Huntress traces web intrusion using Nezha and Ghost RAT across 100+ potential victims
Summary
Huntress traced an August 2025 intrusion using exposed phpMyAdmin, MariaDB log poisoning, a web shell, Nezha and Ghost RAT across 100+ potential victims. A China-nexus attribution was later questioned by an unverified tip.
Key points
- Huntress found that an attacker accessed an internet-exposed phpMyAdmin panel that lacked authentication, then used MariaDB query logging to plant a PHP web shell.
- The attacker used the shell through AntSword, installed the Nezha monitoring agent, and then used it to deploy Ghost RAT.
- Huntress observed more than 100 potential victim systems connected to the Nezha server, with many located in Taiwan, Japan, South Korea and Hong Kong.
- Before deploying Ghost RAT, the attacker added a Windows Defender exclusion; the malware established persistence using a service disguised as “SQLlite.”
- Huntress initially assessed the activity as likely China-nexus, but an anonymous tip proposing VPS hobbyists as an alternative was not independently verified.
- Huntress isolated its investigated system and removed the web shell, Nezha agent and malware.
Article Details
- Attack Vectors
- The attacker accessed an internet-exposed phpMyAdmin panel that was reportedly unauthenticated because of a flawed configuration and a recent DNS record change.
- The attacker used MariaDB general query logging and a PHP file extension to write a web shell into a web-accessible directory, then sent commands through the shell.
- The attacker used AntSword’s virtual terminal to download and run the Nezha agent and a Ghost RAT payload.
- The attacker used the Nezha agent to open an interactive PowerShell session, add a Windows Defender exclusion, and execute the payload.
- Defensive Notes
- Patch and harden public-facing applications, require authentication where possible, and avoid exposing test environments.
- Monitor for web shells, suspicious service creation, and executables running from unusual directories.
- Huntress reported isolating the affected system and removing the web shell, Nezha agent, and malware.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | c[.]mid[.]al | Attacker server address configured in the Nezha agent. |
| DOMAIN | gd[.]bj2[.]xyz | Ghost RAT command-and-control domain; the article says it resolves to 45.207.220[.]12. |
| IPV4 | 172[.]245[.]52[.]169 | IP address listed in the article as associated with the Nezha command-and-control domain. |
| IPV4 | 45[.]207[.]220[.]12 | IP address identified as used to operate the web shell and as Ghost RAT command-and-control infrastructure. |
| IPV4 | 54[.]46[.]50[.]255 | IP address the article identifies as used by the attacker to access the phpMyAdmin panel. |
| SHA256 | 35e0b22139fb27d2c9721aedf5770d893423bf029e1f56be92485ff8fce210f3 | SHA-256 of the malicious 32138546.dll loaded by the dropped SQLlite.exe. |
| SHA256 | 7b2599ed54b72daec0acfd32744c7a9a77b19e6cf4e1651837175e4606dbc958 | SHA-256 of x.exe, identified as a likely Ghost RAT variant. |
| SHA256 | 82611e60a2c5de23a1b976bb3b9a32c4427cb60a002e4c27cadfa84031d87999 | SHA-256 of SQLlite.exe, identified as a malware-dropped, renamed rundll32.exe used to load the malicious DLL. |
| SHA256 | 9f33095a24471bed55ce11803e4ebbed5118bfb5d3861baf1c8214efcd9e7de6 | SHA-256 of live.exe, identified as the installer for the Nezha agent used in the intrusion. |
| SHA256 | f3570bb6e0f9c695d48f89f043380b43831dd0f6fe79b16eda2a3ffd9fd7ad16 | SHA-256 of the malicious PHP web shell at C:\xamp\htdocs\123.php. |
| URL | hxxps[:]//rism[.]pages[.]dev/microsoft.exe | Specific payload-download URL used to retrieve the executable identified as a Nezha agent installer. |
MITRE ATT&CK
