In a recent cybersecurity breach, hackers targeted AhsayCBS backup servers, deploying webshells and concealing malicious code within PNG images. This attack not only involved cryptocurrency mining but also enabled unauthorized access to systems safeguarding critical backups.
Exploit Details and Impact
Between October 8 and October 11, 2026, attackers compromised three AhsayCBS servers before patches were released. They exploited two major vulnerabilities: CVE-2026-105133, which allowed authentication bypass, and CVE-2026-105134, enabling unauthenticated remote code execution with SYSTEM privileges. These flaws allowed hackers to infiltrate the backup platform, potentially compromising sensitive data.
Huntress researchers discovered five webshell families, a second cryptocurrency miner, and a host-specific Python implant during their investigation. Despite these findings, the team could not confirm whether attackers stole any backup data.
Advanced Malware Techniques
A particularly sophisticated webshell masqueraded as an internal image-preview service, reading hidden information from PNG files. This method, reminiscent of previous PNG malware tactics, used least-significant bits of pixel values to reconstruct encrypted payloads, which were decrypted using a hardcoded AES key. The decrypted content was executed in memory, disguised as normal image traffic.
Another webshell functioned like a remote administration API, permitting command execution after verifying an API token and signature. It could transfer files up to 4 GB, although no evidence was found of its download function being used.
Preventive Measures and Future Outlook
A separate Python implant added another layer of stealth, using a combination of Base64 encoding and LZMA compression. It required a specific marker file to execute, potentially evading detection in analyst environments. The attackers also deployed an XMRig miner, running with SYSTEM-level privileges.
With the release of hotfixes 10.3.4.45 for version 10 and 9.15.2.70 for earlier versions, Ahsay addressed the vulnerabilities. However, Huntress emphasizes the need for organizations to scrutinize server activity, unauthorized exclusions, and persistence mechanisms. In cases of confirmed breaches, rebuilding from reliable backups and rotating credentials is strongly advised.
Indicators of compromise include specific C2 domains, URLs, and mining infrastructure details. Security teams are urged to integrate threat intelligence to detect and prevent such incidents promptly.
