Attackers exploit AhsayCBS flaws to hide code in PNGs and plant backdoors
Original title: Hackers Exploit AhsayCBS Vulnerabilities to Hide Malware in PNG Images and Deploy Stealthy Backdoors
AI summary · x-ai/grok-4.7Summaries by Vani AI
Three servers in one organization were hit October 8–11, 2026, via auth bypass and unauthenticated SYSTEM RCE before hotfixes.
Huntress says attackers exploited CVE-2026-105133 and CVE-2026-105134 on three AhsayCBS backup servers, planting webshells, an XMRig miner, and a host-bound Python implant. One webshell extracted AES-encrypted code from PNG pixels and ran it in memory. Ahsay issued hotfix 10.3.4.45 for version 10 and 9.15.2.70 for versions 7 through 9; Huntress says the version 10 hotfix blocked the observed entry point. Whether backup data was stolen remains unconfirmed.
Unconfirmed: Huntress could not confirm every payload’s behavior, the PNG webshell’s commands, or whether backup data was stolen.
Key facts
- Huntress found five webshell families plus a second cryptocurrency miner.
- The Python implant exits unless a host MachineGuid marker file is present.
- An XMRig task named kvm ran as SYSTEM and restarted every minute.
- On a related Veeam server, a NetExec-like command decrypted stored backup credentials with DPAPI.
- Huntress did not identify the Python implant’s malware family or observe it running.
Security assessment · AI, from the articleExploited in the wild
Impact: Unauthenticated remote code execution with SYSTEM privileges
| Product | Affected | Fixed in |
|---|---|---|
| AhsayCBS | version 10 and versions 7 through 9 | 10.3.4.45 for version 10; 9.15.2.70 for versions 7 through 9 |
What to do
- 1.Install hotfix 10.3.4.45 on version 10 or 9.15.2.70 on versions 7 through 9.
- 2.If compromised, rebuild from trusted backups and rotate reachable credentials.
- 3.Check for unauthorized Defender exclusions, the kvm scheduled task, and listed miner and C2 indicators.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-105134+1 related CVE | Unauthenticated OS Command Injection in AhsayCBS | 10.0 group max | 82% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | creepexplosiondarknight.com | of compromise (IoCs):- Type Indicator Description C2 domain creepexplosiondarknight[.]com Python implant infrastructure C2 URL hxxps://creepexplosi |
| domain | supportxmr.com | m/d Endpoint embedded in the DLL Mining infrastructure pool.supportxmr[.]com:443 pool-fr.supportxmr[.]com:443 104.243.43[.]115:443 Con |
| ipv4 | 104.243.43.115 | ture pool.supportxmr[.]com:443 pool-fr.supportxmr[.]com:443 104.243.43[.]115:443 Connections configured for the miner Mining wallet 83 |
| md5 | 07043828c4e2c55eaf2be9e6cb7205cc | f2318a20a88175704af57d1bc4 2df09294da360fffd01142f29b17c6cd 07043828c4e2c55eaf2be9e6cb7205cc f08fc3eea3db76e7ba45cda42de5cafa 4126a061ddda3f433da5def0a7 |
