AhsayCBS intrusion left webshells, an XMRig miner, and a C2 implant
Original title: Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant
Huntress analyzed three servers breached October 8-11, 2026, before Ahsay's hotfixes, and found a host-locked in-memory implant.
Huntress says threat actors exploited CVE-2026-105133, an AhsayCBS authentication bypass, and CVE-2026-105134, unauthenticated remote code execution as SYSTEM, on three backup servers in one environment between October 8 and October 11, 2026. Beyond an earlier cryptomining wave, investigators recovered five JSP webshell families, a second XMRig miner restarted every minute by a SYSTEM scheduled task, tunneling and remote-access tools, Defender exclusions, and a Python implant that loads an x64 DLL in memory and contacts a C2 server. Ahsay hotfixes are 10.3.4.45 for v10 and 9.15.2.70 for v7 through v9; Huntress verified 10.3.4.45 blocks the entry point it saw. Patching does not remove files already planted.
Unconfirmed: Huntress says activity matches its earlier campaign and that a NetExec-style command suggests possible targeting of backup infrastructure.
- AhsayCBS.jsp hides encrypted payloads in PNG pixel data and runs them from memory.
- One webshell family can recursively delete paths and delete itself after use.
- The Python implant requires a marker file named from the SHA-256 of MachineGuid.
- A command was consistent with NetExec's Veeam credential-theft module.
- The second miner used a different wallet and pools than Huntress's first report.
Impact: Unauthenticated remote code execution as SYSTEM on backup servers
| Product | Affected | Fixed in |
|---|---|---|
| AhsayCBS | v10 before hotfix 10.3.4.45; v7 through v9 before 9.15.2.70 | 10.3.4.45 for v10; 9.15.2.70 for v7 through v9 |
- 1.Install AhsayCBS hotfix 10.3.4.45 on v10 or 9.15.2.70 on v7 through v9.
- 2.If servers were exposed before patching, search for the webshells, miner, and implant artifacts described.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-105134+1 related CVE | Unauthenticated OS Command Injection in AhsayCBS | 10.0 group max | 82% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | creepexplosiondarknight.com | have been stripped. Its strings include the C2 URL hxxps://creepexplosiondarknight[.]com/d, a JSON content type, a mutex, and string fragments (dn |
| domain | supportxmr.com | m/d Command-and-control for the Python-based implant pool.supportxmr[.]com:443 pool-fr.supportxmr[.]com:443 104.243.43[.]115:443 Wal |
| ipv4 | 104.243.43.115 | nt pool.supportxmr[.]com:443 pool-fr.supportxmr[.]com:443 104.243.43[.]115:443 Wallet:83YFdNe2X8KhKnAERfr2hmN8L3tCKatsheuViWhF6qp2ZA |
| sha256 | 6953618238eb40f45b584e52aca22cebbe8ba03e9a80c15c6b593f51f7e49527 | f8803 Embedded blob (bootstrap, x64 DLL and loader) SHA256: 6953618238eb40f45b584e52aca22cebbe8ba03e9a80c15c6b593f51f7e49527 x64 DLL SHA256: bb2472cf5dc7e5c94216d355bf84fba2c8d088d03d6 |
| sha256 | 6c695baad1d81ed49194d07a79381292c0466208ff1a9862c0c55f971d6a409f | ta and runs it in memory nsmind.jsp (webapps\rps) SHA256: 6c695baad1d81ed49194d07a79381292c0466208ff1a9862c0c55f971d6a409f X-Auth-Token / API key:NSf1ChEBy4SCYGyIDkYcsWOivwtWyXt5il H |
| sha256 | 6c7a4061bcf08df5fe4a49d37442dc650d751be1a91a8bc802edff213e4d5e61 | he host's MachineGuid. AhsayCBS.jsp (webapps\rps) SHA256: 6c7a4061bcf08df5fe4a49d37442dc650d751be1a91a8bc802edff213e4d5e61 AES key:3c6e0b8a9c15224a< Application attribute:QuCh JSP lo |
| sha256 | 8245c7e7d944923f1608592f6c3473dcc6e3a3e43df3dd1c6257e7880948787b | xe kvm-agent.exe (C:\Windows\SysWOW64\kvm-agent\) SHA256: 8245c7e7d944923f1608592f6c3473dcc6e3a3e43df3dd1c6257e7880948787b config.json SHA256: a87002c32723f1849b3ad17b1fe6da732c9810b |
| sha256 | 8aac187bae71f75fa2dde03dcb4a9279c982182ee8254ae96e7a6626fe4c7617 | STEM, every minute, backdated start time) main.py SHA256: 8aac187bae71f75fa2dde03dcb4a9279c982182ee8254ae96e7a6626fe4c7617 Decoded payload (marshal object) SHA256: 91b3cc9d6421b651ec |
| sha256 | 91b3cc9d6421b651ec85a16062af3ba26700dad2eea4a8a7e42fdd2e422f8803 | e96e7a6626fe4c7617 Decoded payload (marshal object) SHA256: 91b3cc9d6421b651ec85a16062af3ba26700dad2eea4a8a7e42fdd2e422f8803 Embedded blob (bootstrap, x64 DLL and loader) SHA256: 69536 |
| sha256 | a87002c32723f1849b3ad17b1fe6da732c9810b54b08501be21f5b1fcd882a59 | c3473dcc6e3a3e43df3dd1c6257e7880948787b config.json SHA256: a87002c32723f1849b3ad17b1fe6da732c9810b54b08501be21f5b1fcd882a59 Task XML SHA256: f76dae028e0c43248c128b3bf609e8d660ce0bf44b |
| sha256 | bb2472cf5dc7e5c94216d355bf84fba2c8d088d03d61a1ac0d78639049cf5e1f | e52aca22cebbe8ba03e9a80c15c6b593f51f7e49527 x64 DLL SHA256: bb2472cf5dc7e5c94216d355bf84fba2c8d088d03d61a1ac0d78639049cf5e1f Reflective loader tail SHA256: e79c91e8157fef862be8cbe80bdf |
| sha256 | e6e576a634166a16bdbfc09b14e7cf8eab90015d2dfa67dd73f3968ee869229b | ked file upload and download a2b59a4bb296604b.jsp SHA256: e6e576a634166a16bdbfc09b14e7cf8eab90015d2dfa67dd73f3968ee869229b Key parameterp:323ced5cf1f4P… |
| sha256 | e79c91e8157fef862be8cbe80bdf57b87a541416717265f81f669d751fca4a3d | 88d03d61a1ac0d78639049cf5e1f Reflective loader tail SHA256: e79c91e8157fef862be8cbe80bdf57b87a541416717265f81f669d751fca4a3d Python loader and the payload extracted from it (compiled f |
| sha256 | f76dae028e0c43248c128b3bf609e8d660ce0bf44b53ab9e097887e6f5206eb5 | 7b1fe6da732c9810b54b08501be21f5b1fcd882a59 Task XML SHA256: f76dae028e0c43248c128b3bf609e8d660ce0bf44b53ab9e097887e6f5206eb5 Scheduled task:kvm XMRig miner, its configuration and its p |
| url | https://creepexplosiondarknight.com/d | dcrumbs have been stripped. Its strings include the C2 URL hxxps://creepexplosiondarknight[.]com/d, a JSON content type, a mutex, and string fragments (dns. |
From the original article
13 min read at huntress.comFollow-up on AhsayCBS intrusion: new webshells, a second miner, and a host-bound Python implant found on exploited backup servers.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.