Chinese Hackers Weaponize Open-Source Nezha Tool in New Attack Wave

According to Huntress in a report shared with The Hacker News, threat actors with suspected ties to China have weaponised the legitimate open-source monitoring tool Nezha to deliver Gh0st RAT to targets. The activity, observed in August 2025, uses an unusual log poisoning (log injection) technique to plant a PHP web shell on a web server, allowing the attackers to control the server through ANTSWORD before deploying Nezha to issue commands.

The intrusion is said to have likely compromised more than 100 victim machines, with a majority in Taiwan, Japan, South Korea and Hong Kong, and a wider spread across Singapore, the U.K., the U.S. and other countries. Investigators describe the attackers as a "technically proficient adversary" who gained initial access via a publicly exposed and vulnerable phpMyAdmin panel, then dropped a PHP web shell and used Nezha to remotely command infected hosts.

The Nezha agent enables the next stage of the attack, including an interactive PowerShell script to create Microsoft Defender Antivirus exclusions and launch Gh0st RAT, a malware widely used by Chinese hacking groups.