T1036.004 · Masquerade Task or ServiceThe malware used a service named SQLlite and a similarly named executable to present its persistence component as a legitimate SQLite-related component.T1059.001 · PowerShellThe Nezha agent spawned an elevated PowerShell session that ran Add-MpPreference and launched x.exe.T1071.001 · Web ProtocolsThe article identifies HTTP POST requests through the web shell and Ghost RAT communications with its command-and-control infrastructure.T1105 · Ingress Tool TransferThe attacker used curl to download live.exe from the specified URL and deployed additional payloads.T1190 · Exploit Public-Facing ApplicationThe attacker gained initial access through an exposed, unauthenticated phpMyAdmin panel.T1505.003 · Web ShellThe attacker used MariaDB query logging to write a PHP web shell into a web-accessible directory and then operated it through HTTP requests.T1543.003 · Windows ServiceThe malware created a persistence mechanism using a service named SQLlite.T1547.001 · Registry Run Keys / Startup FolderThe Ghost RAT payload copied an executable to Common Files and set a registry key to run it at startup.T1562.001 · Disable or Modify ToolsThe attacker added C:\WINDOWS as a Windows Defender exclusion before executing the Ghost RAT payload.
Malware
Gh0st RATAnalysis of x.exe revealed it was likely a variant of Ghost RAT (also known as Gh0st RAT).Ghost RATQuestions still remain as to why someone with these intentions would deploy Ghost RAT on an endpoint, or would have the majority of systems under their control in locations which have direct geopolitical conflict with
Vendors
Products
ApacheAnalysis of the Apache web server access logs indicates that the threat actor’s initial point of entry was via the phpMyAdmin panel.Huntress EDRTo gain visibility into the exact command, Huntress leveraged telemetry from the Huntress EDR product.MariaDBis likely not the first time they’ve used log poisoning to deploy a web shell through phpMyAdmin and MariaDB.phpMyAdminAnalysis of the Apache web server access logs indicates that the threat actor’s initial point of entry was via the phpMyAdmin panel.Windows DefenderAfter installing the Nezha agent, it was used to run an interactive PowerShell so that Windows Defender exclusions could be created before deploying and running another executable called x.exe.XAMPPThe problem is that Apache distributions, such as XAMPP, by default, run both the database service and web service under the same user account.
Tools
AntSwordThis allowed the threat actor to control the web server using AntSword, before ultimately deploying Nezha, an operation and monitoring tool that allows commands to be run on a web server.NezhaHomeBlogThe Crown Prince, Nezha: A New Tool Favored by China-Nexus Threat ActorsProcdotPerforming quick dynamic analysis with x.exe in a VM using Procmon and Procdot revealed a number of indicators:ProcmonPerforming quick dynamic analysis with x.exe in a VM using Procmon and Procdot revealed a number of indicators:ShodanWinRM to the internet, which exposed details about the system behind the IP address to services such as Shodan, which included a hostname of WIN-DNF8DJKNVH0.
Countries
ChinaHomeBlogThe Crown Prince, Nezha: A New Tool Favored by China-Nexus Threat ActorsHong KongAnalysis of the intrusion revealed the threat actor had likely compromised more than 100 victim machines, with the most frequent location of these machines appearing to be in Taiwan, Japan, South Korea, and Hong Kong.JapanAnalysis of the intrusion revealed the threat actor had likely compromised more than 100 victim machines, with the most frequent location of these machines appearing to be in Taiwan, Japan, South Korea, and Hong Kong.South KoreaAnalysis of the intrusion revealed the threat actor had likely compromised more than 100 victim machines, with the most frequent location of these machines appearing to be in Taiwan, Japan, South Korea, and Hong Kong.TaiwanAnalysis of the intrusion revealed the threat actor had likely compromised more than 100 victim machines, with the most frequent location of these machines appearing to be in Taiwan, Japan, South Korea, and Hong Kong.