The Crown Prince, Nezha

This intrusion campaign involved exploitation of vulnerable phpMyAdmin panels through log poisoning techniques to plant China Chopper web shells, which were managed using the AntSword web shell management tool. The attackers then deployed Nezha, an open-source monitoring and remote command execution tool, to maintain persistence and control. Ultimately, Ghost RAT malware was installed on compromised hosts. The operation targeted over 100 systems primarily in East Asia, leveraging cloud and VPS infrastructure to obfuscate origin. The attackers demonstrated sophisticated multi-stage tactics, techniques, and procedures (TTPs), including use of publicly available tools to maintain plausible deniability. Indicators suggest a China-nexus threat actor behind the campaign.

The campaign resulted in unauthorized remote access and control over compromised systems, enabling attackers to execute arbitrary commands and deploy additional malware (Ghost RAT). This compromises confidentiality, integrity, and availability of affected systems. The use of web shells and remote monitoring tools facilitates long-term persistence and potential data exfiltration or further lateral movement within victim networks. The geographic concentration in Taiwan, Japan, South Korea, and Hong Kong indicates targeted regional impact.

No official patch or vendor advisory is available for this campaign. Mitigation should focus on securing phpMyAdmin installations by correcting misconfigurations, applying the principle of least privilege, and restricting access to management interfaces. Monitoring for web shell indicators such as China Chopper and AntSword activity is recommended. Network segmentation and blocking known malicious IPs or infrastructure associated with this campaign can reduce exposure. Incident response should include removing web shells, Nezha, and Ghost RAT malware from affected systems. Since this campaign abuses legitimate open-source tools, defenders should implement behavioral detection and anomaly monitoring tailored to these tools' misuse.