Tag: antsword

4 Attack Reports | 0 Vulnerabilities

Attack reports

The Crown Prince, Nezha: A New Tool Favored by China-Nexus Threat Actors

A sophisticated cyber intrusion campaign utilizing log poisoning and a new tool called Nezha has been uncovered. The attackers exploited a vulnerable phpMyAdmin interface to deploy a web shell, followed by the installation of Nezha, an open-source server monitoring tool repurposed for malicious act…
china chopper
web shell
remote access trojan
antsword
ghost rat
log poisoning
nezha
2025-10-09
server monitoring
Published: October 9, 2025
Downloadable IOCs: 11

Nezha Tool Used in New Cyber Campaign Targeting Web Applications

A sophisticated cyber campaign utilizing the open-source Nezha tool has been discovered targeting vulnerable web applications since August 2025. Attackers gained access through an exposed phpMyAdmin panel, employing creative log poisoning techniques to implant a PHP web shell. The intrusion involve…
antsword
ghost rat
2025-10-08
phpmyadmin
log poisoning
nezha
mariadb
china-linked
web applications
Published: October 8, 2025
Downloadable IOCs: 0

Echoes in the Shell: Legacy Tooling Behind Ongoing SharePoint 'ToolShell' Exploitation

Chinese nation-state actors are exploiting vulnerabilities in Microsoft SharePoint on-premises infrastructure. The attacks chain together multiple recently disclosed vulnerabilities, collectively known as 'ToolShell', to perform unauthenticated code execution, extract cryptographic keys, and deploy…
valleyrat
china chopper
sharepoint
antsword
CVE-2025-53770
CVE-2025-53771
toolshell
CVE-2025-49704
CVE-2025-49706
2025-08-11
requestrepo
Published: August 11, 2025
Linked vulnerabilities : CVE-2019-0604, CVE-2025-53770 (CVSS 9.8), CVE-2025-53771 (CVSS 7.1), CVE-2025-49704, CVE-2025-49706
Downloadable IOCs: 1

Exploits Cityworks zero-day vulnerability to deliver malware

Chinese-speaking threat actors, dubbed UAT-6382, have been exploiting a remote-code-execution vulnerability (CVE-2025-0994) in Cityworks, a popular asset management system. The attacks, which began in January 2025, target local governing bodies in the United States, focusing on utilities management…
cobalt strike
exploitation
china chopper
chinese threat actors
CVE-2025-0994
vshell
web shells
2025-05-22
antsword
tetraloader
cityworks
Published: May 22, 2025
Linked vulnerabilities : CVE-2025-0944 (CVSS 6.3)
Downloadable IOCs: 18
Click here to see more Attack Reports