china_nexus_apt_group

A suspected China-nexus APT group described in reporting as underreported and capable. The group was observed using the legitimate open-source Nezha server monitoring and task management tool to retrieve detailed information from compromised systems, run commands, and maintain control of victim machines. In the reported campaign, initial compromise involved exploitation of a vulnerable public-facing web application, log poisoning to plant a China Chopper web shell, and use of AntSword as a virtual terminal to control the compromised web server. The actors then installed Nezha and used it to facilitate follow-on activity, including running PowerShell commands to disable Windows Defender and deploying Ghost RAT. Huntress identified more than 100 victim machines with the Nezha client installed. Reported victims were primarily in Taiwan, Japan, South Korea, and Hong Kong, and the activity was assessed as likely politically motivated, although Huntress did not formally attribute the campaign to a specific threat actor or determine whether the end goal was espionage or data theft. Attribution to a China nexus in the reporting is supported by the use of simplified Chinese in the administrative interface and overlap between the Ghost RAT sample used and malware previously linked to China-nexus APT groups targeting the Tibetan community. Additional reporting noted YARA detection for a backdoor loader used by a China-nexus APT group based on two distinct PDB path strings. Known associated tooling and malware mentioned in the content include Nezha, China Chopper, AntSword, Ghost RAT, and an unspecified backdoor loader.