Monitoring Tool Nezha Abused For Stealthy Post-Exploitation Access

Ontinue researchers reported a campaign in which attackers abused the legitimate Nezha monitoring platform as a post-exploitation RAT: silently installed agents run as SYSTEM/root to provide interactive shells, file transfers and remote command execution, register no detections on VirusTotal, and a compromised dashboard suggested hundreds of connected endpoints, making detection and attribution difficult.