Security researchers have uncovered a sophisticated intrusion exploiting critical flaws in AhsayCBS backup servers. Between October 8 and 11, 2026, attackers leveraged two zero-day vulnerabilities—CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (unauthenticated remote code execution with SYSTEM privileges)—to gain elevated access and persist on three servers belonging to one organization, before patches could be applied.
Advanced Stealth Techniques
The threat actors installed multiple webshells, covertly embedded commands and payloads within PNG images, and even deployed a host-bound Python implant. The most striking webshell masqueraded as an internal image preview service: attackers used the PNG format to conceal commands. Specifically, by reading the least-significant bit of each pixel’s RGB values, they reconstructed encrypted payloads. A hardcoded AES key (using ECB mode with PKCS5 padding) decrypted the hidden data. The initial class loader ran in memory and mimicked serving images; later requests triggered actual function via the decrypted class. The system responded by embedding responses in PNGs too, making command-and-control traffic look like benign image transfers.
Other webshell variants offered more traditional remote administration functions. They validated API tokens, nonces, HMAC-SHA256 signatures, timestamps and, once verified, allowed directory changes, command execution, and file transfers—supporting uploads as large as 4GB. No evidence emerged that the download functionality was used.
Persistent Backdoors and Mining Activities
In addition to webshells, researchers detected a Python implant designed to run only on specific machines. Before activation, it calculated a SHA-256 hash from the host’s MachineGuid and looked for a corresponding marker file—without both, it wouldn’t run. If conditions were met, it loaded a large binary blob into memory, spun up a thread, and mapped an embedded x64 DLL using reflective loading. Its embedded command infrastructure suggested support for DNS-over-HTTPS, though analysts observed no active execution or clear malware family attribution so far.
The attackers also deployed an XMRig cryptominer running as a SYSTEM-level scheduled task, configured to restart every minute. To camouflage their presence, they used tunneling tools, remote access software, and broad Microsoft Defender exclusions. On a Veeam-related server, operators appear to have used credential-theft techniques (possibly via NetExec) to access backup secrets protected by DPAPI decryption.
Fixes, Remaining Risks & How to Respond
Ahsay has issued hotfixes: version 10.3.4.45 for version 10, and 9.15.2.70 for versions 7 through 9. Tests confirmed the version 10 patch blocked the known entry point of the attack. However, installing the patch alone will not remove implants and other backdoors already in place. Organizations should audit systems for signs of persistence: shadow accounts, unusual scheduled tasks, configuration exclusions, and tunnels. Any confirmed compromises should lead to rebuilding from verified backups and rotating credentials.
Indicators of compromise include network domains like creepexplosiondarknight[.]com, connections to XMR mining pools such as pool.supportxmr[.]com:443, and filesystem artifacts like a miner executable hidden in SysWOW64 named kvm-agent.exe. SHA-256 hashes are available for malicious files, embedded payloads, and configuration elements.
This intrusion shows attackers maintaining access to systems that are meant to safeguard data, not jeopardize it. Because backup platforms are seldom monitored like production servers, they present a tempting weak point. Defenders should assume that when core infrastructure is breached, lateral spread and long-term implants are likely. Rigorous monitoring, frequent patching, and trust in backup integrity are now more critical than ever.
Why this matters: As attackers increasingly target backup systems, the trust models organizations rely on are under threat. From hiding malicious code in PNG images to host-bound implants that evade detection, the techniques are evolving rapidly. For security teams, watching not just external defenses but internal backup integrity could determine who recovers—and who remains compromised.
