Tag: log poisoning

2 Attack Reports | 0 Vulnerabilities

Attack reports

The Crown Prince, Nezha: A New Tool Favored by China-Nexus Threat Actors

A sophisticated cyber intrusion campaign utilizing log poisoning and a new tool called Nezha has been uncovered. The attackers exploited a vulnerable phpMyAdmin interface to deploy a web shell, followed by the installation of Nezha, an open-source server monitoring tool repurposed for malicious act…
china chopper
web shell
remote access trojan
antsword
ghost rat
log poisoning
nezha
2025-10-09
server monitoring
Published: October 9, 2025
Downloadable IOCs: 11

Nezha Tool Used in New Cyber Campaign Targeting Web Applications

A sophisticated cyber campaign utilizing the open-source Nezha tool has been discovered targeting vulnerable web applications since August 2025. Attackers gained access through an exposed phpMyAdmin panel, employing creative log poisoning techniques to implant a PHP web shell. The intrusion involve…
antsword
ghost rat
2025-10-08
phpmyadmin
log poisoning
nezha
mariadb
china-linked
web applications
Published: October 8, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports