Threat Intelligence

Backup Console Breach: Attackers Hid Webshells, a Miner and a Remote Implant on AhsayCBS Servers

Huntress · 10 Nov 2026

Key Takeaway If you run AhsayCBS, apply the Ahsay hotfixes now, and check the server for unexpected webshells, scheduled tasks and Defender exclusions, since a patch will not remove an attacker who is already inside.

Huntress has published a follow-up to its earlier report on attacks against AhsayCBS, the management console for Ahsay's backup software. Attackers exploited two flaws, CVE-2026-105133 (an authentication bypass) and CVE-2026-105134 (unauthenticated remote code execution as SYSTEM). In this case, three servers in a single environment were breached between October 8 and October 11, 2026, before Ahsay released its hotfixes. The activity went well beyond cryptomining.

The operator left five families of JSP webshells, including a loader that hides encrypted payloads inside PNG image data and runs them from memory. A second XMRig miner restarted every minute through a SYSTEM scheduled task, using a different wallet and mining pools from those in the first report. A Python implant appeared to run only on the host it was staged on, then ran an embedded DLL in memory that contacted a command-and-control server.

The servers also held tunnelling tools, remote access software and broad Microsoft Defender exclusions. One command was consistent with NetExec's Veeam credential-theft module, which suggests the attacker may have been targeting backup infrastructure. Ahsay has released hotfixes (10.3.4.45 for v10, and 9.15.2.70 for v7 through v9), and Huntress verified that 10.3.4.45 blocks the entry point it observed.

AhsayCBS webshells cryptominer backup security CVE-2026-105134

Summarised by CISO AI from Huntress, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.