Researchers have detailed an intrusion that abused two now-patched AhsayCBS vulnerabilities to plant a Python-based implant, along with web shells, cryptocurrency miners and tunneling tools.

Huntress observed the activity in early October 2026, according to The Hacker News. The chain - CVE-2026-105133 and CVE-2026-105134 - let attackers bypass authentication and run arbitrary commands. Ahsay Backup released patches in mid-October 2026. The flaws are assessed to have been weaponized as zero-days, with earlier smash-and-grab use of web shells and XMRig miners giving way to a more patient intrusion.

Huntress researcher Jonathan Semon said the operator planted shells in several places, ran two different miners, staged tunneling tools and installed a custom implant on servers whose job is to hold backups. Five families of Jakarta Server Pages web shells were left behind, including one loader that hides encrypted payloads in PNG pixel data and runs them from memory.

The Python backdoor, main.py, is built to run only on its staged host and to resist sandbox or analyst execution. It hashes the host's MachineGuid with SHA-256, looks for a marker file of the same name beside the implant, then runs an embedded x64 DLL in memory that contacts a command-and-control server. The chain also set Microsoft Defender exclusions and deployed GOST, Chisel, AnyDesk, Atera and Splashtop.

On a related Veeam server, Huntress saw a PowerShell script consistent with NetExec's Veeam credential-theft module querying the VeeamBackup PostgreSQL database and decrypting stored credentials with DPAPI. Semon said the pairing of an Ahsay foothold with a Veeam credential query suggested interest in backup infrastructure was deliberate.

Source: The Hackers News