AhsayCBS flaws exploited to deploy Python backdoors and web shells
TL;DR
Ahsay released patches for two vulnerabilities in AhsayCBS, CVE-2026-105133 and CVE-2026-105134, following active exploitation in the wild. Attackers are using these flaws to bypass authentication and execute commands to deploy web shells, miners, and a sandbox-evading Python backdoor. Upgrade your AhsayCBS instance immediately.
What happened
In early October 2026, threat actors began exploiting a vulnerability chain in AhsayCBS to target backup infrastructure. The attack uses CVE-2026-105133 to bypass authentication via the checkSysPwd function and CVE-2026-105134 to achieve remote OS command injection through the Replication Receiver component.
Once inside, attackers deployed several Jakarta Server Pages (JSP) web shells, including nsmind.jsp and AhsayCBS.jsp, which hides payloads in PNG pixel data. The intrusion also included the deployment of XMRig cryptocurrency miners and a custom Python backdoor named main.py. This implant calculates the host's MachineGuid hash to prevent execution in sandboxes or analyst environments. To maintain access, attackers utilized tunneling tools like GOST and Chisel, alongside legitimate remote access software such as AnyDesk, Atera, and Splashtop.
Why it matters
This is a highly targeted strike against backup environments. Attackers are not just looking for quick profits via crypto-mining; they are establishing deep persistence. The presence of a Python backdoor designed to evade sandbox analysis, combined with attempts to query VeeamBackup PostgreSQL databases for decrypted credentials, suggests the actors are specifically hunting for high-value credentials held within backup infrastructure. This could lead to lateral movement into hypervisors and domain controllers.
Who is affected
- AhsayCBS versions up to 9.15.2.69
- AhsaryCBS versions up to 10.3.4.44
What to do now
- Upgrade AhsayCBS to version 9.15.2.70 or 10.3.4.45 immediately.
- Scan file systems for unauthorized JSP files, specifically
nsmind.jspor files matching the patternst_<six_random_letters>.jsp. - Search for the
main.pyPython implant and check network logs for connections tocreepexplosiondarknight[.]com. - Audit systems for unauthorized XMRig processes or new SYSTEM scheduled tasks.
- Review backup infrastructure logs for unauthorized credential queries or lateral movement attempts.
What we don't know yet
- The specific identity or attribution of the threat actor.
- The total number of organizations affected by this campaign.
- Whether the attackers successfully retrieved hypervisor or domain credentials from the environment.
Sources
