Full Report
Beginning in mid-2025, Huntress discovered a new tool being used to facilitate webserver intrusions known as Nezha, which up until now hasn’t been publicly reported on. This was used in tandem with other families of malware and web shell management tools such as Ghost RAT and AntSword.
Analysis Summary
# Tool/Technique: Nezha
## Overview
Nezha is an open-source operation and monitoring tool that functions as a dashboard for managing multiple servers. While designed for legitimate system administration (popular among VPS enthusiasts in Mainland China), it has been adopted by threat actors as a lightweight Command and Control (C2) agent. It allows attackers to maintain persistence, monitor system status, and execute remote commands on compromised web servers.
## Technical Details
- **Type:** Attack Tool / Monitoring Framework (Dual-use)
- **Platform:** Cross-platform (Linux, Windows, macOS)
- **Capabilities:** Remote command execution, real-time resource monitoring (CPU, RAM, Network), terminal access, and file management.
- **First Seen:** Publicly reported in a malicious context in August 2025.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1190 - Exploit Public-Facing Application] (Used via log poisoning/injection)
- **[TA0003 - Persistence]**
- [T1105 - Ingress Tool Transfer]
- **[TA0002 - Execution]**
- [T1059.003 - Command and Scripting Interpreter: Windows Command Shell]
- [T1059.004 - Command and Scripting Interpreter: Unix Shell]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
## Functionality
### Core Capabilities
- **Remote Shell Access:** Provides a web-based terminal to execute commands directly on the host.
- **Resource Monitoring:** Real-time tracking of system performance, which helps attackers assess the value of a compromised node.
- **Centralized Management:** Ability to manage hundreds of compromised "nodes" from a single Nezha dashboard.
### Advanced Features
- **Plausible Deniability:** Because it is a legitimate tool used by hobbyists to bypass the "Great Firewall," its presence is harder to categorize as inherently malicious compared to bespoke malware.
- **Multi-Stage Deployment:** Used as a middle-tier tool to bridge the gap between initial web shell access (AntSword/China Chopper) and high-level backdoors (Ghost RAT).
## Indicators of Compromise
*Note: Specific hashes were not provided in the truncated article text; indicators focus on behavioral and naming conventions mentioned.*
- **File Names:** `nezha-agent`, `dashboard` (commonly renamed to blend in).
- **Network Indicators:**
- Communication with C2 dashboards often hosted on international VPS providers.
- Links to infrastructure associated with **Moedove LLC**.
- **Behavioral Indicators:**
- Log entries showing **Log Poisoning** attempts (injection of PHP/ASP code into server logs).
- Web server processes (e.g., `httpd`, `nginx`, `w3wp.exe`) spawning Nezha agent binaries.
- Inbound connections to AntSword management interfaces.
## Associated Threat Actors
- **China-Nexus Actors:** Primarily targeting entities in Taiwan, Japan, South Korea, and Hong Kong.
- **VPS Enthusiast Communities:** Individuals using the tool for "experimentation" or bypassing internet restrictions (Great Firewall), though their activity overlaps with malicious intrusion TTPs.
## Detection Methods
- **Signature-based detection:** Scanning for the Nezha agent binary and associated configuration files (`config.yaml` or similar).
- **Behavioral detection:**
- Monitoring for **Log Poisoning** attempts where HTTP headers (User-Agent, Referer) contain executable code strings (e.g., `eval()`, `base64_decode`).
- Auditing web server logs for high-frequency access to specific files from known China Chopper/AntSword management patterns.
- **YARA Rules:** Target the unique strings within the Nezha Go-based agent and the AntSword web shell components.
## Mitigation Strategies
- **Input Validation:** Implement strict validation to prevent log injection/poisoning.
- **Least Privilege:** Ensure web service accounts do not have permissions to write to directories where binaries can be executed.
- **Egress Filtering:** Restrict web server outbound traffic to only necessary update services to block C2 communication.
- **Patch Management:** Regularly update public-facing web applications to prevent initial exploitation.
## Related Tools/Techniques
- **AntSword / China Chopper:** Used for initial web shell management and log poisoning.
- **Ghost RAT:** A classic Trojan deployed via Nezha for deeper system persistence.
- **Log Poisoning:** The specific technique used to achieve the initial Nezha deployment.