Attackers exploit patched AhsayCBS flaws to plant a Python backdoor
Original title: Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
Huntress says the October chain was used as zero-days to drop web shells, two XMRig miners, and tunneling tools.
Huntress reported an October 2026 intrusion that chained CVE-2026-105133 and CVE-2026-105134 in AhsayCBS to bypass authentication and run commands. Ahsay Backup patched both flaws in mid-October 2026. Operators planted several JSP web shells, two XMRig miners, tunneling tools, remote-access software, and a host-locked Python backdoor. On a related Veeam server, a command matched NetExec's credential-theft module.
Unconfirmed: Zero-day use is Huntress's assessment, the actor is unnamed, and how many Veeam credentials were retrieved is unknown.
- Huntress assesses both Ahsay flaws were exploited as zero-days.
- Five JSP web-shell families included a PNG steganography loader, AhsayCBS.jsp.
- Miner kvm-agent.exe restarts every minute through a SYSTEM scheduled task.
- The Python implant hashes MachineGuid and beacons to creepexplosiondarknight[.]com.
- A Veeam PostgreSQL query sought credentials decrypted with DPAPI.
Impact: Authentication bypass and arbitrary commands on backup servers
| Product | Affected |
|---|---|
| Ahsay Backup AhsayCBS | — |
- 1.Apply the Ahsay Backup patches released in mid-October 2026.
- 2.Hunt for the named JSP shells, XMRig binaries, and the Python implant.
- 3.Review backup hosts for Defender exclusions and unexpected remote-access tools.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1496 Resource HijackingT1562.001 Disable or Modify ToolsT1053.005 Scheduled Task
- Vendors
- Ahsay Backup
- Malware
- XMRig
- Organizations
- Huntress
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-105134+1 related CVE | Unauthenticated OS Command Injection in AhsayCBS | 10.0 group max | 82% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | creepexplosiondarknight.com | in memory that contacts a command-and-control (C2) server ("creepexplosiondarknight[.]com"). In an attempt to fly under the radar, the attack chain |
From the original article
3 min read at thehackernews.com
Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant. The activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.