This threat involves a sophisticated intrusion campaign starting in August 2025 targeting vulnerable phpMyAdmin installations through log poisoning techniques to deploy China Chopper web shells. The attackers used AntSword to control these shells and deployed Nezha, an open-source monitoring tool, to facilitate remote command execution. This chain of compromise led to the deployment of Ghost RAT malware on affected systems. The campaign affected over 100 machines primarily in East Asian regions and utilized cloud and VPS infrastructure for operations. The attackers demonstrated advanced multi-stage tactics and leveraged publicly available tools to maintain stealth and plausible deniability. Indicators include multiple IP addresses, domains, and file hashes associated with the campaign. No CVE or patch information is provided, and no known exploits in the wild are confirmed.

The intrusion enables remote command execution on compromised systems, allowing attackers to deploy Ghost RAT, which can facilitate persistent access, data exfiltration, and further malicious activities. The campaign affected over 100 systems, primarily in Taiwan, Japan, South Korea, and Hong Kong, indicating targeted regional impact. The use of legitimate open-source tools like Nezha and AntSword complicates detection and attribution. The exploitation of misconfigured phpMyAdmin panels via log poisoning highlights risks in web application security and configuration management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should verify and secure phpMyAdmin installations, ensuring proper configuration to prevent log poisoning and unauthorized web shell deployment. Monitoring for known indicators of compromise such as the provided IPs, domains, and file hashes is recommended. Since the campaign abuses legitimate tools, defenders should implement detection rules for unusual use of AntSword, Nezha, and China Chopper web shells. Incident response should focus on identifying and removing Ghost RAT infections. No official patch or fix is currently documented for this specific campaign.