China-Nexus Actors Weaponize 'Nezha' Open Source Tool

A Dark Reading report details how a China-nexus threat actor is weaponising Nezha, an open source server operations and maintenance tool, to compromise organisations across Southeast Asia. Nezha, described as a lightweight program that can monitor and manage multiple servers, has been used in campaigns that include deploying a log-poisoning attack after an exposed Web server panel was found, with attackers dropping Gh0stRAT afterwards.

The activity, tracked in a Huntress blog post, has infected more than 100 organisations on six continents since August, with victims predominantly in Southeast Asia and a heavy concentration in Taiwan, alongside targets in Guatemala, Slovakia and Tanzania. The attacker reportedly used Nezha in conjunction with the AntSword framework to control the infected systems via a C2 server, run PowerShell interactively, and disable Windows Defender scanning in the affected C: directory before dropping Gh0stRAT.

The article, published on 8 October 2025, notes that the tool’s legitimate functionality can be repurposed for illicit use, emphasising the ongoing risk posed by publicly available tooling. According to Huntress, the report underscores how attackers increasingly abuse publicly available tools to achieve plausible deniability and lower research costs.