Huntress Uncovers Log Poisoning Campaign Linking Nezha and Ghost RAT in Widespread Asian Cyber Intrusions

Huntress researchers have unveiled a new intrusion technique that combines log poisoning, AntSword web shell control, and the Nezha monitoring tool to deliver Ghost RAT malware across more than 100 victim systems. Beginning in August 2025, according to Huntress, the intrusion started with a compromised phpMyAdmin interface exposed to the internet without authentication, with the attacker exploiting flaws in the default configuration following a DNS record change months earlier.

The attacker, operating from an AWS-hosted IP in Hong Kong, changed the interface language to Simplified Chinese, then accessed the SQL query interface and executed commands rapidly before using log poisoning to write PHP code into a web-accessible log file.

The campaign culminated in deploying Ghost RAT after the Nezha agent and configuration were downloaded from rism.pages[.]dev, with the Nezha dashboard showing infected systems across Taiwan, Japan, South Korea and Hong Kong, among others, and a three-stage Ghost RAT architecture enabling remote commands, DLL loading and persistence. Authorities trace the infrastructure to MoeDove LLC, with DGAs and Chinese-language settings suggesting a China-nexus threat actor.