Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
Hackers targeted backup servers using zero-day vulnerabilities to install persistent, stealthy malware implants.
1Critical Vulnerability Chain Exploited
In October 2026, security researchers identified attackers exploiting two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, within AhsayCBS software. These flaws allowed unauthorized actors to bypass authentication protocols and execute arbitrary commands on targeted systems. Ahsay Backup released necessary patches for these security gaps in mid-October, addressing the critical risks posed by the initial zero-day weaponization.
2Sophisticated Multi-Stage Intrusion Tactics
The attackers utilized a patient, multi-layered approach rather than simple automated scripts. They deployed five distinct families of Jakarta Server Pages web shells to maintain persistent access. These shells were cleverly disguised as internal image preview services, utilizing standard Java implicit objects to ensure compatibility across various servlet containers and older JDK versions.
3Cryptocurrency Mining and System Hijacking
Beyond initial access, the intruders installed two separate XMRig cryptocurrency miners on compromised servers. One miner was disguised as a legitimate Microsoft Edge process, while the second, named kvm-agent.exe, utilized a SYSTEM scheduled task to restart every minute. These miners operated using different digital wallets and mining pools to maximize illicit gains.
4Sandbox-Evading Python Backdoor Mechanism
A custom Python backdoor, main.py, was deployed to ensure long-term control. To prevent analysis in sandboxes or security labs, the malware computes the SHA-256 hash of the host's MachineGuid. It only executes if it finds a matching marker file, subsequently loading an x64 DLL into memory to communicate with a remote command-and-control server.
5Persistence and Evasion Techniques
The attackers actively sought to remain undetected by configuring Microsoft Defender exclusions to bypass security scans. They also staged various tunneling tools, including GOST and Chisel, alongside legitimate remote access software like AnyDesk, Atera, and Splashtop. These tools provided the threat actors with reliable, persistent access to the compromised backup infrastructure environments.
6Targeting Backup Infrastructure Credentials
Evidence suggests the primary objective was the theft of sensitive credentials stored within backup software. Researchers observed activity on a Veeam server involving NetExec modules and PowerShell scripts designed to query PostgreSQL databases. By decrypting stored credentials via DPAPI, the attackers aimed to gain elevated access to hypervisors and domain accounts.
7Strategic Focus on Backup Systems
The deliberate pairing of AhsayCBS footholds with Veeam credential-theft attempts indicates a calculated strategy. Backup servers hold the keys to an organization's entire data landscape, making them high-value targets for sophisticated operators. This incident highlights the critical need to secure backup management platforms as aggressively as primary production and domain infrastructure.
8Broader Security Implications Observed
This campaign demonstrates how attackers leverage specialized software vulnerabilities to pivot toward deeper administrative access. By targeting the infrastructure that manages data recovery, the threat actors posed a systemic risk to organizational integrity. Security teams must prioritize identity visibility and attack surface monitoring to detect such hidden threats before data exfiltration occurs.