The Crown Prince, Nezha: A New Tool Favored by China-Nexus Threat Actors

**Executive summary:** Huntress discovered a multi-stage intrusion (Aug 2025) where attackers used phpMyAdmin log poisoning to drop a China Chopper web shell, used AntSword to run remote commands, installed a Nezha RMM agent, and deployed Ghost RAT across more than 100 victims primarily in Taiwan, Japan, South Korea and Hong Kong; the report provides detailed malware analysis, IOCs (files, domains, IPs, mutexes), victim geography, and TTPs and assesses a China-nexus actor (while noting a possible VPS-enthusiast motivation).