Cybersecurity experts have revealed a cyber attack that took advantage of two recently patched vulnerabilities in AhsayCBS, leading to the deployment of a Python-based backdoor. This attack, observed by Huntress in October 2026, leveraged vulnerabilities identified as CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute commands on compromised systems. The vulnerabilities were patched by Ahsay Backup in mid-October 2026.
Zero-Day Vulnerabilities Exploited
The vulnerabilities were reportedly used as zero-days, with security researchers noting threat actors’ aggressive tactics in deploying web shells and XMRig cryptocurrency miners on affected systems. Huntress researcher Jonathan Semon highlighted that the attackers showed considerable patience, strategically placing web shells, running multiple miners, and installing a custom implant on servers meant for backup storage.
The attackers reportedly utilized five different Jakarta Server Pages (JSP) web shells, each with distinct functionalities. These included nsmind.jsp for command execution and file transfers, AhsayCBS.jsp for concealing encrypted payloads within PNG images, and various keyed shells for executing commands and writing files.
Advanced Tactics and Tools
Alongside XMRig miners disguised as Microsoft Edge, the attackers deployed another miner, “kvm-agent.exe,” scheduled to restart every minute. This miner utilized different wallets and mining pools to avoid detection. A critical component of the attack was a Python backdoor, “main.py,” designed to operate only on the intended host while evading sandbox environments by verifying the host’s MachineGuid and performing tasks in memory.
The attack chain further included configuring Microsoft Defender exclusions and using tunneling tools like GOST and Chisel, along with legitimate remote access software such as AnyDesk and Splashtop, to maintain persistent access to the compromised systems.
Implications for Backup Infrastructure
Evidence suggests the attackers targeted servers responsible for managing backups, with a parallel attack observed on a Veeam server. A PowerShell script, launched remotely, queried the VeeamBackup PostgreSQL database to access decrypted credentials, indicating a deliberate focus on backup infrastructure.
According to Semon, the attack’s sophistication suggests a calculated effort to exploit backup software, which holds vital credentials for hypervisors and repositories, potentially compromising a wide range of sensitive information.
In conclusion, the exploitation of AhsayCBS vulnerabilities underscores the critical need for timely patching and robust security measures to protect against advanced threats targeting essential infrastructure.
