Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant.
The activity, observed by Huntress in early October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two vulnerabilities were released by Ahsay Backup in mid-October 2026.
The two vulnerabilities are assessed to have been weaponized as zero-days, with the managed security platform first observing threat actors employing a smash-and-grab approach to deploy web shells and XMRig cryptocurrency miners on compromised systems.
"However, this incident reflects a much larger intrusion with more patience; the operator planted shells in several places, ran two different miners, staged tunneling tools, and installed a custom implant, all on servers whose job is to hold backups," Huntress researcher Jonathan Semon said.
Specifically, the unknown threat actor is said to have left five families of Jakarta Server Pages (JSP, formerly JavaServer Pages) web shells -
- nsmind.jsp, a signed API with command execution and file transfer capabilities using exec, cd, upload, and download parameters
- AhsayCBS.jsp, a loader that hides encrypted payloads in the pixel data of PNG images and runs them from memory
- Keyed command shell, which compares a hard-coded key against its own copy and, if it matches, runs the command via "cmd.exe"
- Keyed shell with file write, which expands on the keyed command web shell with the ability to write Base64-decoded bytes to any path the service account can reach and deploy more tools
- status_<six_random_letters>.jsp or st_<six_random_letters>.jsp (e.g., st_jgaejj.jsp), which are used to run commands, recursively delete any path provided as input, and delete themselves using cmd, del, and rm parameters.
"[AhsayCBS.jsp's] disguise as an internal image preview service even extended down to a comment block describing a watermark endpoint," Huntress explained. "The web shell used only JSP implicit objects and fully qualified class names, meaning it would compile on any servlet container and on Java Development Kit (JDK) 6 and later."
The attack, besides deploying an XMRig miner masquerading as Microsoft Edge, has been found to deliver a second XMRig miner ("kvm-agent.exe") that restarts every minute through a SYSTEM scheduled task, while using a different wallet and mining pool.
The most notable aspect of the intrusion revolves around the Python backdoor ("main.py"), which is designed to run only on the host it's staged on and prevent it from executing within a sandbox or an analyst's machine.
It achieves this by computing the SHA-256 cryptographic hash of the host's MachineGuid and looks for a marker file with the same name in the same directory housing the Python implant, and then runs an embedded x64 DLL in memory that contacts a command-and-control (C2) server ("creepexplosiondarknight[.]com").
In an attempt to fly under the radar, the attack chain also configures Microsoft Defender exclusions, while serving tunneling tools (GOST and Chisel) and legitimate remote access software (AnyDesk, Atera, and Splashtop) to establish persistent access.
Evidence indicates that the threat actor may have targeted servers holding or managing backups.
"On a related Veeam server in the same environment, we also saw a command consistent with NetExec's Veeam credential-theft module: a PowerShell script, apparently launched remotely through WMI, that queried the VeeamBackup PostgreSQL database for stored credentials and decrypted them with DPAPI," Semon said.
"Backup software holds credentials for hypervisors, repositories and domain accounts. We cannot say how many of those credentials were retrieved, but the pairing of an Ahsay foothold with a Veeam credential query suggested the operator was interested in backup infrastructure on purpose, not by accident."
Update
Ahsay Backup has released 10.3.6.1 with additional security hardening updates to enhance the platform's security posture, urging partners to apply the latest fixes to stay adequately protected.
"As the threat landscape continues to evolve, cybercriminals are increasingly employing AI-powered techniques to accelerate and enhance the exploitation of vulnerabilities," the Singapore-based company said. "This is a challenge faced by software vendors across all industries, and this incident reflects that broader reality rather than an issue unique to Ahsay."
"These enhancements are designed to strengthen the resilience of Ahsay solutions against emerging cyber threats, including increasingly sophisticated AI-powered attacks."
Ahsay also revealed in a status update last month that it began receiving reports from partners regarding unauthorized access incidents impacting their AhsayCBS server environments on October 9, 2026, prompting it to release hotfixes for versions 9 and 10 on October 10 and 12, 2026.
It has also shared the following indicators that customers can check to determine if their AhsayCBS server has been compromised -
- Suspicious folders with names created on the root of the hard drive (e.g., ahsay_ts, ahsay_t8, ahsay_t9, ahsay_t20, ahsay_t21, srv, user, and opt).
- Multiple JSP files in the "%CBS%\webapps" folder with randomly generated names like "75bc584d292933ad.jsp" and/or folders with lower case letter and numbers such as xtj7iu, kje74x, and 103y9r.
- Addition of unauthorized RPS receivers.
- Presence of unauthorized AhsayCBS user accounts with "Admin" type privileges.
If malicious activity has been detected, it's advised to reinstall Windows or Linux on the backup server, install the latest version of AhsayCBS, and restore from Auto Save by recovering a server configuration version whose timestamp predates the compromise.
"As a best practice, select an Auto Save version from at least one day before the timestamp of any suspicious folders or files created during the unauthorized access incident," it said.
