Cyberattack Campaign Exploits Web Apps with Log Poisoning
Cyber Security News by CyberSum.net
Security researchers have uncovered a sophisticated cyberattack campaign where threat actors exploit web applications using log poisoning to deploy web shells and weaponize Nezha, a legitimate server monitoring tool, for malicious command execution. The attack begins with exploiting vulnerable phpMyAdmin panels lacking proper authentication. Threat actors set the language to simplified Chinese upon access, indicating their likely origin. Within 30 seconds, they execute SQL commands to enable logging and deploy their web shell payload. The log poisoning technique involves manipulating MariaDB’s logging functionality to write malicious PHP code into log files with executable extensions. Following web shell deployment, threat actors install Nezha agents on compromised systems. Nezha, marketed as a lightweight open-source server monitoring tool, is repurposed for malicious command execution and persistent access. The campaign demonstrates how threat actors increasingly abuse publicly available tools to achieve their objectives while maintaining plausible deniability.