Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
Huntress says the October chain was used as zero-days to drop web shells, two XMRig miners, and tunneling tools.
Huntress reported an October 2026 intrusion that chained CVE-2026-105133 and CVE-2026-105134 in AhsayCBS to bypass authentication and run commands. Ahsay Backup patched both flaws in mid-October 2026. Operators planted several JSP web shells, two XMRig miners, tunneling tools, remote-access software, and a host-locked Python backdoor. On a related Veeam server, a command matched NetExec's credential-theft module.
- Huntress assesses both Ahsay flaws were exploited as zero-days.
- Five JSP web-shell families included a PNG steganography loader, AhsayCBS.jsp.
- Miner kvm-agent.exe restarts every minute through a SYSTEM scheduled task.
- The Python implant hashes MachineGuid and beacons to creepexplosiondarknight[.]com.
- A Veeam PostgreSQL query sought credentials decrypted with DPAPI.
- Vendors
- Ahsay BackupAhsay
- Malware
- XMRig
- Organizations
- Huntress
Coverage
oldest first · one row per article · UTC- · 1d ago
HuntressFirst report
AhsayCBS intrusion left webshells, an XMRig miner, and a C2 implant
Huntress analyzed three servers breached October 8-11, 2026, before Ahsay's hotfixes, and found a host-locked in-memory implant.
- · 12h ago
The Hacker News
Attackers exploit patched AhsayCBS flaws to plant a Python backdoor
Huntress says the October chain was used as zero-days to drop web shells, two XMRig miners, and tunneling tools.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-105134+1 related CVE | Unauthenticated OS Command Injection in AhsayCBS | 10.0 group max | 82% | KEVPoC | KEV |