Skip to main content
Mallory
Back to threat actors
3 malware families

china_nexus_apt

Also known aschina_nexus_apt

A China-nexus advanced persistent threat (APT) group that EclecticIQ attributed with high confidence as the primary actor behind the 2025 exploitation wave targeting Ivanti Endpoint Manager Mobile (EPMM) zero-day vulnerabilities CVE-2025-4427 and CVE-2025-4428. The campaign targeted Internet-facing Ivanti EPMM servers and affected thousands of organizations, particularly in Europe, including hospitals, a UK government entity, and organizations in telecommunications and financial services. Reported post-compromise activity included deploying reverse shells on compromised Ivanti servers, searching system directories and configuration files to obtain unencrypted database credentials, accessing MySQL to obtain EPMM encryption keys, and decrypting sensitive platform data. The actor’s access to EPMM could enable abuse of legitimate administrative functions against enrolled mobile devices, including resetting PINs, unlocking devices, pushing security configurations, deploying applications or malware, and installing root certificates to intercept and decrypt mobile web traffic. If cloud integrations were enabled, attackers could obtain valid access tokens for Google Workspace, Salesforce, and Microsoft 365, with potential for broader enterprise compromise and business email compromise. Attribution indicators cited in the content include China Telecom-hosted command-and-control infrastructure, use of open-source reconnaissance tools documented in Mandarin, and use of the open-source FRP reverse-proxy tool for tunneling, lateral movement, and internal network access. No additional aliases or sub-groups are provided in the content.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial
OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

  • healthcare
  • government
  • telecommunications
  • financial
ARSENAL

Associated malware families

3 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen
AntSwordHuntress said Nezha was used in tandem with other families of malware and web shell management tools, such as Ghost RAT and AntSword. One of the first clues leading them to attribute the incident to Chinese actors was that, upon accessing the administrative interface of the compromised system, the hacker set the language to simplified Chinese. Minton added that even though Huntress stopped short of formally attributing the campaign to a specific Chinese threat actor, the use of Ghost RAT and AntSword was a clue because they both have been used before in activity publicly attributed to Chinese APT groups.1Mar 18, 2026
Ghost RATHuntress said Nezha was used in tandem with other families of malware and web shell management tools, such as Ghost RAT and AntSword. One of the first clues leading them to attribute the incident to Chinese actors was that, upon accessing the administrative interface of the compromised system, the hacker set the language to simplified Chinese. Minton added that even though Huntress stopped short of formally attributing the campaign to a specific Chinese threat actor, the use of Ghost RAT and AntSword was a clue because they both have been used before in activity publicly attributed to Chinese APT groups.1Mar 18, 2026
NezhaResearchers found evidence that suspected China-based actors used a monitoring tool called Nezha during compromises of more than 100 victim machines in Taiwan, Japan, South Korea and Hong Kong. Incident responders at cybersecurity firm Huntress said they initially came across the campaign while investigating a vulnerable, public-facing web application that was the source of an intrusion at the beginning of August. The threat actor took over a web shell before deploying Nezha — an operation and monitoring tool that allows commands to be run on a web server.1Mar 18, 2026
ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Start free trial
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal3

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.