Threat actors suspected to be affiliated with China have repurposed the legitimate open-source monitoring tool Nezha as an attack vector to deliver Gh0st RAT malware. Observed first in August 2025, this campaign employs a technique known as log poisoning to plant a web shell on servers. This method allows attackers to control the web server using ANTSWORD before deploying Nezha, which facilitates remote command execution. More than a hundred (100) machines have been compromised, predominantly in Taiwan, Japan, South Korea, and Hong Kong. The attackers initially gain access through vulnerable phpMyAdmin panels, leveraging SQL query interfaces to plant PHP web shells. This access allows them to execute commands and remotely control infected hosts via Nezha. Interestingly, the threat actors operate their Nezha dashboard in Russian, indicating a broad reach with victims in countries such as Singapore, Malaysia, India, the U.K., and the U.S. The Nezha agent supports further attacks by executing PowerShell scripts to bypass Microsoft Defender and deploy Gh0st RAT.