Loading story…
Security researchers at Ontinue have identified that the open-source Nezha server monitoring tool, originally intended for legitimate IT administration, is being exploited by sophisticated threat actors as a Remote Access Trojan (RAT). Attackers are leveraging Nezha’s legitimate features—such as system health monitoring, command execution, file transfer, and interactive terminal sessions—to gain persistent, undetected access to compromised systems. The tool’s popularity and benign reputation, with nearly 10,000 GitHub stars and zero detections on VirusTotal, allow it to evade traditional security solutions, making it an attractive option for malicious actors.
Investigations revealed that attackers deploy Nezha using a bash script containing Chinese-language status messages and configuration details pointing to a command and control server hosted on Alibaba Cloud. The deployment is silent, granting SYSTEM/root level access across a wide range of platforms, including Windows, Linux, macOS, and even home routers. This approach has enabled the compromise of hundreds of endpoints, demonstrating the scale and effectiveness of this technique. The incident highlights the growing trend of repurposing legitimate open-source tools for stealthy post-exploitation activities.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Ontinue researchers accessed the attackers’ Nezha dashboard in a sandbox, confirming the scale of the compromise and the use of the tool for centralized control of compromised devices. Their public reporting highlighted the detection challenges posed by abuse of legitimate administrative software and urged organizations to hunt for unauthorized Nezha installations.
Ontinue researchers discovered that threat actors were abusing Nezha as a post-exploitation remote access trojan, using its legitimate command execution, file transfer, and terminal features to control compromised systems. The activity affected hundreds of endpoints, with agents running as SYSTEM or root and infrastructure linked to Alibaba Cloud in Japan and Chinese-language deployment artifacts.
Previous incidents involving the legitimate open-source monitoring tool Nezha were reported by Huntress in October 2025, with organizations in East Asia identified as targets. This established an earlier pattern of attackers repurposing Nezha for malicious access.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Chinese-nexus threat actors have been observed leveraging the open-source Nezha server monitoring tool as part of a sophisticated attack campaign targeting web servers, primarily in East and Southeast Asia. The campaign, first identified by Huntress in August 2025, involves the exploitation of publicly exposed and vulnerable web applications, with a particular focus on phpMyAdmin panels. Attackers initiate the compromise by exploiting these panels, often setting the interface language to simplified Chinese, and then proceed to execute a series of SQL commands to enable general query logging. Through a technique known as log poisoning or log injection, the adversaries inject a one-liner PHP web shell into the server logs, which are deliberately configured to be saved with a .php extension, allowing remote code execution via HTTP requests. Once the web shell is established, the attackers use AntSword, a popular web shell management tool, to gain interactive control over the compromised server. With this foothold, they deploy the Nezha agent, which is typically a legitimate tool for server monitoring but in this context is repurposed to maintain persistent access and facilitate further malicious activity. The Nezha agent connects to an external command-and-control server, enabling the attackers to issue commands and monitor the infected systems covertly. Subsequently, the attackers deploy Gh0st RAT, a well-known remote access trojan, to exfiltrate data and expand their control. Analysis indicates that over 100 victim machines have been compromised in this campaign, with the majority located in Taiwan, Japan, South Korea, and Hong Kong, though similar tactics have been observed globally. The use of open-source and otherwise legitimate tools like Nezha and AntSword allows the attackers to blend in with normal network activity and evade detection by security products. This campaign underscores the growing trend of threat actors abusing publicly available tools for malicious purposes, reducing their development costs and increasing operational stealth. The technical proficiency of the attackers is evident in their ability to chain together multiple tools and techniques, from initial access to persistence and lateral movement. Security researchers emphasize the importance of securing public-facing web applications and monitoring for unusual use of legitimate administrative tools. The campaign represents the first public reporting of Nezha being used in this manner, highlighting the evolving threat landscape and the need for vigilance against the weaponization of open-source software. Organizations are advised to audit their web applications, restrict access to administrative panels, and monitor for signs of log poisoning and unauthorized tool deployment. The incident serves as a reminder that even benign tools can become potent weapons in the hands of skilled adversaries.
Jun 29, 2026
Researchers and incident responders have documented continued abuse of **Quasar RAT** and related malware such as **AsyncRAT** across espionage, phishing, and commodity malware operations. Quasar, an open-source remote administration tool, has been used by multiple threat actors including **APT10** and operators targeting Ukrainian government institutions, where it appeared alongside Sobaken RAT and the custom Vermin backdoor to steal sensitive documents. JPCERT/CC reported that Quasar evolved into a broader **Quasar Family** that includes derivatives such as **XPCTRA, CinaRAT, Void-RAT, and AsyncRAT**, with protocol, encryption, and configuration changes complicating detection and attribution. Recent technical analyses show the malware remains active in varied delivery chains and is often bundled or customized to evade scrutiny. One sample posing as a **Chaos Ransomware** builder was found to contain a clean ransomware builder alongside a hidden **Quasar RAT** payload embedded with **Celesty Binder**, with decrypted configuration revealing C2 `66.63.167.164:55640`, mutex `QSR_MUTEX_M6ajmD3hhoJo7CTsvN`, and persistence-related strings. Separate **AsyncRAT** campaigns used GitHub-hosted payloads, spoofed Thailand Pass lures, ISO/VBScript/PowerShell stages, process injection into `aspnet_compiler.exe`, scheduled-task persistence, antivirus checks, and credential theft. Network defenders have also been warned that Quasar, AsyncRAT, and other RATs frequently use **custom non-HTTP/S C2 protocols** over TCP with encryption, making heuristic traffic analysis and protocol-aware detection critical.
Aug 15, 2026
Trend Micro disclosed a previously undocumented Linux implant, **Quasar Linux RAT** (`QLNX`), that targets developer workstations and DevOps environments to steal credentials tied to software supply chains. The malware harvests secrets from assets including **npm**, **PyPI**, **Git**, **AWS**, **Kubernetes**, **Docker**, **Vault**, **Terraform**, **GitHub CLI**, `.env` files, SSH keys, browser data, and even `/etc/shadow`, creating a path to malicious package publication, cloud account compromise, and CI/CD abuse. Researchers said the implant combines backdoor, surveillance, credential theft, and lateral movement features, with a 58-command RAT core supporting shell execution, file management, screenshots, keylogging, clipboard theft, SOCKS proxying, TCP tunneling, and SSH-based movement across environments. The malware was built for stealth and long-term persistence on Linux systems. Trend Micro said `QLNX` runs filelessly from memory, deletes its original binary, wipes logs, spoofs process names as kernel threads, and uses multiple persistence methods including **`LD_PRELOAD`**, **systemd**, **crontab**, **init.d**, **XDG autostart**, and `.bashrc` injection. It also dynamically compiles rootkit and PAM credential-interception components on the victim host using `gcc`, then hides processes, files, and ports through a two-tier design that combines a userland `LD_PRELOAD` rootkit with an **eBPF** kernel component. Command-and-control traffic can flow over raw TCP, custom TLS, HTTP, or HTTPS, and at publication only a small number of security products reportedly detected the malware, while no actor attribution or confirmed intrusions had been publicly disclosed.
Jun 29, 2026