assessment cites tool provenance, linguistic artifacts in configurations, and consistent long-term targeting of Asian critical infrastructure as key factors supporting attribution. The activity features exploitation of **internet-facing web servers** to deploy **web shells** and establish persistence across both Windows and Linux environments, using a mix of custom malware, modified open-source tools, and **living-off-the-land binaries (LOLBINs)**. Reported tooling includes **Godzilla** and **ANTSWORD** web shells, the **Xnote** Linux backdoor, and **Fast Reverse Proxy (FRP)** for tunneling/relay; post-compromise behavior includes lateral movement and targeted file theft from Windows web servers (e.g., `c:\inetpub\wwwroot`) focusing on files such as `web.config`, `.aspx`, `.asmx`, `.asax`, and `.dll`, consistent with credential access and follow-on exploitation discovery.
Jun 29, 2026
Cisco Talos reported that Chinese-speaking threat actor **UAT-10147** targeted vulnerable internet-facing **Windows IIS** and **Linux** servers worldwide, using publicly disclosed one-day flaws to gain access and then deploying a broad post-compromise toolkit tied to **SEO fraud** and data theft. Talos said the group used AI-assisted workflows to automate reconnaissance, exploit validation, payload deployment, persistence, and operational documentation, and maintained infrastructure suggesting significant scale, including a target list of roughly **170,000 URLs**. On compromised Windows systems, the actor used batch scripts, scheduled tasks, rogue user creation, **EfsPotato**, and Defender exclusions; on Linux, it relied on web shells and local privilege-escalation exploits to obtain root access. A central payload in the campaign was **SPECTRE**, a custom cross-platform backdoor for Windows and Linux that supports HTTP-based command and control, anti-analysis, process injection, credential access, and on Windows a **BYOVD** technique to reduce EDR visibility by unlinking kernel callbacks. On Linux, SPECTRE deployed a rootkit called **Specter**, disguised as `acpi_pad.ko` and persisted through a fraudulent systemd service to hide processes and modules and elevate privileges. Talos also observed **Noodle RAT**, **QuasarRAT**, **Gh0stCringe**, **Meterpreter**, and web shells in the same operations; prior research has linked Noodle RAT variants to multiple Chinese-speaking espionage and financially motivated clusters, including Linux samples that copy themselves to `/tmp/CCCCCCCC`, decrypt configuration with RC4 using the hardcoded key `r0st@#$`, and connect to attacker-controlled C2 servers.
Aug 28, 2026