Attackers target AhsayCBS backup servers with stealthy Python backdoor

In early October 2026, cybersecurity firm Huntress observed a sophisticated intrusion campaign targeting AhsayCBS backup servers. The attackers exploited two previously unknown vulnerabilities to bypass authentication and install persistent malware, including a custom Python backdoor designed to evade analysis.

Ahsay Backup released patches for these flaws in mid-October 2026, but the incident highlights the risks facing self-hosted backup infrastructure. The attack chain demonstrates a shift from quick cryptocurrency mining to long-term persistence and credential theft within critical data environments.

What happened

The intrusion began with the exploitation of CVE-2026-105133 and CVE-2026-105134. These two vulnerabilities allowed the threat actors to bypass authentication mechanisms and execute arbitrary commands on the affected systems. Huntress assesses that these flaws were weaponized as zero-days, meaning they were actively exploited before public patches were available. While initial observations of similar tactics involved quick "smash-and-grab" deployments of miners, this specific campaign showed significant patience and operational depth.

Once inside, the operators deployed a complex array of five different Jakarta Server Pages (JSP) web shells. These tools provided various capabilities, from basic command execution to advanced file transfers and payload loading. One notable shell, named AhsayCBS.jsp, disguised itself as an internal image preview service. It hid encrypted payloads within the pixel data of PNG images and executed them directly from memory, making detection by standard file scanners more difficult. This shell was compatible with Java Development Kit 6 and later, ensuring it could run on a wide range of legacy and modern servlet containers.

Beyond the web shells, the attackers installed a custom Python backdoor named main.py. This implant featured anti-analysis capabilities, checking the host's MachineGuid against a marker file to ensure it was not running in a sandbox or analyst environment. If the check passed, it loaded an embedded x64 DLL into memory to communicate with a command-and-control server at creepexplosiondarknight[.]com. The attackers also configured Microsoft Defender exclusions and deployed tunneling tools like GOST and Chisel, alongside legitimate remote access software such as AnyDesk and Splashtop, to maintain persistent access.

Key details

• Vulnerabilities: CVE-2026-105133 and CVE-2026-105134 were exploited as zero-days to bypass authentication and allow remote code execution.
• Web Shells: Five families of JSP web shells were deployed, including one that hid payloads in PNG image pixels and another that could recursively delete paths.
• Python Backdoor: The main.py implant used SHA-256 hashing of the host's MachineGuid to detect sandboxes and only executed if a matching marker file was present.
• Cryptominers: Two variants of XMRig were installed, one masquerading as Microsoft Edge and another as kvm-agent.exe, which restarted every minute via a SYSTEM scheduled task.
• Credential Theft: Evidence suggested the attackers targeted backup infrastructure specifically, using PowerShell scripts to query VeeamBackup PostgreSQL databases for stored credentials.
• Persistence: The attackers established long-term access using tunneling tools, legitimate remote access software, and Microsoft Defender exclusions.

Background

AhsayCBS is a backup solution often self-hosted by organizations to manage their data protection workflows. Like many enterprise backup tools, it holds high-value credentials for hypervisors, storage repositories, and domain accounts. This makes it a prime target for attackers who aim to move laterally across a network or exfiltrate sensitive data. The use of JSP web shells is a common tactic in Java-based environments, allowing attackers to maintain control even if the initial vulnerability is patched.

The concept of a "sandbox" in cybersecurity refers to an isolated environment where suspicious code can be executed safely for analysis. Malware authors increasingly include anti-sandbox checks to prevent their code from running in these controlled settings, ensuring that security researchers cannot easily study the payload. By verifying specific hardware identifiers like the MachineGuid, the Python backdoor in this case ensured it would only operate on the intended victim's machine.

Why it matters

For teams that self-host backup solutions, this incident underscores the critical nature of patch management. Backup servers are often treated as set-and-forget infrastructure, leading to delayed updates. However, because these systems hold the keys to the rest of the IT environment, they are high-value targets. The use of zero-day exploits means that even diligent teams may be vulnerable until patches are released, highlighting the need for robust monitoring and network segmentation around backup infrastructure.

The sophistication of the attack chain also reveals a trend toward living-off-the-land techniques. By using legitimate tools like AnyDesk and PowerShell, and hiding malicious code within benign-looking PNG files, the attackers reduced their footprint. This makes traditional signature-based detection less effective. For IT managers, this means relying solely on antivirus software is insufficient; behavioral monitoring and audit logs are essential to detect anomalous activities such as unexpected outbound connections or unusual process executions.

Furthermore, the specific targeting of backup credentials suggests a strategic intent beyond simple resource hijacking. If attackers gain access to backup credentials, they can potentially decrypt and steal entire datasets or deploy ransomware that encrypts both live data and backups. This reinforces the principle of least privilege and the need to isolate backup networks from general corporate traffic.

What you can do

• Patch immediately: Ensure your AhsayCBS instances are updated to the version released in mid-October 2026 or later to close CVE-2026-105133 and CVE-2026-105134.
• Audit web directories: Scan your web server directories for unknown JSP files, particularly those with names resembling system components or random characters.
• Monitor process execution: Look for unusual processes such as Python scripts running from temporary directories or unexpected scheduled tasks restarting executables like kvm-agent.exe.
• Review firewall rules: Check for unauthorized tunneling tools like GOST or Chisel and restrict outbound connections from backup servers to only necessary destinations.
• Validate backup credentials: Rotate passwords for hypervisor and repository accounts stored in your backup software, and verify that no unauthorized queries have been made to your backup databases.
• Enable detailed logging: Ensure that audit logs for file access and administrative actions are enabled and reviewed regularly for signs of lateral movement or data exfiltration.