Ontinue’s Cyber Defense Center has uncovered a sophisticated attack campaign leveraging Nezha, a legitimate open-source server monitoring utility, as a post-exploitation remote access trojan (RAT).
The tool, initially designed for system administrators to monitor servers and perform maintenance tasks, provides attackers with SYSTEM-level access on Windows and root privileges on Linux systems, complete with file management capabilities and interactive web terminal sessions.
The discovery highlights a growing trend in threat actor tradecraft: weaponizing legitimate administrative tools to evade security detection.
VirusTotal analysis reveals zero detections across 72 security vendors, as Nezha is not inherently malicious it is legitimate software configured to communicate with attacker-controlled infrastructure rather than authorized servers.
Nezha’s architecture consists of a central dashboard server that coordinates lightweight agents deployed on monitored systems.
While intended for legitimate system administration, these capabilities including remote command execution, file transfer, and interactive shell access also make it equally valuable to malicious actors.
Installation occurs silently through a single bash command that downloads and configures the agent with attacker-controlled server details and authentication tokens.
During incident response, Ontinue SOC discovered a deployment script containing several revealing indicators.
The script referenced a command-and-control server hosted on Alibaba Cloud infrastructure at IP address 47.79.42[.]91, geolocated in Japan.
Chinese-language error messages embedded in the script suggest a native or fluent Mandarin speaker authored the deployment code, though such linguistic indicators are easily falsified and should not be considered definitive attribution.
Huntress published earlier research in October 2025 documenting similar Nezha abuse targeting organizations across East Asia, confirming this is not an isolated incident but part of a broader campaign pattern.
Technical Capabilities and Agent Function
Nezha employs a client-server model where agents maintain persistent gRPC connections to the dashboard.
The system multiplexes HTTP and gRPC traffic on a single port (default 8008), with web browsers accessing the dashboard interface via HTTP/WebSocket while agents communicate through gRPC for command and control.
The agent supports multiple task types, with three particularly relevant for attackers:
| Task Type | ID | Description |
|---|---|---|
| Command | 4 | Arbitrary command execution |
| Terminal (gRPC) | 8 | Interactive terminal session |
| File Manager | 11 | File operations (browse, upload, download, delete) |
Default credentials on first deployment are “admin:admin,” and agents authenticate using a shared client_secret passed in gRPC metadata.
The terminal spawns a pseudo-terminal (PTY) that inherits the agent’s process context, meaning shells run with root or SYSTEM privileges by design.
Mitigations
Organizations should implement behavioral monitoring to detect post-exploitation activity, as signature-based detection cannot flag legitimate binaries.
USA as the most common location for this software running on the internet exceeded my expectations. Given that the software was designed in China, I did not expect this outcome.
Critical protections include deploying Microsoft Defender for Endpoint with Tamper Protection enabled, configuring Attack Surface Reduction (ASR) rules to block credential theft from LSASS and process creation from WMI, and establishing baselines of authorized remote management tools.
Ontinue has published hunting queries and indicators of compromise via their GitHub repository to assist security teams in proactively identifying unauthorized Nezha agents within enterprise environments.
The incident underscores that defenders must shift focus from known-bad indicators to behavioral anomaly detection and contextual analysis when confronting legitimate-tool abuse.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
