Attackers exploited AhsayCBS zero-day flaws to deploy sandbox-evading Python backdoor

Attackers combined CVE-2026-105133 and CVE-2026-105134 to defeat authentication and run arbitrary commands on AhsayCBS systems, with Huntress observing the intrusion in early October 2026.

CVE-2026-105133 bypasses authentication on the AhsayCBS web console while CVE-2026-105134 converts that access into arbitrary command execution on the host, Security Arsenal reported based on Huntress’s October 2026 disclosure. The chain requires no credentials, no user interaction, and only a network-reachable AhsayCBS server. BleepingComputer described CVE-2026-105133 as a critical authentication bypass with a public exploit and CVE-2026-105134 as a medium-severity OS command injection flaw on Oct. 9, 2026, and said attackers used CVE-2026-105133 first for authentication bypass and then CVE-2026-105134 for code execution during the Oct. 7 intrusions.

Ahsay Backup released patches for both vulnerabilities in mid-October 2026, but only after attackers had weaponized both flaws as zero-days. Researchers assessing the incident concluded attackers had weaponized both flaws before patches arrived.

AhsayCBS is the centralized backup server within the Ahsay Cloud Backup Suite and is commonly used by managed service providers and system integrators. The Java-based platform runs on Windows and Linux servers and sees heavy use among MSPs and SMB-focused backup providers. Internet-facing management consoles are common, increasing exposure to the vulnerability chain, and Security Arsenal identifies the web management console and backend authentication logic as the affected components.

Huntress detected malicious activity on Oct. 7, 2026, affecting at least five organizations. The attackers used a fast smash-and-grab method to install web shells and XMRig miners on compromised systems.

The unknown threat actor deployed at least five families of Jakarta Server Pages web shells on compromised backup servers. The nsmind.jsp shell acts as a signed API supporting command execution and file transfer through exec, cd, upload, and download parameters. The AhsayCBS.jsp loader conceals encrypted payloads in PNG image pixels and executes them from memory, disguising itself as an internal image preview service with a comment block about a watermark endpoint. Huntress explained that the AhsayCBS.jsp loader uses standard JSP objects and full class names, letting it compile on any servlet container and Java Development Kit 6 or later.

A keyed command shell compares an embedded key to its stored version and executes commands through cmd.exe when they match, while a keyed shell with file write can write Base64-decoded bytes to any reachable path. Files beginning with status_ or st_ plus six random characters execute commands then remove themselves, and these shells can recursively delete any path supplied as input.

Huntress identified a Python backdoor named main.py designed to execute only on the host where it was staged. The implant searches its directory for a marker file whose name equals the SHA-256 hash derived from the host MachineGuid, and if the marker is present, main.py runs an embedded x64 DLL in memory that contacts creepexplosiondarknight[.]com. The implant avoids running in analyst sandboxes or on machines other than the intended host. The Python implant executes from the CBS service context, which often runs under a high-privilege account, causing the backup server process to spawn Python interpreters as descendants.

Attackers deployed an XMRig miner that pretends to be Microsoft Edge on compromised systems, and a second XMRig miner called kvm-agent.exe restarts every minute via a SYSTEM scheduled task with a different wallet and pool. A WMI-launched PowerShell script on a separate Veeam server pulled stored credentials from the VeeamBackup PostgreSQL database, and credential decryption used DPAPI, matching NetExec’s Veeam credential-theft module. Huntress stated it could not say how many credentials were retrieved. Huntress supplied indicators of compromise and four Sigma rules for detecting the earlier webshell and cryptomining activity.

In the earlier phase detected on Oct. 7, 2026, the XMRig miner persisted through a service named MicrosoftEdgeUpdateSvc that ran msedge.exe, identified by Huntress as a modified Non-Sucking Service Manager copy. A PowerShell script named Taskgmr.ps1 concealed mining by stopping the MicrosoftEdgeUpdateSvc service when Task Manager opened and restarting it when closed. The script ended Task Manager at 6 p.m. local time or after it stayed open for over an hour overnight. In one case, the attacker deployed the vulnerable WinRing0x64.sys driver, apparently to gain more hardware resources for mining.

The activity also configured Microsoft Defender exclusions to reduce detection risk, and intruders delivered GOST and Chisel tunneling utilities along with AnyDesk, Atera, and Splashtop remote-access programs to maintain access. The operator placed shells in several locations, operated two miners, deployed tunneling tools, and installed a custom implant on backup servers.

Backup servers store credentials for hypervisors, repositories, and domain accounts, catalog sensitive data, and sit at the network edge with remote access exposed. Compromising a backup server can provide a staging point for lateral movement and a way to destroy recovery copies in ransomware scenarios. Backup servers are frequently administered by small staffs, updated less often than customer-facing software, and treated as inside systems despite facing the internet. Jonathan Semon said the combination of an Ahsay foothold and a Veeam credential query showed intentional targeting of backup infrastructure.

“Backup software holds credentials for hypervisors, repositories and domain accounts.”

Huntress reported on Oct. 9, 2026, that AhsayCBS version 10.3.4, described as the latest version, remains affected by both vulnerabilities despite fixes in version 10.3.2. “After further investigation, Huntress has determined that Ahsay 10.3.4 is also affected by these vulnerabilities.” CISA had not confirmed adding the vulnerabilities to its Known Exploited Vulnerabilities catalog at the time of writing.

Teams should identify AhsayCBS deployments and confirm they run a patched version, and administrators should confirm installation of patches from Ahsay Backup released in mid-October 2026. Patches are available from Ahsay, and administrators should verify the exact fixed build against release notes. Teams should review Microsoft Defender exclusions for tampering, and should treat any AhsayCBS host that was reachable from the internet and unpatched during or after October 2026 as potentially compromised.

The backup management interface must not be exposed to the public internet, and remote administration belongs behind a VPN or zero-trust gateway. Running the AhsayCBS service under a least-privilege dedicated account instead of SYSTEM or root limits blast radius, and the CBS console should never be internet-facing but belong behind a VPN or zero-trust gateway restricted to management subnets and MSP jump hosts.

Teams should examine logs for unusual access patterns before the patch, such as odd login attempts and script interpreters started by the backup service, and look for Python or other scripting engines starting from server processes using unusual arguments or making outbound network connections. Incident responders should hunt for the five JSP shell types and a main.py implant checking a MachineGuid-named marker file, and also look for tasks rerunning kvm-agent.exe every minute and VeeamBackup PostgreSQL database queries possibly decrypted using DPAPI. Teams should watch for tunneled connections created using GOST or Chisel. Security Arsenal provided Sigma rules and KQL hunts targeting AhsayCBS service processes spawning cmd.exe, powershell.exe, python.exe, and other interpreters.

Responders should review CBS administrative accounts and API keys, rotate credentials for the backup platform, and look for new local or domain accounts, tasks, services, and run-key persistence. After remediation, teams should test restores and treat backup integrity as suspect until verified if an attacker had implant-level access, monitoring for 90 days. Before a patch became available, Huntress advised restricting AhsayCBS management interface access to trusted IP addresses only, and administrators should restore the host fully from a safe backup if a compromise is confirmed since added backdoors may allow prolonged persistence. BleepingComputer contacted AhsayCBS about plans to fix the flaws but had not received a response by publication.