The Crown Prince, Nezha: A New Tool Favored by China-Nexus Threat Actors (opens in new tab)

Beginning in mid-2025, Huntress discovered a new tool being used to facilitate webserver intrusions known as Nezha, which up until now hasn’t been publicly reported on. This was used in tandem with other families of malware and web shell management tools such as Ghost RAT and AntSword.