Chinese Hackers Weaponize Nezha Tool to Run Commands on Web Servers

Security researchers have identified a cyberattack campaign where Chinese threat actors are exploiting web applications using a log poisoning technique. This method is used to deploy web shells and subsequently utilize Nezha, a legitimate server monitoring tool, for executing malicious commands.

In August 2025, cybersecurity firm Huntress discovered an intrusion involving log poisoning to plant a China Chopper web shell on vulnerable web servers. This technique enables threat actors to gain initial access and control compromised systems, using AntSword before deploying Nezha for persistent command execution.

The attack starts by exploiting vulnerable phpMyAdmin panels lacking proper authentication. Threat actors quickly set the language to simplified Chinese upon accessing these interfaces, indicating their likely origin.

Within 30 seconds of setting the language, attackers execute SQL commands to enable general query logging and deploy their web shell payload. The log poisoning involves manipulating MariaDB's general logging to write malicious PHP code directly into log files with executable extensions.

By naming the log file with a .php extension and placing it within the web server's directory, attackers hide their web shell among legitimate log entries while maintaining remote access.

Following successful web shell deployment, threat actors download and install Nezha agents on compromised systems. Nezha, designed as a lightweight server monitoring tool, is repurposed for malicious command execution and persistent access.

Analysis reveals attackers configured their Nezha dashboard in Russian and managed over 100 compromised machines across multiple regions, with a concentration in Taiwan, Japan, South Korea, and Hong Kong.

The threat actor's infrastructure investigation showed suspicious autonomous system registrations and domain generation algorithms consistent with advanced persistent threat operations. Attackers used cloud-based infrastructure across multiple providers, including AWS-hosted IP addresses in Hong Kong and virtual private servers in Dublin.

This campaign highlights how threat actors leverage publicly available tools to achieve their goals while maintaining plausible deniability compared to custom malware development. The low research costs, reduced detection probability, and legitimate tool appearance make this approach attractive for sustained operations.

Organizations should consider implementing network segmentation and monitoring solutions to detect suspicious administrative tool usage patterns.

The following table provides indicators of compromise associated with the Chinese threat actor campaign using Nezha monitoring tools for malicious command execution on web servers.

Category Item Type Description

Files C:\xampp\htdocs\123.php File Path Web shell file location

Files f3570bb6e0f9c695d48f89f043380b43831dd0f6fe79b16eda2a3ffd9fd7ad16 SHA256 Hash Web shell file hash

Files https://rism.pages[.]dev/microsoft.exe Download URL Nezha Agent download source

Files C:\Windows\Cursors\live.exe File Path Downloaded Nezha Agent executable

Files 9f33095a24471bed55ce11803e4ebbed5118bfb5d3861baf1c8214efcd9e7de6 SHA256 Hash Nezha Agent file hash

Files C:\Windows\Cursors\x.exe File Path Ghost RAT payload file

Files 7b2599ed54b72daec0acfd32744c7a9a77b19e6cf4e1651837175e4606dbc958 SHA256 Hash Ghost RAT payload hash

Files C:\Windows\system32\SQLlite.exe File Path Renamed rundll32.exe for persistence

Files 82611e60a2c5de23a1b976bb3b9a32c4427cb60a002e4c27cadfa84031d87999 SHA256 Hash Renamed rundll32.exe hash

Files C:\Windows\system32\32138546.dll File Path Malicious DLL component

Infrastructure 54.46.50[.]255 IP Address Initial access IP address

Infrastructure 45.207.220[.]12 IP Address Web shell C2 operator IP

Infrastructure c.mid[.]al Domain Nezha C2 domain

Infrastructure 172.245.52[.]169 IP Address Nezha C2 IP address

Infrastructure gd.bj2[.]xyz Domain Backdoor C2 domain

Miscellaneous SQLlite Service Name Persistence service identifier

Miscellaneous gd.bj2[.]xyz:53762:SQLlite Mutex Infect

Based on reporting by GBHackers.