MalwarePublished 9 Oct 2025Updated 8 Nov 2025

The Crown Prince, Nezha: A New Tool Favored by China-Nexus Threat Actors

Source AlienVault OTX General

Description

A sophisticated cyber intrusion campaign utilizing log poisoning and a new tool called Nezha has been uncovered. The attackers exploited a vulnerable phpMyAdmin interface to deploy a web shell, followed by the installation of Nezha, an open-source server monitoring tool repurposed for malicious activities. The campaign targeted over 100 victims, primarily in Taiwan, Japan, South Korea, and Hong Kong. The threat actors also deployed Ghost RAT, a remote access trojan, for further system compromise. The attack methodology and victimology suggest a China-nexus threat actor, highlighting the need for improved security measures and vigilance against emerging threats.

Impact

For European organizations, the impact of this threat could be significant if they operate vulnerable phpMyAdmin interfaces or similar web management tools exposed to the internet. Successful exploitation can lead to unauthorized remote code execution, installation of persistent backdoors, and deployment of remote access trojans like Ghost RAT, resulting in potential data breaches, intellectual property theft, and disruption of critical services. The use of log poisoning complicates incident detection and response, increasing dwell time and the risk of extensive lateral movement within networks. Given the stealthy nature of Nezha and the multi-stage attack chain, organizations may face prolonged undetected intrusions, leading to reputational damage and regulatory consequences under GDPR if personal data is compromised. The medium severity rating reflects that while exploitation requires a vulnerable public-facing application, no user interaction is needed, and the scope can be broad if defenses are weak. European entities in sectors such as government, critical infrastructure, finance, and technology, which often use phpMyAdmin or similar tools for database management, are particularly at risk. The geopolitical context of China-nexus threat actors targeting East Asia also suggests potential spillover or targeting of European organizations with strategic or economic ties to the region.

Defensive guidance

European organizations should implement the following specific mitigations: 1) Immediately audit and patch all phpMyAdmin instances to the latest secure versions or disable public-facing phpMyAdmin interfaces where possible. 2) Employ strict network segmentation and firewall rules to limit access to management interfaces only to trusted IP addresses or VPN users. 3) Deploy web application firewalls (WAFs) with rules to detect and block web shell uploads and suspicious HTTP requests indicative of log poisoning or command injection. 4) Monitor logs for anomalies, but also implement immutable or remote log storage to prevent log tampering. 5) Use endpoint detection and response (EDR) solutions to identify behaviors associated with Nezha, Ghost RAT, and other known indicators of compromise, including unusual process creations and network connections. 6) Conduct regular threat hunting focused on MITRE ATT&CK techniques relevant to this campaign, such as T1190 and T1059. 7) Harden server configurations by disabling unnecessary services and enforcing least privilege principles for service accounts. 8) Educate IT and security teams on the tactics and tools used by China-nexus actors to improve detection and response capabilities. 9) Implement multi-factor authentication (MFA) for administrative access to reduce risk from credential theft. 10) Establish incident response plans that include procedures for web shell detection and removal, and forensic analysis of log poisoning attempts.

Indicators of compromise

Domains 3

gd.bj2.xyz
c.mid.al
host.404111.xyz

IP addresses 3

45.207.220.12
172.245.52.169
38.246.250.201

Hashes 12

d757ec4d5350843c44dd34a95dcb3a50
ad5e5b00f58396f5a518680e7084dc7dd5f2cc2b
7b2599ed54b72daec0acfd32744c7a9a77b19e6cf4e1651837175e4606dbc958
6f336f372c5a642b57413363265e7d7e
8459d693c951248a5e8e128f299e9618
89cb9c926e136c54011f3e0792b4a28c
1c948822cb57763c1d343542ee4ade212d8f4fbb
55ac33d1ebfa28296c5128617d29ccbfed11157e
35e0b22139fb27d2c9721aedf5770d893423bf029e1f56be92485ff8fce210f3
82611e60a2c5de23a1b976bb3b9a32c4427cb60a002e4c27cadfa84031d87999

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 9 Oct 2025, 17:23 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details

Indicators of compromise

Domains 3

IP addresses 3

Hashes 12

Community reviews

Related threats