Global News | November 12, 2026
The AhsayCBS attack against backup-management servers went beyond cryptocurrency mining, with attackers leaving multiple webshells, remote-access tools and a Python implant in one organization’s environment, according to security company Huntress.
In a November 9 investigation, Huntress said it examined three AhsayCBS servers in a single environment that were compromised between October 8 and October 11, before security hotfixes became available. Researchers identified five families of webshells, including a loader designed to extract encrypted code hidden inside PNG image pixels and run it in memory.
The activity followed exploitation of two AhsayCBS vulnerabilities: CVE-2026-105133, an authentication bypass, and CVE-2026-105134, which Huntress says can enable unauthenticated remote code execution with SYSTEM privileges through the replication receiver component.
Ahsay has since released fixes, and Huntress says it verified that one version 10 hotfix blocks the entry point observed in its investigation. Organizations should also investigate exposed systems: installing a patch does not remove malicious files already planted by an attacker.
Backup Infrastructure Became the Target
AhsayCBS is a management console for Ahsay’s backup software. Managed service providers and other organizations may use backup-management systems to administer protected machines, policies and stored data.
Such systems can have a valuable role in business recovery. Depending on their configuration, they may also have access to sensitive credentials, backup repositories or network resources. A compromise of a management server therefore calls for an assessment that extends beyond the server itself.
The AhsayCBS attack described by Huntress involved internet-exposed servers. Its October report documented attackers chaining the two vulnerabilities to bypass authentication and run code. In the November follow-up, the company analyzed tools recovered from three compromised servers in one environment.
These are findings about a specific investigation, not a count of every compromised Ahsay customer. The presence of a backup platform in an environment does not establish that attackers stole or destroyed its backups. Huntress identified activities that raise concern about backup access, but the extent of any data retrieval remains uncertain. A separate DigiCert data breach also illustrates the importance of reviewing access to sensitive internal systems.
The Two Vulnerabilities
Huntress identifies CVE-2026-105133 as an authentication bypass. The second issue, CVE-2026-105134, concerns command execution through the replication receiver component. The researchers say the issues were chained against exposed systems to obtain remote code execution with Windows SYSTEM privileges.
SYSTEM is a highly privileged Windows account. Code running with those privileges can have broad control over a host, although the actual consequences depend on system configuration, network access and defensive controls.
Huntress began observing exploitation on October 7. In its initial report, it described attackers deploying webshells and a cryptocurrency miner. The company’s later analysis shows a deeper intrusion in one environment, with several mechanisms that could enable further attacker activity.
The researchers connected that environment to the previously observed campaign using evidence that included webshell locations, AhsayCBS access logs and matching indicators. Their report does not publicly identify the organization or attribute the activity to a named threat group.
Five Webshell Families
A webshell is malicious server-side code that enables a remote operator to interact with a compromised system through a web service. Its capabilities vary: some execute commands, while others can write files, transfer data or remove evidence of their presence.
Huntress reported five webshell families in the examined environment. Some required a key before running commands. One could write attacker-supplied data to a file, while another provided command execution and file-transfer functions through an interface protected by signed requests.
One family could delete itself after use. That matters during an investigation because the absence of a specific file at the time of inspection does not establish that it was never present. Logs, file-system evidence, backups of relevant artifacts and process activity can provide additional context.
The researchers found webshells within application directories served by AhsayCBS. A familiar-looking filename or a file located inside an application directory should not automatically be treated as legitimate. Administrators should compare findings with vendor-provided software, known-good installations and the technical indicators in Huntress’s report.
Malicious Code Concealed in Images
One of the most distinctive artifacts was a loader called AhsayCBS.jsp. Huntress says it was disguised as an image-preview service and designed to read encrypted code hidden in the pixel data of PNG images.
The loader could extract the payload and run a Java class in memory, allowing malicious exchanges to resemble ordinary image-processing activity. The technique is a form of steganography: information is concealed within another file rather than presented as an obvious program.
This does not mean PNG images generally execute code when opened, or that every image processed by a backup server is malicious. The described behavior depends on the attacker’s webshell interpreting a specially prepared image.
It also does not prove that a particular image was used to steal backup data. Huntress documented the loader’s design and recovered tooling; the public findings should not be expanded into claims about actions the researchers did not confirm.
For defenders, the finding illustrates why monitoring should consider the full chain: an unexpected server-side script, unusual requests to that script, process or memory activity, and other changes around the affected application. Inspecting only a file extension may miss the purpose of a crafted payload.
Miner and Host-Bound Implant
Huntress also identified a second XMRig cryptocurrency miner. The researchers say a scheduled task configured to run as SYSTEM restarted the miner every minute. Its wallet and mining pools differed from those described in their first report.
Cryptomining can consume computing resources and degrade performance, but the presence of a miner does not establish that mining was the attacker’s only objective. In this investigation, Huntress found additional access mechanisms and tools alongside the miner.
