[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOZMUxfGiCKAU7gkrV8PLVnb5kMFLYku-sXQkoA5Ry6Q":3},{"article":4,"iocs":54,"watch_terms":62,"solutions":63,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"bd33015c-5cd2-44b9-86e1-60e3d31e27e1","Hackers Exploit AhsayCBS Vulnerabilities to Hide Malware in PNG Images and Deploy Stealthy Backdoors","hackers-exploit-ahsaycbs-vulnerabilities-to-hide-malware-in-png-images-and-deplo-09e1fd","Hackers exploiting AhsayCBS backup servers have planted webshells, hidden encrypted code inside PNG images, and staged a Python implant designed to run only on its intended host. The findings show an intrusion that extended beyond cryptocurrency mining, giving attackers several ways to keep access to systems responsible for protecting an organization’s backups. The attack affected […] The post Hackers Exploit AhsayCBS Vulnerabilities to Hide Malware in PNG Images and Deploy Stealthy Backdoors appeared first on Cyber Security News.","Attackers exploited AhsayCBS backup servers using CVE-2026-105133 and CVE-2026-105134 to plant webshells and a Python implant. The intrusion involved hiding encrypted code within PNG image pixels and using a host-bound implant designed to evade sandboxes. The attack affected three servers before vendor hotfixes were available.","Hackers exploit AhsayCBS vulnerabilities to hide malware in PNG images and deploy stealthy backdoors.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-exploit-ahsaycbs-vulnerabilities\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Exploit-AhsayCBS-Vulnerabilities-to-Hide-Malware-in-PNG-Images-and-Deploy-Stealthy-Backdoors.webp","2026-11-11T10:44:43+00:00","2026-11-11T11:00:33.476159+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"AhsayCBS","product",{"name":21,"type":22},"PNG","technology",{"name":24,"type":22},"Python",{"name":26,"type":22},"AES",{"name":28,"type":22},"HMAC-SHA256",{"name":30,"type":22},"DNS-over-HTTPS","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59],{"type":56,"value":57,"context":58},"cve","CVE-2026-105133","Exploited authentication bypass vulnerability",{"type":56,"value":60,"context":61},"CVE-2026-105134","Exploited unauthenticated remote code execution vulnerability",[18],{"controls":64,"vendors":152},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":95,"name":96,"problem":97,"products":98},"patch-management","Automated patch management","Known holes get closed in days, not months.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":124,"name":125,"problem":126,"products":127},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[153],{"slug":145,"name":146,"logo_path":147,"roles":154},[155],"reported_by",{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":166},"unpatched-backup-servers-exploited-before-vendor-fixes-were-available","Unpatched Backup Servers Exploited Before Vendor Fixes Were Available","Attackers exploited two vulnerabilities in AhsayCBS backup software to plant webshells and a Python-based backdoor on three servers, all before the vendor had released hotfixes. The attackers used steganography—hiding encrypted malicious code inside PNG image pixel data—and sandbox-evasion techniques to maintain persistence while avoiding detection. This incident highlights the acute danger of zero-day or pre-patch exploitation windows in internet-facing infrastructure, particularly backup systems that often hold privileged access to sensitive data. The fact that three servers were compromised before remediation underscores the need for compensating controls when patches are unavailable.",[161,162,163,164,165],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-3: Malicious Code Protection","MITRE ATT&CK T1505.003: Server Software Component: Web Shell","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":167,"NIST SP 800-53 SI-3: Malicious Code Protection":168,"CIS Control 7: Continuous Vulnerability Management (v8)":169,"CIS Control 2: Inventory and Control of Software Assets (v8)":170,"MITRE ATT&CK T1505.003: Server Software Component: Web Shell":171},"This provision requires security in acquisition, development and maintenance including vulnerability handling, meaning operators of AhsayCBS should have had processes to respond immediately to disclosed vulnerabilities in critical software before vendor patches arrived.","This control calls for mechanisms to detect malicious code including in unexpected file types; file-integrity and content inspection controls would have flagged steganographically hidden payloads in PNG files.","This control requires ongoing scanning and timely remediation of vulnerabilities in internet-facing systems, which would have surfaced the AhsayCBS flaws and driven faster compensating action before patches were available.","An accurate software asset inventory would have ensured AhsayCBS instances were known, tracked, and included in vulnerability management processes so the exposure window was minimised.","Attackers planted webshells on the AhsayCBS servers as a persistence mechanism, which is precisely the technique this ATT&CK entry describes and for which detection guidance exists."]