| md5 | 1b755d215b43b8e7da25a80386493568 | 7c8160fb2df89e217d475c50b4 db64a245782d2d619d10eae73ef0f196 1b755d215b43b8e7da25a80386493568 7d33dc36088a8c20ee109f33d01d63c7 d5f0289bf84876023eb6ccdc92 |
| md5 | 208143f41c1d6148842b7ed5d817f122 | 835a7f6400bbb01d8b78bfc811 7dd5c4a904893cad2b757205dc224014 208143f41c1d6148842b7ed5d817f122 310161c45b193e923c8c99e0c21a2a0c Authentication values for |
| md5 | 2df09294da360fffd01142f29b17c6cd | b4836090e26a6ec717b26db7c8 38d0eff2318a20a88175704af57d1bc4 2df09294da360fffd01142f29b17c6cd 07043828c4e2c55eaf2be9e6cb7205cc f08fc3eea3db76e7ba45cda42d |
| md5 | 310161c45b193e923c8c99e0c21a2a0c | a904893cad2b757205dc224014 208143f41c1d6148842b7ed5d817f122 310161c45b193e923c8c99e0c21a2a0c Authentication values for status_*.jsp gost SHA-256 6f6b66c |
| md5 | 38d0eff2318a20a88175704af57d1bc4 | 3c393edff904c99fbdea0ea90c f4f9b5b4836090e26a6ec717b26db7c8 38d0eff2318a20a88175704af57d1bc4 2df09294da360fffd01142f29b17c6cd 07043828c4e2c55eaf2be9e6cb |
| md5 | 3b44593c393edff904c99fbdea0ea90c | 36088a8c20ee109f33d01d63c7 d5f0289bf84876023eb6ccdc92ddb05a 3b44593c393edff904c99fbdea0ea90c f4f9b5b4836090e26a6ec717b26db7c8 38d0eff2318a20a88175704af5 |
| md5 | 4126a061ddda3f433da5def0a7c79955 | 28c4e2c55eaf2be9e6cb7205cc f08fc3eea3db76e7ba45cda42de5cafa 4126a061ddda3f433da5def0a7c79955 7de8cd835a7f6400bbb01d8b78bfc811 7dd5c4a904893cad2b757205dc |
| md5 | 7d33dc36088a8c20ee109f33d01d63c7 | 45782d2d619d10eae73ef0f196 1b755d215b43b8e7da25a80386493568 7d33dc36088a8c20ee109f33d01d63c7 d5f0289bf84876023eb6ccdc92ddb05a 3b44593c393edff904c99fbdea |
| md5 | 7dd5c4a904893cad2b757205dc224014 | 61ddda3f433da5def0a7c79955 7de8cd835a7f6400bbb01d8b78bfc811 7dd5c4a904893cad2b757205dc224014 208143f41c1d6148842b7ed5d817f122 310161c45b193e923c8c99e0c2 |
| md5 | 7de8cd835a7f6400bbb01d8b78bfc811 | eea3db76e7ba45cda42de5cafa 4126a061ddda3f433da5def0a7c79955 7de8cd835a7f6400bbb01d8b78bfc811 7dd5c4a904893cad2b757205dc224014 208143f41c1d6148842b7ed5d8 |
| md5 | 82e58ea5839581846e19be5d0c414436 | 0fc643fadabe5f41b94c7826d5 ee808b1dac987d19b1b864f18538116f 82e58ea5839581846e19be5d0c414436 c048c97c8160fb2df89e217d475c50b4 db64a245782d2d619d10eae73e |
| md5 | acbe51127a7e4a3b8f7cde6e857b5e4d | 44 Command/delete/self-delete shell Per-host status secrets acbe51127a7e4a3b8f7cde6e857b5e4d d650dd0fc643fadabe5f41b94c7826d5 ee808b1dac987d19b1b864f185 |
| md5 | c048c97c8160fb2df89e217d475c50b4 | 1dac987d19b1b864f18538116f 82e58ea5839581846e19be5d0c414436 c048c97c8160fb2df89e217d475c50b4 db64a245782d2d619d10eae73ef0f196 1b755d215b43b8e7da25a80386 |
| md5 | d5f0289bf84876023eb6ccdc92ddb05a | 215b43b8e7da25a80386493568 7d33dc36088a8c20ee109f33d01d63c7 d5f0289bf84876023eb6ccdc92ddb05a 3b44593c393edff904c99fbdea0ea90c f4f9b5b4836090e26a6ec717b2 |
| md5 | d650dd0fc643fadabe5f41b94c7826d5 | ll Per-host status secrets acbe51127a7e4a3b8f7cde6e857b5e4d d650dd0fc643fadabe5f41b94c7826d5 ee808b1dac987d19b1b864f18538116f 82e58ea5839581846e19be5d0c |
