Nezha Tool Used in New Cyber Campaign Targeting Web Applications

Huntress discovered an August 2025 campaign where attackers gained access through an internet-exposed phpMyAdmin, used MariaDB general query log poisoning to plant a PHP web shell, then leveraged AntSword to deploy a Nezha agent (live.exe) and a Ghost RAT variant (x.exe), affecting over 100 systems across APAC and other regions; the operators disabled Windows Defender, created persistence named "SQLlite", and connected to China-linked C2 domains. Researchers recommend patching public-facing apps, enforcing authentication, and improving detection of web shells and post-exploitation activity.