Huntress Details AhsayCBS Intrusion With Hidden Webshells, XMRig Miner and C2 Implant
Summary
Huntress details a three-server AhsayCBS intrusion linked to exploitation of CVE-2026-105133 and CVE-2026-105134, documenting JSP webshells, XMRig mining, an in-memory implant and signs of attempted Veeam credential theft.
Key points
- Huntress reports that three AhsayCBS servers in one environment were exploited between October 8 and 11, 2026, before hotfixes were released; webshell locations, access logs and other artifacts linked the activity to a previously reported campaign.
- Investigators found five JSP webshell families. AhsayCBS.jsp extracts an AES-encrypted payload from PNG pixel data and runs a Java class in memory; the researchers could not determine what code the operator ran through it.
- The nsmind.jsp shell provides signed command execution and chunked file transfers. Huntress found no logs showing its download function was used and could not establish whether data was taken.
- A second XMRig miner, kvm-agent.exe, was restarted every minute by a SYSTEM scheduled task. Broad Microsoft Defender exclusions also reduced scanning of paths and processes used by the operator’s tools.
- A Python implant required a marker file named from the host’s MachineGuid hash, then reflectively loaded an x64 DLL. The implant’s C2 string included hxxps://creepexplosiondarknight[.]com/d, but its post-check-in behavior remains unknown.
- On a related Veeam server, investigators observed a command consistent with NetExec’s Veeam credential-theft module; they could not determine how many credentials, if any, were retrieved. Huntress recommends re-imaging exposed servers and rotating reachable credentials.
Article Details
- Attack Vectors
- The operators exploited CVE-2026-105133 and CVE-2026-105134 against internet-exposed AhsayCBS; the latter enabled unauthenticated remote code execution as SYSTEM through /rps/api/json/UpdateReceivers.do.
- JSP webshells ran commands through cmd.exe /c; some variants also wrote Base64-decoded files or supported recursive deletion.
- AhsayCBS.jsp extracted an AES-encrypted payload from PNG pixel data and loaded the resulting Java class in memory.
- nsmind.jsp provided authenticated command execution and chunked file upload and download; the article describes download as a potential exfiltration channel but reports no evidence it was used.
- A Python implant used a host-specific MachineGuid-derived marker to gate execution, then reflectively loaded an embedded x64 DLL.
- A SYSTEM scheduled task named kvm checked every minute for kvm-agent.exe and restarted the XMRig miner if it was not running.
- On a related Veeam server, investigators observed a command consistent with NetExec's Veeam credential-theft module querying stored credentials and decrypting them with DPAPI.
- Defensive Notes
- Ahsay released hotfix 10.3.4.45 for v10 and 9.15.2.70 for v7 through v9; Huntress verified that 10.3.4.45 blocks the observed entry point.
- For servers exposed before patching, check for unexpected JSP files under webapps\cbs and webapps\rps, suspicious folders and timestamp-named directories, unfamiliar scheduled tasks, Defender exclusions, and an embedded Python installation under the SYSTEM profile.
- Huntress recommends re-imaging affected systems from a trusted backup and rotating credentials stored on or reachable from the server, including credentials in AhsayCBS and other backup software.
- Look for python.exe or pythonw.exe running from a SYSTEM-profile path and outbound requests to public DNS-over-HTTPS resolvers from non-browser processes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | pool-fr[.]supportxmr[.]com | Mining pool endpoint used by the kvm-agent.exe XMRig miner. |
| DOMAIN | pool[.]supportxmr[.]com | Mining pool endpoint used by the kvm-agent.exe XMRig miner. |
| IPV4 | 104[.]243[.]43[.]115 | Mining pool IP listed for the kvm-agent.exe XMRig miner. |
| SHA256 | 6953618238eb40f45b584e52aca22cebbe8ba03e9a80c15c6b593f51f7e49527 | Hash of the implant's embedded blob containing the bootstrap, x64 DLL, and loader. |
| SHA256 | 6c695baad1d81ed49194d07a79381292c0466208ff1a9862c0c55f971d6a409f | Hash of nsmind.jsp, the signed-API JSP webshell. |
| SHA256 | 6c7a4061bcf08df5fe4a49d37442dc650d751be1a91a8bc802edff213e4d5e61 | Hash of AhsayCBS.jsp, the JSP loader that extracts and runs encrypted payloads from PNG data. |
| SHA256 | 6f6b66cbdc4a5aa5685d0017abd3f65843a28bcc2bb4e5b78d6d12a844a51aa8 | Hash of gost, a tunneling tool staged in the compromised environment. |
| SHA256 | 7a13e59d816d68a071a8648e62a7c3c7f929a61c618a2133ab6f511da24f979d | Hash of a JSP webshell identified as the nobody shell. |
| SHA256 | 818bb464271a539c96bcbbfea1db7d5a722512041ed8ed10d3f6c7f366190044 | Hash of an earlier JSP webshell supporting command execution, deletion, and self-deletion. |
| SHA256 | 8245c7e7d944923f1608592f6c3473dcc6e3a3e43df3dd1c6257e7880948787b | Hash of kvm-agent.exe, the XMRig miner found on two servers. |
| SHA256 | 875d0986ddaa51bfb5e03b06df1213cc3bb7966588d6153bdda57f2e3671e986 | Hash of an unauthenticated st_ JSP webshell. |
| SHA256 | 8aac187bae71f75fa2dde03dcb4a9279c982182ee8254ae96e7a6626fe4c7617 | Hash of main.py, the Python loader for the host-specific implant. |
| SHA256 | 91b3cc9d6421b651ec85a16062af3ba26700dad2eea4a8a7e42fdd2e422f8803 | Hash of the decoded marshaled Python payload from the implant loader. |
