{
  "name": "The Crown Prince, Nezha",
  "slug": "the-crown-prince-nezha",
  "description": "Beginning in August 2025, a sophisticated intrusion was discovered where attackers used log poisoning techniques to deploy a web shell on vulnerable phpMyAdmin panels. The threat actors exploited misconfigured web applications to plant China Chopper web shells, controlled via AntSword, before deploying Nezha, an open-source monitoring tool, to facilitate remote command execution. This led to the deployment of Ghost RAT on compromised systems. Analysis revealed over 100 compromised machines, predominantly located in Taiwan, Japan, South Korea, and Hong Kong. The attackers demonstrated technical proficiency through multi-stage operations, utilizing AWS and VPS infrastructure, with indicators pointing to China-nexus threat actors. The campaign highlights increasing abuse of legitimate publicly available tools to achieve malicious objectives while maintaining plausible deniability.",
  "published": "2026-07-03T21:26:02.504000+00:00",
  "created_at": "2026-07-06T09:30:50.369000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-07-06T09:30:50.369000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "antsword",
    "china chopper",
    "china-nexus",
    "gh0st rat",
    "ghost rat",
    "log poisoning",
    "nezha",
    "phpmyadmin",
    "web compromise",
    "web shell"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "1a439a87-0c81-40ac-8c01-6dfc40206790",
        "name": "c.mid.al"
      },
      {
        "id": "fbe9c8fa-0844-4f31-b88c-46519eadf302",
        "name": "gd.bj2.xyz"
      },
      {
        "id": "61b9af7d-730e-4dc7-a3a2-4959cd1d0b21",
        "name": "9f33095a24471bed55ce11803e4ebbed5118bfb5d3861baf1c8214efcd9e7de6"
      },
      {
        "id": "70551ff5-1c11-4411-9cb1-296c36afc39a",
        "name": "f3570bb6e0f9c695d48f89f043380b43831dd0f6fe79b16eda2a3ffd9fd7ad16"
      },
      {
        "id": "c300ebdf-d208-40fd-92d5-a8396a256314",
        "name": "45.207.220.12"
      },
      {
        "id": "1b062437-be2e-4a61-b5cb-a74994b70375",
        "name": "host.404111.xyz"
      },
      {
        "id": "e7fc7c1c-a5dc-484b-8c02-653fdad189f6",
        "name": "7b2599ed54b72daec0acfd32744c7a9a77b19e6cf4e1651837175e4606dbc958"
      },
      {
        "id": "7bd2caff-7806-4c07-b294-66d5bef07917",
        "name": "38.246.250.201"
      },
      {
        "id": "5f5e65e5-317b-4d54-b0e4-bac61f35dbfb",
        "name": "35e0b22139fb27d2c9721aedf5770d893423bf029e1f56be92485ff8fce210f3"
      }
    ],
    "attack_patterns": [
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "9643a7e9-771b-4396-83a3-26fcec5200e4",
        "name": "T1021.006"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "beaa4978-0309-438b-a45e-ec566b643811",
        "name": "T1505.003"
      },
      {
        "id": "f6ceeba2-b50c-47dc-8642-ab9842ca76d7",
        "name": "T1018"
      },
      {
        "id": "81b422de-709e-43bd-b471-2befac0c623a",
        "name": "T1218.011"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "2e0c6db7-16a7-4bf6-992e-263474014fce",
        "name": "T1059.004"
      },
      {
        "id": "7364ca96-72bf-4b7f-afef-ce2583b1ed58",
        "name": "T1562.001"
      },
      {
        "id": "b15c00da-c412-4429-900c-659de612baf5",
        "name": "T1543.003"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "1eef7f88-3992-4add-899e-a7cc9fcdd5b3",
        "name": "T1569.002"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "3ccbe4bd-0466-4cbc-9645-5082016edc19",
        "name": "T1070.006"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      }
    ],
    "malware": [
      {
        "id": "6f6d7661-9298-489c-b699-247a067239b5",
        "name": "Nezha",
        "slug": "nezha"
      },
      {
        "id": "b5013c64-25ac-406d-85a1-630ba29e50d6",
        "name": "AntSword",
        "slug": "antsword"
      },
      {
        "id": "db3270fd-1a2b-4c8f-b6b5-9332b19e2c3a",
        "name": "Mydoor",
        "slug": "moudoor"
      },
      {
        "id": "4246420b-b8ae-4379-8ed8-4c4669807daa",
        "name": "China Chopper - S0020",
        "slug": "china-chopper-s0020"
      },
      {
        "id": "db7f167e-24b0-49d3-b8e0-ef250e0c5046",
        "name": "gh0st RAT - S0032",
        "slug": "gh0st-rat-s0032"
      },
      {
        "id": "59b70500-cf78-4d6d-836f-e4dade698c7b",
        "name": "Ghost RAT",
        "slug": "ghost-rat"
      }
    ],
    "observables": [
      {
        "id": "c86699ac-d1de-4285-9f31-277acb979848",
        "name": "gd.bj2.xyz"
      },
      {
        "id": "cad8c289-3073-41dc-8180-553d2348fb80",
        "name": "c.mid.al"
      },
      {
        "id": "9bc0120f-f25c-414f-87c5-6c10150813ec",
        "name": "host.404111.xyz"
      },
      {
        "id": "38affd67-d83d-4d64-9c08-df56652beff0",
        "name": "45.207.220.12"
      },
      {
        "id": "95ee9db8-7ede-44fe-9f27-a2addcfeef02",
        "name": "38.246.250.201"
      }
    ]
  },
  "external_refs": [
    {
      "id": "3d55e279-d7cf-470b-b58d-d08657c50df2",
      "standard_id": "external-reference--92407fec-ba79-580d-9e93-2567fe337746",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool?hnt=mznstlyl4ouf",
      "hash": null,
      "external_id": null,
      "created": "2026-07-06T09:30:44.321Z",
      "modified": "2026-07-06T09:30:44.321Z",
      "createdById": null
    },
    {
      "id": "e2543c78-46da-45f2-bba3-582f5bb64a6b",
      "standard_id": "external-reference--b6893872-445e-51dd-a114-40ab604ac0e2",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a4828eab61bec7567ac88b1",
      "hash": null,
      "external_id": "6a4828eab61bec7567ac88b1",
      "created": "2026-07-06T09:30:44.268Z",
      "modified": "2026-07-06T09:30:44.268Z",
      "createdById": null
    }
  ]
}