| md5 | db64a245782d2d619d10eae73ef0f196 | a5839581846e19be5d0c414436 c048c97c8160fb2df89e217d475c50b4 db64a245782d2d619d10eae73ef0f196 1b755d215b43b8e7da25a80386493568 7d33dc36088a8c20ee109f33d0 |
| md5 | ee808b1dac987d19b1b864f18538116f | 127a7e4a3b8f7cde6e857b5e4d d650dd0fc643fadabe5f41b94c7826d5 ee808b1dac987d19b1b864f18538116f 82e58ea5839581846e19be5d0c414436 c048c97c8160fb2df89e217d47 |
| md5 | f08fc3eea3db76e7ba45cda42de5cafa | 94da360fffd01142f29b17c6cd 07043828c4e2c55eaf2be9e6cb7205cc f08fc3eea3db76e7ba45cda42de5cafa 4126a061ddda3f433da5def0a7c79955 7de8cd835a7f6400bbb01d8b78 |
| md5 | f4f9b5b4836090e26a6ec717b26db7c8 | 9bf84876023eb6ccdc92ddb05a 3b44593c393edff904c99fbdea0ea90c f4f9b5b4836090e26a6ec717b26db7c8 38d0eff2318a20a88175704af57d1bc4 2df09294da360fffd01142f29b |
| sha256 | 6953618238eb40f45b584e52aca22cebbe8ba03e9a80c15c6b593f51f7e49527 | 42fdd2e422f8803 Marshaled code object Embedded blob SHA-256 6953618238eb40f45b584e52aca22cebbe8ba03e9a80c15c6b593f51f7e49527 Bootstrap, DLL, and loader DLL SHA-256 bb2472cf5dc7e5c94216 |
| sha256 | 6c695baad1d81ed49194d07a79381292c0466208ff1a9862c0c55f971d6a409f | ibute: QuCh Hardcoded loader values Signed webshell SHA-256 6c695baad1d81ed49194d07a79381292c0466208ff1a9862c0c55f971d6a409f nsmind.jsp under webapps\rps API token NS_f1ChEBy4SCYGyIDkY |
| sha256 | 6c7a4061bcf08df5fe4a49d37442dc650d751be1a91a8bc802edff213e4d5e61 | 1416717265f81f669d751fca4a3d Loader tail PNG loader SHA-256 6c7a4061bcf08df5fe4a49d37442dc650d751be1a91a8bc802edff213e4d5e61 AhsayCBS.jsp under webapps\rps PNG loader artifacts AES key |
| sha256 | 6f6b66cbdc4a5aa5685d0017abd3f65843a28bcc2bb4e5b78d6d12a844a51aa8 | 21a2a0c Authentication values for status_*.jsp gost SHA-256 6f6b66cbdc4a5aa5685d0017abd3f65843a28bcc2bb4e5b78d6d12a844a51aa8 Tunneling utility chisel SHA-256 ca5f8e5247f1a044b8be45ef03 |
| sha256 | 7a13e59d816d68a071a8648e62a7c3c7f929a61c618a2133ab6f511da24f979d | ysecret123 Fixed authentication values Status shell SHA-256 7a13e59d816d68a071a8648e62a7c3c7f929a61c618a2133ab6f511da24f979d Shell using nobody Unauthenticated shell SHA-256 875d0986dd |
| sha256 | 818bb464271a539c96bcbbfea1db7d5a722512041ed8ed10d3f6c7f366190044 | 66588d6153bdda57f2e3671e986 st_ shell Earlier shell SHA-256 818bb464271a539c96bcbbfea1db7d5a722512041ed8ed10d3f6c7f366190044 Command/delete/self-delete shell Per-host status secrets ac |
| sha256 | 8245c7e7d944923f1608592f6c3473dcc6e3a3e43df3dd1c6257e7880948787b | cheduled task kvm Runs as SYSTEM every minute Miner SHA-256 8245c7e7d944923f1608592f6c3473dcc6e3a3e43df3dd1c6257e7880948787b kvm-agent.exe Configuration SHA-256 a87002c32723f1849b3ad17 |
| sha256 | 875d0986ddaa51bfb5e03b06df1213cc3bb7966588d6153bdda57f2e3671e986 | 1da24f979d Shell using nobody Unauthenticated shell SHA-256 875d0986ddaa51bfb5e03b06df1213cc3bb7966588d6153bdda57f2e3671e986 st_ shell Earlier shell SHA-256 818bb464271a539c96bcbbfea1d |
