AhsayCBS intruders planted webshells and miners that outlast patches
Original title: AhsayCBS Hackers Plant Multiple Webshells and Secret Crypto Miners That Survive Security Patching
Huntress found five webshell families and miners on three servers breached October 8–11, before October 12 hotfixes.
Attackers exploited AhsayCBS backup servers at one organization, chaining authentication-bypass CVE-2026-105133 with CVE-2026-105134 for unauthenticated remote code execution as SYSTEM. Huntress’s follow-up found webshells, cryptominers, tunneling tools, remote-access software, and a Python implant that patching does not remove. Ahsay issued hotfixes on October 12: 10.3.4.45 for v10 and 9.15.2.70 for v7 through v9. The three servers were breached before those fixes.
Unconfirmed: The Python implant’s malware family and execution were not confirmed, and Veeam credential theft was not proven.
- Huntress verified that 10.3.4.45 blocks the observed entry point.
- AhsayCBS.jsp rebuilds AES-encrypted payloads from PNG pixel bits.
- A SYSTEM task named kvm restarted miner kvm-agent.exe every minute.
- The Python implant’s C2 was creepexplosiondarknight[.]com; execution was not seen.
- A related Veeam command matched NetExec-style credential extraction; theft was not proven.
Impact: Unauthenticated remote code execution as SYSTEM
| Product | Affected | Fixed in |
|---|---|---|
| AhsayCBS | v10 and v7 through v9 | 10.3.4.45 (v10); 9.15.2.70 (v7 through v9) |
- 1.Install hotfix 10.3.4.45 or 9.15.2.70 for the matching AhsayCBS line.
- 2.Reimage compromised hosts from trusted backups instead of patching alone.
- 3.Hunt unexpected JSP files, SYSTEM Python, tasks, Defender exclusions, and cbssvcX64.exe children.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-105134+1 related CVE | Unauthenticated OS Command Injection in AhsayCBS | 10.0 group max | 82% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | creepexplosiondarknight.com | Static analysis identified the defanged C2 address hxxps://creepexplosiondarknight[.]com/d ; researchers neither observed execution nor establishe |
| domain | supportxmr.com | com/d Command-and-control for the Python-based implant pool.supportxmr[.]com:443 pool-fr.supportxmr[.]com:443 104.243.43[.]115:443 Wal |
| ipv4 | 104.243.43.115 | lant pool.supportxmr[.]com:443 pool-fr.supportxmr[.]com:443 104.243.43[.]115:443 Wallet : 83YFdNe2X8KhKnAERfr2hmN8L3tCKatsheuViWhF6qp2 |
| url | https://creepexplosiondarknight.com/d | x64 DLL. Static analysis identified the defanged C2 address hxxps://creepexplosiondarknight[.]com/d ; researchers neither observed execution nor established |
From the original article
3 min read at gbhackers.com
Attackers exploiting AhsayCBS backup servers deployed five webshell families, persistent cryptocurrency miners, tunneling utilities, and a custom Python implant across three servers in one organization. Huntress’s follow-up investigation covers intrusions between October 8 and October 11, 2026, revealing a broader operation than the cryptomining activity initially reported.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.