Chinese Hackers Weaponize Nezha Tool to Run Commands on Web Servers

Security researchers have uncovered a campaign in which Chinese threat actors exploited web applications using a log poisoning technique to deploy web shells and subsequently weaponise Nezha, a legitimate server monitoring tool, for malicious command execution. Beginning in August 2025, Huntress identified an intrusion where attackers used log poisoning to plant a China Chopper web shell on vulnerable web servers.

Following the initial access, the attackers downloaded and installed Nezha on compromised systems, with Nezha dashboard settings configured in Russian and management extending to over 100 affected victims across Taiwan, Japan, South Korea and Hong Kong. Investigations of the threat actor’s infrastructure revealed cloud-based設 deployments across multiple providers, including AWS-hosted IP addresses in Hong Kong and virtual private servers in Dublin, indicating sophisticated operational security.

The campaign demonstrates how publicly available tools can be abused for persistent command execution while allowing threat actors to maintain plausible deniability compared to custom malware development, according to Huntress.