{
  "name": "The Crown Prince, Nezha: A New Tool Favored by China-Nexus Threat Actors",
  "slug": "the-crown-prince-nezha-a-new-tool-favored-by-china-nexus-threat-actors",
  "description": "A sophisticated cyber intrusion campaign utilizing log poisoning and a new tool called Nezha has been uncovered. The attackers exploited a vulnerable phpMyAdmin interface to deploy a web shell, followed by the installation of Nezha, an open-source server monitoring tool repurposed for malicious activities. The campaign targeted over 100 victims, primarily in Taiwan, Japan, South Korea, and Hong Kong. The threat actors also deployed Ghost RAT, a remote access trojan, for further system compromise. The attack methodology and victimology suggest a China-nexus threat actor, highlighting the need for improved security measures and vigilance against emerging threats.",
  "published": "2025-10-09T14:38:49+00:00",
  "created_at": "2025-10-09T14:38:49+00:00",
  "modified_at": "2025-10-09T15:02:33+00:00",
  "created_at_opencti": "2025-10-09T14:38:49+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-10-09",
    "antsword",
    "china chopper",
    "ghost rat",
    "log poisoning",
    "nezha",
    "remote access trojan",
    "server monitoring",
    "web shell"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "38.246.250.201"
      },
      {
        "id": "",
        "name": "172.245.52.169"
      },
      {
        "id": "",
        "name": "45.207.220.12"
      },
      {
        "id": "",
        "name": "host.404111.xyz"
      },
      {
        "id": "",
        "name": "c.mid.al"
      },
      {
        "id": "",
        "name": "gd.bj2.xyz"
      },
      {
        "id": "",
        "name": "f3570bb6e0f9c695d48f89f043380b43831dd0f6fe79b16eda2a3ffd9fd7ad16"
      },
      {
        "id": "",
        "name": "9f33095a24471bed55ce11803e4ebbed5118bfb5d3861baf1c8214efcd9e7de6"
      },
      {
        "id": "",
        "name": "82611e60a2c5de23a1b976bb3b9a32c4427cb60a002e4c27cadfa84031d87999"
      },
      {
        "id": "",
        "name": "35e0b22139fb27d2c9721aedf5770d893423bf029e1f56be92485ff8fce210f3"
      },
      {
        "id": "",
        "name": "7b2599ed54b72daec0acfd32744c7a9a77b19e6cf4e1651837175e4606dbc958"
      }
    ],
    "malware": [
      {
        "id": "6f6d7661-9298-489c-b699-247a067239b5",
        "name": "Nezha",
        "slug": "nezha"
      },
      {
        "id": "59b70500-cf78-4d6d-836f-e4dade698c7b",
        "name": "Ghost RAT",
        "slug": "ghost-rat"
      }
    ],
    "intrusion_sets": [
      {
        "id": "e62c53a2-f33c-4855-8143-625544812879",
        "name": "China-nexus threat actors",
        "slug": "china-nexus-threat-actors"
      }
    ],
    "attack_patterns": [
      {
        "id": "beaa4978-0309-438b-a45e-ec566b643811",
        "name": "T1505.003"
      },
      {
        "id": "1eef7f88-3992-4add-899e-a7cc9fcdd5b3",
        "name": "T1569.002"
      },
      {
        "id": "b15c00da-c412-4429-900c-659de612baf5",
        "name": "T1543.003"
      },
      {
        "id": "14ea0786-b57c-4a30-8e4e-46944d17eb18",
        "name": "T1036.004"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "93b2c4dd-5523-4464-8976-78754ee372fd",
        "name": "T1012"
      },
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "5b7c66d1-0466-4ba7-af6f-eb82c2f9d05b",
        "name": "T1033"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Hong Kong"
      },
      {
        "id": "",
        "name": "Taiwan"
      },
      {
        "id": "",
        "name": "Japan"
      }
    ]
  },
  "external_refs": [
    "https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool",
    "https://otx.alienvault.com/pulse/68e7e51909bb02e0f22bfc5a"
  ]
}