Executive Summary
Beginning in August 2025, Huntress identified a campaign attributed to a technically proficient China-nexus threat actor targeting over 100 victims globally. The attackers primarily focus on systems in Taiwan, Japan, South Korea, and Hong Kong, aligning with known regional geopolitical tensions. While some activity is attributed to VPS enthusiasts in mainland China, the deployment of Ghost RAT and the specific selection of international targets suggest more strategic motivations.
The attack chain begins with log poisoning (log injection) on vulnerable phpMyAdmin/MariaDB instances to drop a China Chopper-style web shell. This is followed by the installation of Nezha, a legitimate open-source monitoring and task management tool repurposed as a persistent backdoor. Finally, the actor uses Nezha to deploy Ghost RAT variants for full system control and data exfiltration. The use of legitimate monitoring tools like Nezha provides the adversary with plausible deniability and a lower chance of detection by standard security products.
This activity is significant due to the creative use of database log files to bypass security restrictions and the rapid adoption of emerging open-source administrative tools for malicious persistence. Organizations using XAMPP or exposed phpMyAdmin panels are at high risk, especially if these services are running with elevated privileges.
Key Details
Threat Name
Nezha Monitoring Tool
Affects
—
Adversary
China-nexus threat actor Other Adversaries and Aliases: China-nexus threat actors
MITRE Techniques
Malware/Tools
Ghost RAT, Nezha, China Chopper, AntSword, Matanbuchus, AstarionRAT, PureRAT, Havoc, Komari, XMRig