Hackers Abuse Popular Monitoring Tool Nezha as a Stealth Trojan

**Executive summary:** Researchers report that the open-source server monitoring tool Nezha is being repurposed by attackers as a full-featured Remote Access Trojan (RAT) with SYSTEM/root-level capabilities, cross-platform support, low antivirus detection, and command-and-control infrastructure linked to Alibaba Cloud; organisations should proactively hunt for unapproved Nezha agents and focus on usage/context rather than treating tools as strictly benign or malicious.