As cited
Copy frozen at (site build).
threat intel
The Crown Prince, Nezha | Huntress
Huntress has identified a previously unreported tool called Nezha being deployed since mid-2025 to compromise web servers, often used alongside Ghost RAT and AntSword for malware and web shell management.
Why it matters: Organizations running web servers need to monitor for Nezha indicators of compromise and review access logs for signs of web shell deployment, as this tool facilitates persistent server access.
- Source published
- First seen by Cybersecurity Tracker