Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant.
The activity, observed by Huntress in early October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two vulnerabilities were released by Ahsay Backup in mid-October 2026.
The two vulnerabilities are assessed to have been weaponized as zero-days, with the managed security platform first observing threat actors employing a smash-and-grab approach to deploy web shells and XMRig cryptocurrency miners on compromised systems.
“However, this incident reflects a much larger intrusion with more patience; the operator planted shells in several places, ran two different miners, staged tunneling tools, and installed a custom implant, all on servers whose job is to hold backups,” Huntress researcher Jonathan Semon said.
Specifically, the unknown threat actor is said to have left five families of Jakarta Server Pages (JSP, formerly JavaServer Pages) web shells –
- nsmind.jsp, a signed API with command execution and file transfer capabilities using exec, cd, upload, and download parameters
- AhsayCBS.jsp, a loader that hides encrypted payloads in the pixel data of PNG images and runs them from memory
- Keyed command shell, which compares a hard-coded key against its own copy and, if it matches, runs the command via “cmd.exe”
- Keyed shell with file write, which expands on the keyed command web shell with the ability to write Base64-decoded bytes to any path the service account can reach and deploy more tools
- status_
.jsp or st_.jsp (e.g., st_jgaejj.jsp), which are used to run commands, recursively delete any path provided as input, and delete themselves using cmd, del, and rm parameters.
“[AhsayCBS.jsp’s] disguise as an internal image preview service even extended down to a comment block describing a watermark endpoint,” Huntress explained. “The web shell used only JSP implicit objects and fully qualified class names, meaning it would compile on any servlet container and on Java Development Kit (JDK) 6 and later.”
The attack, besides deploying an XMRig miner masquerading as Microsoft Edge, has been found to deliver a second XMRig miner (“kvm-agent.exe”) that restarts every minute through a SYSTEM scheduled task, while using a different wallet and mining pool.
The most notable aspect of the intrusion revolves around the Python backdoor (“main.py”), which is designed to run only on the host it’s staged on and prevent it from executing within a sandbox or an analyst’s machine.
It achieves this by computing the SHA-256 cryptographic hash of the host’s MachineGuid and looks for a marker file with the same name in the same directory housing the Python implant, and then runs an embedded x64 DLL in memory that contacts a command-and-control (C2) server (“creepexplosiondarknight[.]com”).
In an attempt to fly under the radar, the attack chain also configures Microsoft Defender exclusions, while serving tunneling tools (GOST and Chisel) and legitimate remote access software (AnyDesk, Atera, and Splashtop) to establish persistent access.
Evidence indicates that the threat actor may have targeted servers holding or managing backups.
“On a related Veeam server in the same environment, we also saw a command consistent with NetExec’s Veeam credential-theft module: a PowerShell script, apparently launched remotely through WMI, that queried the VeeamBackup PostgreSQL database for stored credentials and decrypted them with DPAPI,” Semon said.
“Backup software holds credentials for hypervisors, repositories and domain accounts. We cannot say how many of those credentials were retrieved, but the pairing of an Ahsay foothold with a Veeam credential query suggested the operator was interested in backup infrastructure on purpose, not by accident.”