| SHA256 | a87002c32723f1849b3ad17b1fe6da732c9810b54b08501be21f5b1fcd882a59 | Hash of the configuration associated with the XMRig miner. |
| SHA256 | bb2472cf5dc7e5c94216d355bf84fba2c8d088d03d61a1ac0d78639049cf5e1f | Hash of the x64 DLL embedded in the Python implant. |
| SHA256 | ca5f8e5247f1a044b8be45ef03187726b9af3ac30fd93fb5bb54144e34ed3738 | Hash of chisel, a tunneling tool staged in the compromised environment. |
| SHA256 | e6e576a634166a16bdbfc09b14e7cf8eab90015d2dfa67dd73f3968ee869229b | Hash of a2b59a4bb296604b.jsp, a keyed JSP webshell that runs commands. |
| SHA256 | e79c91e8157fef862be8cbe80bdf57b87a541416717265f81f669d751fca4a3d | Hash of the reflective-loader tail embedded in the implant. |
| SHA256 | f76dae028e0c43248c128b3bf609e8d660ce0bf44b53ab9e097887e6f5206eb5 | Hash of the scheduled-task XML associated with the miner's persistence. |
| URL | hxxps[:]//creepexplosiondarknight[.]com/d | C2 URL identified in the embedded DLL of the Python-based implant. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe Python loader was wrapped in Base64, lzma, and marshaled code; the webshells also used hardcoded keys and signed requests.T1027.003 · SteganographyAhsayCBS.jsp extracted an AES-encrypted payload from the least-significant bits of PNG pixel data.T1053.005 · Scheduled TaskThe kvm scheduled task ran as SYSTEM every minute and restarted kvm-agent.exe when needed.T1059.003 · Windows Command ShellJSP webshells executed commands through cmd.exe /c.T1059.006 · Pythonmain.py ran decoded Python code from an embedded Python distribution.T1071.001 · Web ProtocolsThe implant's embedded DLL contained an HTTPS C2 URL.T1190 · Exploit Public-Facing ApplicationThe operators exploited CVE-2026-105133 and CVE-2026-105134 against internet-exposed AhsayCBS servers.T1480.001 · Environmental KeyingThe implant exited unless a marker file named with the SHA-256 of the host's MachineGuid was present.T1496.001 · Compute Hijackingkvm-agent.exe ran as an XMRig miner configured to connect to mining pools.T1505.003 · Web ShellFive families of JSP webshells were found in AhsayCBS web directories.T1547.001 · Registry Run Keys / Startup FolderA registry Run key started the Python implant through explorer.exe.T1555 · Credentials from Password StoresA command consistent with NetExec's Veeam module queried stored backup credentials and decrypted them with DPAPI.T1562.001 · Disable or Modify ToolsMicrosoft Defender exclusions covered system paths, temporary folders, dropper processes, and the AhsayCBS service process.T1572 · Protocol TunnelingThe compromised environment contained the tunneling tools gost and chisel.T1620 · Reflective Code LoadingThe implant used a reflective loader to map an embedded x64 DLL into memory.
CVE
CVE-2026-105133Ahsay · AhsayCBSOn October 8, 2026, we reported that threat actors were exploiting CVE-2026-105133 and CVE-2026-105134 in AhsayCBS to drop webshells and an XMRig miner. This follow-up analyzes the tooling we recovered from threeCVE-2026-105134Ahsay · AhsayCBSOn October 8, 2026, we reported that threat actors were exploiting CVE-2026-105133 and CVE-2026-105134 in AhsayCBS to drop webshells and an XMRig miner. This follow-up analyzes the tooling we recovered from three
Malware
Vendors
Products
AhsayCBSHomeBlogInside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 ImplantMicrosoft Defender Antimalware PlatformAtera and Splashtop, a local account named wdguest, and a Mimikatz package on disk. We also saw Microsoft Defender exclusions that covered C:\ProgramData, C:\Windows, temp folders, the dropper processes, and theVeeamtools, remote access software, broad Defender exclusions, and a command consistent with NetExec's Veeam credential-theft module, which suggests the operator may have targeted backup infrastructure in particular.
Tools
AnyDeskgost and chisel, staged in .st<id> folders as wust<id>a.exe and wust<id>b.exe, the remote access tools AnyDesk, Atera and Splashtop, a local account named wdguest, and a Mimikatz package on disk. We also sawAterachisel, staged in .st<id> folders as wust<id>a.exe and wust<id>b.exe, the remote access tools AnyDesk, Atera and Splashtop, a local account named wdguest, and a Mimikatz package on disk. We also saw MicrosoftChiselAround those pieces, the same environment held the tunneling tools gost and chisel, staged in .st<id> folders as wust<id>a.exe and wust<id>b.exe, the remote access tools AnyDesk, Atera and Splashtop, a local accountGOSTAround those pieces, the same environment held the tunneling tools gost and chisel, staged in .st<id> folders as wust<id>a.exe and wust<id>b.exe, the remote access tools AnyDesk, Atera and Splashtop, a local accountMimikatzthe remote access tools AnyDesk, Atera and Splashtop, a local account named wdguest, and a Mimikatz package on disk. We also saw Microsoft Defender exclusions that covered C:\ProgramData, C:\Windows, tempNetExecheld tunneling tools, remote access software, broad Defender exclusions, and a command consistent with NetExec's Veeam credential-theft module, which suggests the operator may have targeted backup infrastructure inSplashtopin .st<id> folders as wust<id>a.exe and wust<id>b.exe, the remote access tools AnyDesk, Atera and Splashtop, a local account named wdguest, and a Mimikatz package on disk. We also saw Microsoft Defender