Attackers who broke into AhsayCBS backup servers left far more behind than a crypto miner, according to a follow-up investigation by security firm Huntress published on 9 November. The intruders planted five families of webshells, two cryptocurrency miners, tunnelling tools and a custom Python implant across three servers in a single organisation, and the backdoors they left can survive the security patches that close the original way in.

The findings matter because the affected systems hold backups. A compromised backup server can give an attacker a route back into an organisation long after the initial incident appears to be over, and can put the credentials stored alongside those backups at risk.

Two flaws chained together

The intrusion, which took place between 8 and 11 October 2026, chained two vulnerabilities in AhsayCBS, the backup software made by Ahsay. The first, CVE-2026-105133, is an authentication bypass in the product's API component. The second, CVE-2026-105134, is a command injection flaw that lets an attacker run commands with SYSTEM privileges through the Replication Receiver's /rps/api/json/UpdateReceivers.do endpoint.

Huntress assessed that the flaws were exploited as zero-days, before fixes were available. Ahsay released hotfixes on 12 October: version 10.3.4.45 for version 10, and 9.15.2.70 for versions 7 to 9. Huntress verified that hotfix 10.3.4.45 closes the entry point it observed. The three servers examined in the follow-up report had all been breached before those fixes existed.

Five webshells and two miners

Investigators recovered five families of JSP webshells hidden inside AhsayCBS installation directories. They included simple command shells, file-writing variants and self-deleting shells, alongside two more sophisticated tools. One, named AhsayCBS.jsp, hides encrypted payloads in the least significant bits of PNG image pixels, decrypts them with AES and loads the resulting Java class into memory, so that malicious traffic resembles ordinary image exchanges. The other, nsmind.jsp, is a remote administration tool protected by a hard-coded token, HMAC-SHA256 signatures, timestamps and nonces, with functions for command execution and chunked file transfers of up to 4 GB.

The attackers also ran two XMRig cryptocurrency miners. The first was disguised as Microsoft Edge, running as a service named MicrosoftEdgeUpdateSvc, with a script that hid and killed Task Manager at 18:00. The second, kvm-agent.exe, used a different wallet and was restarted every minute by a SYSTEM scheduled task named kvm, whose configured start time predated the intrusion to make it look older than it was.

A Python implant that only runs on its own host

The most notable find was a Python implant called main.py, staged inside an embedded Python distribution under the SYSTEM profile and launched through a Windows Registry Run key. Before running, it calculates the SHA-256 hash of the host's MachineGuid and looks for a marker file with the same name. If the marker is absent, it exits, so the implant will only execute on the machine it was staged for and not in a researcher's sandbox.

When the check passes, the implant loads a 673 KB blob that reflectively loads an embedded 64-bit DLL in memory, which contacts a command-and-control domain. Researchers identified the defanged address creepexplosiondarknight[.]com but said they had neither observed the implant execute nor established which malware family it belongs to.

Other artefacts found on the servers included the tunnelling tools GOST and Chisel, the remote access tools AnyDesk, Atera and Splashtop, the credential tool Mimikatz, broad Microsoft Defender exclusions and a local account named wdguest. On a related Veeam server in the same environment, investigators saw a command consistent with querying the Veeam backup database and decrypting stored credentials, although Huntress said the amount retrieved, if any, remains unknown.

Patching alone is not enough

Huntress's central warning is that installing the hotfixes blocks the observed entry point but does not remove webshells, scheduled tasks or implants already planted. The firm recommends reimaging compromised hosts from trusted backups rather than relying on patching alone, and checking for unexpected JSP files, SYSTEM-profile Python installations, unauthorised tasks, Defender exclusions and commands spawned by cbssvcX64.exe.

Huntress has not attributed the intrusion to any named group, and the investigation is continuing.

Sources: GBHackers and Cyber Press.