| sha256 | 8aac187bae71f75fa2dde03dcb4a9279c982182ee8254ae96e7a6626fe4c7617 | b9e097887e6f5206eb5 Miner persistence Python loader SHA-256 8aac187bae71f75fa2dde03dcb4a9279c982182ee8254ae96e7a6626fe4c7617 main.py Decoded payload SHA-256 91b3cc9d6421b651ec85a16062a |
| sha256 | 91b3cc9d6421b651ec85a16062af3ba26700dad2eea4a8a7e42fdd2e422f8803 | 82ee8254ae96e7a6626fe4c7617 main.py Decoded payload SHA-256 91b3cc9d6421b651ec85a16062af3ba26700dad2eea4a8a7e42fdd2e422f8803 Marshaled code object Embedded blob SHA-256 6953618238eb40f |
| sha256 | a87002c32723f1849b3ad17b1fe6da732c9810b54b08501be21f5b1fcd882a59 | df3dd1c6257e7880948787b kvm-agent.exe Configuration SHA-256 a87002c32723f1849b3ad17b1fe6da732c9810b54b08501be21f5b1fcd882a59 config.json Task XML SHA-256 f76dae028e0c43248c128b3bf609e8 |
| sha256 | bb2472cf5dc7e5c94216d355bf84fba2c8d088d03d61a1ac0d78639049cf5e1f | c15c6b593f51f7e49527 Bootstrap, DLL, and loader DLL SHA-256 bb2472cf5dc7e5c94216d355bf84fba2c8d088d03d61a1ac0d78639049cf5e1f Embedded x64 DLL Reflective loader SHA-256 e79c91e8157fef86 |
| sha256 | ca5f8e5247f1a044b8be45ef03187726b9af3ac30fd93fb5bb54144e34ed3738 | cc2bb4e5b78d6d12a844a51aa8 Tunneling utility chisel SHA-256 ca5f8e5247f1a044b8be45ef03187726b9af3ac30fd93fb5bb54144e34ed3738 Tunneling utility Tunnel staging patterns .st<id> , wust<id |
| sha256 | e6e576a634166a16bdbfc09b14e7cf8eab90015d2dfa67dd73f3968ee869229b | cnj9w8Hkaew Request signature secret Keyed webshell SHA-256 e6e576a634166a16bdbfc09b14e7cf8eab90015d2dfa67dd73f3968ee869229b a2b59a4bb296604b.jsp Keyed shell secrets 323ced5cf1f4P , 12 |
| sha256 | e79c91e8157fef862be8cbe80bdf57b87a541416717265f81f669d751fca4a3d | 0d78639049cf5e1f Embedded x64 DLL Reflective loader SHA-256 e79c91e8157fef862be8cbe80bdf57b87a541416717265f81f669d751fca4a3d Loader tail PNG loader SHA-256 6c7a4061bcf08df5fe4a49d37442 |
| sha256 | f76dae028e0c43248c128b3bf609e8d660ce0bf44b53ab9e097887e6f5206eb5 | 9810b54b08501be21f5b1fcd882a59 config.json Task XML SHA-256 f76dae028e0c43248c128b3bf609e8d660ce0bf44b53ab9e097887e6f5206eb5 Miner persistence Python loader SHA-256 8aac187bae71f75fa2d |
| url | https://creepexplosiondarknight.com/d | plosiondarknight[.]com Python implant infrastructure C2 URL hxxps://creepexplosiondarknight[.]com/d Endpoint embedded in the DLL Mining infrastructure pool.s |
From the original article
5 min read at cybersecuritynews.com
Hackers exploiting AhsayCBS backup servers have planted webshells, hidden encrypted code inside PNG images, and staged a Python implant designed to run only on its intended host. The findings show an intrusion that extended beyond cryptocurrency mining, giving attackers several ways to keep access to systems responsible for protecting an organization’s backups. The attack affected […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.