The team also analyzed a Python implant that appears designed to run only on the host where it was staged. Huntress says it checks for a marker file derived from the machine’s unique identifier before loading an embedded component into memory.
This host-binding behavior can limit where a sample runs during analysis. It does not, by itself, establish the malware’s family or prove that the implant successfully executed on every examined server. Huntress’s analysis of the recovered code and its findings should be read together with the company’s stated limitations.
The servers also contained tunneling and remote-access tools and broad Microsoft Defender exclusions, according to the researchers. Legitimate remote-administration tools can be used for authorized support, so their presence alone is not conclusive; unexpected installation, timing and use should be assessed in context.
Backup Credentials and Unanswered Questions
Huntress reported a command consistent with a NetExec module used to query Veeam backup credentials. The command suggests that the operator may have been interested in backup infrastructure, but it does not establish how many credentials were obtained or whether backup data was exfiltrated.
Organizations should distinguish between an observed command, the capability of a tool and a confirmed outcome. A tool that can download data is not proof that its download function was used. Similarly, access to a backup-management server does not by itself demonstrate that all connected backups were accessed.
Huntress’s report does not provide a complete victim count, name the affected organization or identify the attacker. NewsFlayer has not independently examined the servers or verified the recovered artifacts.
These gaps do not make the incident harmless. They define what is known and help response teams prioritize the evidence needed to determine the impact in their own environments.
Available Fixes and Their Limits
Huntress says Ahsay released hotfix 10.3.4.45 for version 10 and 9.15.2.70 for versions 7 through 9. The company says it verified that 10.3.4.45 blocks the entry point it observed; that statement should not be extended into a claim that Huntress independently tested every release or configuration.
Administrators should consult current Ahsay guidance and apply the appropriate supported update for their deployment. Verify the version actually running after maintenance, and include all management nodes or instances within the scope of the inventory.
Restricting access to the management interface is another important measure. Huntress recommends limiting web access to trusted addresses or requiring a VPN. Network restrictions reduce exposure but are not a substitute for installing applicable fixes or investigating prior compromise.
Patching prevents exploitation of the corrected entry point going forward. It does not remove webshells, scheduled tasks, malicious exclusions, stolen credentials or other changes that may already exist. A formerly exposed server should not be assumed clean merely because its software is now patched.
Investigation Priorities
Identify exposed systems
Inventory AhsayCBS deployments, their versions and the network paths that can reach their management interfaces. Include systems operated by service providers or hosting teams where they fall within the organization’s responsibility.
Determine which systems were exposed before patching and retain the relevant time period for review. The absence of a current internet-facing interface does not prove a system was never exposed earlier.
Review server activity
Use Huntress’s published indicators and technical analysis to guide a search for unexpected JSP files in application directories, suspicious child processes, scheduled tasks and unfamiliar remote-access or tunneling tools.
Review web-access logs alongside endpoint telemetry, security configuration changes and relevant authentication records. A single indicator is not always decisive: legitimate tools can be misused, malicious files can be renamed, and some webshells can remove themselves.
Check for unusual Microsoft Defender exclusions and validate whether any exceptions were authorized. Preserve evidence before making changes where practical, and coordinate urgent containment with the incident-response team.
Assess backup systems and credentials
Review the privileges available to the affected server and whether connected backup infrastructure or stored credentials could have been reached. Investigate the reported Veeam-related command where relevant to the environment.
Rotate potentially exposed credentials according to incident-response guidance and use trusted systems for recovery. Verify the integrity and availability of backups, but avoid declaring data theft or destruction without supporting evidence.
Organizations that provide backup services to customers should assess their contractual and legal notification responsibilities based on the actual scope of the incident. Communicate confirmed findings and remaining uncertainties separately.
A Reminder for Recovery Planning
Backups are a core resilience control, but the systems that manage them are themselves part of the attack surface. Strong access restrictions, separation of administrative accounts and monitoring of backup infrastructure can reduce the impact of a compromise.
Recovery plans should also address the possibility that the management plane is untrusted. Teams need a way to validate backup integrity and restore services without assuming that a compromised server’s configuration or credentials remain safe.
The reported intrusion illustrates why an apparent cryptominer infection can warrant a broader investigation. In the environment Huntress examined, the miner appeared alongside several other tools that could support persistence or further access.
Conclusion
Huntress’s follow-up describes a multi-layer intrusion across three AhsayCBS servers in one organization, including webshells, a miner and a host-bound Python implant. The company did not establish a full victim count or confirm the amount of backup data or credentials taken.
Administrators should apply the appropriate vendor fixes, restrict management access and investigate systems that were exposed before patching. A security update is essential, but it is not a substitute for determining whether an attacker already left a foothold.
Source note: This article is based on Huntress’s November 9 investigation, its October exploitation report and SecurityWeek’s reporting. NewsFlayer has not independently analyzed the affected environment.
NewsFlayer — Bringing You the Latest Cybersecurity News from Around the World.