Huntress Details AhsayCBS Exploitation Delivering Python Backdoor
Summary
Huntress says attackers exploited two patched AhsayCBS flaws to install web shells, XMRig miners and a Python backdoor that checks the host before running. The activity also included Defender exclusions and a Veeam credential query.
Key points
- Huntress observed the activity in October 2026 and attributed the exploitation to an unknown threat actor; the two flaws, CVE-2026-105133 and CVE-2026-105134, were patched in mid-October.
- The vulnerabilities enabled authentication bypass and arbitrary command execution and were assessed to have been weaponized as zero-days.
- Attackers reportedly deployed five families of JSP web shells and two XMRig miners; one miner was configured to restart every minute through a SYSTEM scheduled task.
- The Python backdoor checks the host's MachineGuid against a marker file before running an embedded x64 DLL in memory, which contacts creepexplosiondarknight[.]com.
- The intrusion also involved Microsoft Defender exclusions, GOST and Chisel tunneling tools, and remote-access software including AnyDesk, Atera and Splashtop.
- On a related Veeam server, Huntress observed a PowerShell command apparently launched remotely through WMI that queried the backup database for credentials and decrypted them with DPAPI; the number retrieved is unknown.
Article Details
- Attack Vectors
- Attackers exploited CVE-2026-105133 and CVE-2026-105134 in AhsayCBS to bypass authentication and execute arbitrary commands.
- The intrusion deployed JSP web shells, XMRig miners, tunneling tools, remote-access software, and a Python backdoor.
- On a related Veeam server, a PowerShell script apparently launched remotely through WMI queried the VeeamBackup PostgreSQL database and decrypted stored credentials with DPAPI.
- Defensive Notes
- Ahsay Backup released patches for CVE-2026-105133 and CVE-2026-105134 in mid-October 2026.
- The attack configured Microsoft Defender exclusions.
- A second XMRig miner was set to restart every minute through a SYSTEM scheduled task.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | creepexplosiondarknight[.]com | C2 domain contacted by the embedded DLL run by the Python backdoor. |
MITRE ATT&CK
T1036 · MasqueradingOne XMRig miner masqueraded as Microsoft Edge.T1047 · Windows Management InstrumentationA PowerShell script was apparently launched remotely through WMI on a related Veeam server.T1053.005 · Scheduled TaskA SYSTEM scheduled task restarted the second XMRig miner every minute.T1059.001 · PowerShellA PowerShell script queried the VeeamBackup PostgreSQL database for stored credentials.T1059.006 · PythonThe intrusion used a Python backdoor that ran an embedded x64 DLL in memory.T1105 · Ingress Tool TransferThe attack served tunneling tools, including GOST and Chisel, to compromised systems.T1190 · Exploit Public-Facing ApplicationAttackers exploited two AhsayCBS vulnerabilities to bypass authentication and execute commands on affected systems.T1219 · Remote Access ToolsAnyDesk, Atera, and Splashtop were used as legitimate remote-access software to establish persistent access.T1496 · Resource HijackingXMRig miners were deployed to compromised systems.T1505.003 · Web ShellThe intrusion left JSP web shells on compromised systems.T1562.001 · Disable or Modify ToolsThe attack configured Microsoft Defender exclusions.
CVE
CVE-2026-105133Ahsay · AhsayCBSThe activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems.CVE-2026-105134Ahsay · AhsayCBSby Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two
People
Malware
Products
AhsayCBSCybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant.AnyDeskexclusions, while serving tunneling tools (GOST and Chisel) and legitimate remote access software (AnyDesk, Atera, and Splashtop) to establish persistent access.Aterawhile serving tunneling tools (GOST and Chisel) and legitimate remote access software (AnyDesk, Atera, and Splashtop) to establish persistent access.Microsoft Defender Antimalware PlatformIn an attempt to fly under the radar, the attack chain also configures Microsoft Defender exclusions, while serving tunneling tools (GOST and Chisel) and legitimate remote access software (AnyDesk, Atera, and Splashtop)PostgreSQLmodule: a PowerShell script, apparently launched remotely through WMI, that queried the VeeamBackup PostgreSQL database for stored credentials and decrypted them with DPAPI," Semon said.Splashtopserving tunneling tools (GOST and Chisel) and legitimate remote access software (AnyDesk, Atera, and Splashtop) to establish persistent access.Veeam"On a related Veeam server in the same environment, we also saw a command consistent with NetExec's Veeam credential-theft module: a PowerShell script, apparently launched remotely through WMI, that queried the
Tools
Chiselthe attack chain also configures Microsoft Defender exclusions, while serving tunneling tools (GOST and Chisel) and legitimate remote access software (AnyDesk, Atera, and Splashtop) to establish persistent access.GOSTthe radar, the attack chain also configures Microsoft Defender exclusions, while serving tunneling tools (GOST and Chisel) and legitimate remote access software (AnyDesk, Atera, and Splashtop) to establish persistentNetExec"On a related Veeam server in the same environment, we also saw a command consistent with NetExec's Veeam credential-theft module: a PowerShell script, apparently launched remotely through WMI, that queried the