Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor

Huntress researchers disclosed an attack that exploited two patched AhsayCBS vulnerabilities to deploy a Python-based implant on backup servers. The activity, observed in October 2026, used CVE-2026-105133 and CVE-2026-105134 as a chain to bypass authentication and execute arbitrary commands. Patches were released by Ahsay Backup in mid-October 2026.

Vulnerabilities and intrusion

Researchers assessed that the two flaws were weaponized as zero-days. The managed security platform first saw threat actors use a smash-and-grab approach to deploy web shells and XMRig cryptocurrency miners on compromised systems. The October 2026 incident was more patient, with shells planted in several places, two different miners run, tunneling tools staged, and a custom implant installed on servers whose job is to hold backups, according to Huntress researcher Jonathan Semon.

Web shells and miners

The unknown threat actor left five families of Jakarta Server Pages (JSP, formerly JavaServer Pages) web shells. They included nsmind.jsp, described as a signed API with command execution and file transfer capabilities using exec, cd, upload, and download parameters; AhsayCBS.jsp, a loader that hides encrypted payloads in the pixel data of PNG images and runs them from memory; a keyed command shell that compares a hard-coded key against its own copy and runs commands via cmd.exe if it matches; a keyed shell with file write that can write Base64-decoded bytes to any path the service account can reach; and status or st files with six random letters, such as st_jgaejj.jsp, used to run commands, recursively delete paths, and delete themselves using cmd, del, and rm parameters.

AhsayCBS.jsp's disguise as an internal image preview service extended to a comment block describing a watermark endpoint, Huntress said. The web shell used only JSP implicit objects and fully qualified class names, meaning it would compile on any servlet container and on Java Development Kit (JDK) 6 and later. Besides an XMRig miner masquerading as Microsoft Edge, the attack delivered a second XMRig miner, kvm-agent.exe, which restarts every minute through a SYSTEM scheduled task and uses a different wallet and mining pool.

Sandbox-evasive Python backdoor

The Python backdoor, main.py, is designed to run only on the host where it is staged and to prevent execution in a sandbox or an analyst's machine. It computes the SHA-256 cryptographic hash of the host's MachineGuid and looks for a marker file with the same name in the same directory housing the Python implant. It then runs an embedded x64 DLL in memory that contacts a command-and-control server at creepexplosiondarknight[.]com.

The attack chain also configures Microsoft Defender exclusions. It serves tunneling tools, GOST and Chisel, and legitimate remote access software, AnyDesk, Atera, and Splashtop, to establish persistent access.

Backup infrastructure focus

Evidence indicates the threat actor may have targeted servers holding or managing backups. On a related Veeam server in the same environment, Huntress saw a command consistent with NetExec's Veeam credential-theft module: a PowerShell script, apparently launched remotely through WMI, queried the VeeamBackup PostgreSQL database for stored credentials and decrypted them with DPAPI.

Backup software holds credentials for hypervisors, repositories, and domain accounts. Huntress said it cannot say how many credentials were retrieved, but the pairing of an Ahsay foothold with a Veeam credential query suggested the operator was interested in backup infrastructure on purpose, not by accident.

Sources: The Hacker News