AhsayCBS intrusion: attackers left webshells, a cryptominer and a Python implant on backup servers

What happened

On 9 November 2026 security firm Huntress published a detailed write-up of an intrusion into three AhsayCBS servers in a single environment. AhsayCBS is the server side of Ahsay's backup software, run mostly by backup service providers and MSPs on behalf of their customers. The attacker got in between 8 and 11 October 2026, before the vendor had shipped a working fix.

The flaws themselves are not new. NVD published them on 4 October 2026, Huntress reported the first exploitation on 7 October, Ahsay released hotfixes on 12 October and CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog on 14 October. What the new report adds is the full picture of what the attacker did on servers that hold backups: patiently stacking independent footholds that survive patching.

Technical details

• CVE-2026-105133 – improper authentication (CWE-287) in the checkSysPwd function (com/ahsay/obs/api/ApiStructsAction.java), used to get past authentication. NVD lists CVSS 3.1 7.3 (scored by VulDB).
• CVE-2026-105134 – OS command injection (CWE-78) in the Replication Receiver component, endpoint /rps/api/json/UpdateReceivers.do, parameter random. An unauthenticated attacker runs commands as NT AUTHORITY\SYSTEM. CVSS 3.1 and 4.0 10.0.
• Webshells: five JSP families – keyed command shells using a p parameter, a file-write variant, self-deleting status_*/st_* shells, nsmind.jsp with a signed API (exec, upload, download) and AhsayCBS.jsp, a loader that hides AES-encrypted payloads in the least significant bits of PNG pixels and runs them in memory.
• Miner: XMRig as kvm-agent.exe, restarted every minute by a SYSTEM scheduled task named kvm.
• Python implant: an embedded Python runtime and main.py under the SYSTEM profile, launched from a Run key via explorer.exe. It only proceeds if it finds a marker file named after the SHA-256 of the host's MachineGuid – a way to stay quiet in sandboxes – and then runs an x64 DLL in memory that checks in with a C2 server. Huntress has not yet identified the malware family or seen what it does after check-in.
• Support tooling: gost and chisel tunnels, AnyDesk, Atera and Splashtop, a local account wdguest, a Mimikatz package and broad Microsoft Defender exclusions (C:\ProgramData, C:\Windows).
• Going after backups: on a related Veeam server, the attacker ran a command consistent with NetExec's Veeam module, querying the VeeamBackup PostgreSQL database and decrypting stored credentials with DPAPI.

Who is affected

• AhsayCBS v10 without hotfix 10.3.4.45 and v7, v8 and v9 without hotfix 9.15.2.70. Huntress found that 10.3.4.0 is also vulnerable, contrary to early NVD data.
• Earlier patches 9.15.2.59 and 10.3.4.0 did not fully fix the flaws, as Ahsay itself states.
• Highest risk: servers whose interface was reachable from the internet before 12 October 2026. If you patched later, assume the server may have been compromised until you've checked.

Huntress does not name victims. Because AhsayCBS is typically run by providers serving many customers at once, a single compromised server can put many organizations' data and credentials at risk.

How to tell if you were compromised

Huntress recommends checking servers that were exposed before patching for:

• unexpected .jsp files under webapps\cbs and webapps\rps, especially random names and status_/st_ prefixes,
• requests to UpdateReceivers.do in AhsayCBS access logs,
• folders named ahsay_*, home, opt, srv or usr at the drive root or in Program Files, plus timestamp-named folders next to webshells,
• empty pb_ marker files in conf folders,
• scheduled tasks, services and Defender exclusions you didn't create (especially a one-minute SYSTEM task),
• python.exe or pythonw.exe running from the SYSTEM profile, DNS-over-HTTPS from non-browser processes, and cbssvcX64.exe spawning a command shell.

Selected indicators from the Huntress report (domains and IPs defanged):

creepexplosiondarknight[.]com                      Python implant C2 (hxxps://…/d)
104.243.43[.]115:443                               network indicator
pool.supportxmr[.]com:443  pool-fr.supportxmr[.]com:443   mining pools
C:\Windows\SysWOW64\kvm-agent\                     miner folder, scheduled task "kvm"
wdguest                                            attacker-created local account
8245c7e7d944923f1608592f6c3473dcc6e3a3e43df3dd1c6257e7880948787b  kvm-agent.exe
8aac187bae71f75fa2dde03dcb4a9279c982182ee8254ae96e7a6626fe4c7617  main.py
bb2472cf5dc7e5c94216d355bf84fba2c8d088d03d61a1ac0d78639049cf5e1f  implant DLL (x64)
6c7a4061bcf08df5fe4a49d37442dc650d751be1a91a8bc802edff213e4d5e61  AhsayCBS.jsp
6c695baad1d81ed49194d07a79381292c0466208ff1a9862c0c55f971d6a409f  nsmind.jsp
6f6b66cbdc4a5aa5685d0017abd3f65843a28bcc2bb4e5b78d6d12a844a51aa8  gost
ca5f8e5247f1a044b8be45ef03187726b9af3ac30fd93fb5bb54144e34ed3738  chisel

The full list – including webshell keys you can use to filter log requests – is in the Huntress report. Pull hashes and domains out of your logs with our IOC extractor and check files with the hash calculator; both run entirely in your browser.

What to do

1. Check the version: v10 needs hotfix 10.3.4.45, v7–v9 need 9.15.2.70 (downloaded from the Ahsay partner portal). Reboot the server afterwards, as Ahsay instructs.
2. Restrict access to the AhsayCBS management interface – trusted addresses or VPN only, not the whole internet.
3. Hunt for the indicators above even if the server is patched.
4. If you find anything, restore from a trusted backup or re-image the server – Huntress recommends a full re-image.
5. Rotate credentials stored on the server or reachable from it, including those saved in AhsayCBS and other backup software on the network (Veeam).
6. Review Defender exclusions and scheduled tasks and block the domains and IPs listed above.
7. Report the incident to your national CERT (in the US, CISA; in the UK, the NCSC), especially if the server held customer backups.

Timeline