Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Kaspersky Security Blog

Check Point Research

CVE Database V5

AlienVault OTX General

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A sophisticated cyber intrusion campaign utilizing log poisoning and a new tool called Nezha has been uncovered. The attackers exploited a vulnerable phpMyAdmin interface to deploy a web shell, followed by the installation of Nezha, an open-source server monitoring tool repurposed for malicious activities. The campaign targeted over 100 victims, primarily in Taiwan, Japan, South Korea, and Hong Kong. The threat actors also deployed Ghost RAT, a remote access trojan, for further system compromise. The attack methodology and victimology suggest a China-nexus threat actor, highlighting the need for improved security measures and vigilance against emerging threats.

This threat involves a sophisticated cyber intrusion campaign attributed to China-nexus threat actors, who exploit a vulnerable phpMyAdmin interface to gain initial access. The attackers deploy a web shell, commonly associated with tools like China Chopper and AntSword, enabling remote command execution on compromised servers. Subsequently, they install Nezha, an open-source server monitoring tool that has been repurposed for malicious activities, allowing attackers to maintain persistence, monitor system status, and execute further commands stealthily. The campaign also involves log poisoning techniques to evade detection by corrupting or manipulating log files, complicating forensic analysis. Additionally, the attackers deploy Ghost RAT, a remote access trojan, to facilitate deeper system compromise and data exfiltration. The attack chain includes multiple tactics and techniques mapped to MITRE ATT&CK IDs such as T1190 (Exploit Public-Facing Application), T1543.003 (Create or Modify System Process: Windows Service), T1059 (Command and Scripting Interpreter), and T1105 (Ingress Tool Transfer), indicating a multi-stage, persistent attack. Over 100 victims have been targeted, primarily in Taiwan, Japan, South Korea, and Hong Kong, focusing on organizations running vulnerable phpMyAdmin instances. Indicators of compromise include specific IP addresses, domains, and file hashes linked to the campaign. While no known exploits in the wild have been reported for this specific vulnerability, the use of publicly available tools and open-source software repurposed for malicious use increases the attack surface. The campaign highlights the evolving threat landscape where legitimate tools are weaponized by advanced persistent threat actors to evade detection and maintain long-term access.

Detailed information about The Crown Prince, Nezha: A New Tool Favored by China-Nexus Threat Actors. Get real-time updates, technical details, and mitigation st

The Crown Prince, Nezha: A New Tool Favored by China-Nexus Threat Actors - Live Threat Intelligence - Threat Radar | OffSeq.com

The Crown Prince, Nezha: A New Tool Favored by China-Nexus Threat Actors

A sophisticated cyber campaign utilizing the open-source Nezha tool has been discovered targeting vulnerable web applications since August 2025. Attackers gained access through an exposed phpMyAdmin panel, employing creative log poisoning techniques to implant a PHP web shell. The intrusion involved the use of AntSword for server control, followed by the installation of Nezha agent and Ghost RAT malware. This marks the first public report of Nezha being used for web server compromises. The campaign, linked to China-based infrastructure, affected over 100 systems, primarily in Taiwan, Japan, South Korea, and Hong Kong. Attackers used Nezha to disable Windows Defender and deploy Ghost RAT, establishing persistence under the name 'SQLlite'. Recommendations include patching public-facing applications, implementing authentication, and improving detection for post-exploitation activities.

This sophisticated cyber campaign, active since August 2025, targets vulnerable web applications by exploiting exposed phpMyAdmin panels, a widely used web-based database management tool. Attackers employ a creative log poisoning technique to inject a PHP web shell, allowing initial foothold on the server. Following this, they use AntSword, a known web shell management tool, to gain interactive control over the compromised servers. Subsequently, the attackers install the Nezha agent—an open-source remote administration tool (RAT) not previously reported in web server compromises—and Ghost RAT malware. Nezha is used to disable Windows Defender, effectively neutralizing endpoint defenses, while Ghost RAT facilitates remote access and data exfiltration. Persistence is established under the alias 'SQLlite', likely to evade detection. The campaign infrastructure is linked to China-based servers and has impacted over 100 systems primarily in Taiwan, Japan, South Korea, and Hong Kong. The attack chain involves exploitation of phpMyAdmin (CWE-287: Improper Authentication), log poisoning (a form of injection), and post-exploitation techniques aligned with MITRE ATT&CK tactics such as persistence (T1543.003), command and control (T1071), exploitation of public-facing applications (T1190), and defense evasion (T1562.001). No CVE or known exploits in the wild are reported yet, but the campaign demonstrates advanced multi-stage intrusion capabilities targeting web-facing infrastructure.

Detailed information about Nezha Tool Used in New Cyber Campaign Targeting Web Applications. Get real-time updates, technical details, and mitigation strategies

Title	Severity	Type	Source	Date

Threats Tagged 'log poisoning'

Stop chasing alerts. Route them.

Filter Threats

Threats Tagged 'log poisoning'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility