Threat Actors Weaponizing Nezha Monitoring Tool as Remote Access Trojan

Cybersecuritynews •Tushar Subhra Dutta • December 23, 2025

Researchers at Ontinue’s Cyber Defense Center have uncovered a significant threat as attackers exploit Nezha, a legitimate open-source server monitoring tool, for post-exploitation access. The discovery reveals how sophisticated threat actors repurpose benign software to gain complete control over compromised systems while evading traditional security detection mechanisms. Nezha, originally developed for the Chinese IT community, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Nezha Monitoring Tool Exploited as Remote Access Trojan by Cybercriminals Cybersecurity researchers at Ontinue’s Cyber Defense Center have identified that the Nezha monitoring tool, originally designed for server management, is being exploited by threat actors as a Remote Access Trojan (RAT). This misuse allows attackers to gain full control over compromised systems while avoiding detection by traditional security measures. The tool is widely used across Windows and Linux environments. 6 sources 47

Threat Actors Weaponizing Nezha Monitoring Tool as Remote Access Trojan

The full story

Extracted Entities

Attack Types (1)

Malware (1)