Security researchers have flagged a critical attack leveraging two unpatched vulnerabilities in AhsayCBS to infiltrate backup servers and deploy a Python-based backdoor. The flaws—CVE-2026-105133 and CVE-2026-105134—permit authentication bypass and arbitrary command execution. Fixes for both issues were issued in mid-October 2026. The incident was first spotted by Huntress in October.
Web Shell Proliferation & Mining Operation
The breach opened the door to multiple web shells deployed on compromised servers. Attackers embedded at least five distinct Jakarta Server Pages (JSP) web shells, each serving different purposes: ranging from executing commands and transferring files to uploading payloads, conducting recursive file deletions, or self-erasing operations. One shell variant veiled itself as an image preview service—hiding encrypted payloads within PNGs and operating entirely in memory using JSP implicit objects and fully qualified class names—ensuring compatibility with any servlet container on Java Development Kit 6 or newer.
Alongside these implants, the attackers deployed cryptocurrency miners, including two XMRig instances. One masquerades as Microsoft Edge, and another (“kvm-agent.exe”) is configured to restart every minute via a SYSTEM scheduled task, each communicating with different mining pools and operating under different wallets.
Sandbox-Evasive Python Implant & Backup Environment Targeting
At the core of the attack lies a custom Python backdoor (“main.py”) engineered to avoid detection. It validates the target host by hashing the MachineGuid and seeking a corresponding marker file in the implant’s directory. Only when both checks pass does it load an embedded 64-bit DLL into memory and connect to a command-and-control server at creepexplosiondarknight[.]com. To further conceal its activity, the attackers altered Microsoft Defender exclusions and delivered tools like GOST, Chisel, AnyDesk, Atera, and Splashtop for tunneling and remote access.
Investigators also found evidence of a coordinated move against backup management infrastructure. A Veeam server in the same environment was found running a PowerShell script—via WMI—that queried its PostgreSQL database for credentials before decrypting them using DPAPI. The pairing of Ahsay footholds and Veeam credential theft indicates deliberate targeting of systems responsible for storing backups, hypervisors, and domain credentials—not mere opportunistic attacks.
Patching remains essential: the two CVEs have been fixed, but organizations using AhsayCBS or co-located backup solutions should assume compromise if patches haven’t been applied. Any lingering exposure to these vulnerabilities could provide attackers full access, allowing them to establish persistence, steal credentials, or harvest data silently from critical infrastructure.
What this reveals is the growing sophistication of threats aimed at backup software—components long trusted to be stable, secure repositories. As attackers move from smash-and-grab tactics toward long-term, stealthy access, enterprises must rethink their protection strategies. Defense shouldn’t begin with perimeter security—it must start with how backups are managed and secured. Validate patches, monitor for unusual web shells, and treat backup systems as high-risk, not hidden vaults.
