Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant
Huntress reveals extensive AhsayCBS intrusion with multiple webshells, cryptominers, and Python implant
Following up on earlier AhsayCBS exploitation tied to CVE-2026-105133 and CVE-2026-105134, Huntress discovered a sophisticated intrusion involving five webshell families, two XMRig miners, tunneling tools, and a custom Python implant left on backup servers between October 8–11, 2026. The attacker demonstrated patience and persistence, planting shells across multiple locations and staging various tools despite the initial "smash and grab" pattern. Organizations that patched after exploitation remain at risk; artifacts left on disk must be actively hunted and removed, as patches do not automatically remediate already-compromised systems.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Ahsay?
Get an email when a new story names Ahsay, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers exploited known vulnerabilities in AhsayCBS backup software to plant multiple webshells, cryptominers, tunneling tools, and a custom Python C2 implant across a four-day window. The critical failure was not just delayed patching, but the assumption that applying a patch after exploitation constitutes full remediation — it does not. Artifacts left on disk by the attacker persist through patching, leaving organizations silently compromised. This incident highlights that backup servers, often trusted and internet-facing, are high-value targets whose compromise can undermine an organization's entire recovery posture. Active threat hunting and forensic validation must follow any patch applied to a system that was exposed during a vulnerability window.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-105133
- cve — CVE-2026-105134
- malware — XMRig