Darktrace’s Malware Research Engineer Nathaniel Bill published analysis on June 10 of an intrusion against a Docker-based honeypot in which attackers used a misconfigured container to escape to the host and install Nezha — a legitimate, open-source Chinese server monitoring tool with roughly 10,000 GitHub stars — as a covert command-and-control implant. The attack chain began with a malicious docker create command that passed the host’s cron.d directory through to the container; the attacker then wrote a root-level cron job that fetched and executed a remote shell script, which downloaded a modified version of Nezha’s official installer pre-configured with the attacker’s server address and stripped of interactive prompts. Because Nezha is a recognized administrative tool, its presence can blend into expected operational tooling and evade malware-centric detection — a technique Darktrace terms “trust inversion.” At the time of analysis the attacker’s Nezha dashboard showed 141 infected servers, 45 still online; the campaign also revealed a design quirk — Nezha’s monitoring panel requires no authentication to view the host list, allowing the scale and geographic distribution of the victim pool to be read openly. Darktrace separately identified 33 internet-facing Nezha installations accessible via Shodan and Censys.
In parallel, the Chinese-language VPS community has been building defensive tooling. GitHub project Nezha-cleaner (41 stars, MIT license) provides a 10-step bash script that terminates Nezha processes, removes its systemd services and binaries, clears cron entries, and scans the file system for residual traces — with v1.4, released this month, adding three-layer Docker protection to avoid accidentally removing unrelated containers. The project was first published in May 2025 and has iterated rapidly, suggesting a sustained underlying problem of unauthorized Nezha installations on Linux VPS hosts. The NodeSeek forum thread linked alongside these sources reflects active community discussion of detection and remediation. Darktrace’s broader takeaway: as dual-use software abuse grows more common, organizations should invest in behavioral and asset-visibility controls rather than relying solely on signature-based malware detection, particularly in cloud environments where legitimate monitoring tools and attacker backdoors can be functionally indistinguishable.