"However, this incident reflects a much larger intrusion with more patience; the operator planted shells in several places, ran two different miners, staged tunneling tools, and installed a custom implant, all on servers whose job is to hold backups," Huntress researcher Jonathan Semon said.
How the attackers got in: CVE-2026-105133 and CVE-2026-105134
Huntress observed activity in October 2026 that exploited a chain of two now-patched AhsayCBS vulnerabilities — CVE-2026-105133 and CVE-2026-105134 — to bypass authentication and execute arbitrary commands on affected systems. Ahsay Backup released patches for those two vulnerabilities in mid‑October 2026. Security researchers assessing the incident concluded the flaws were weaponized as zero‑days.
Multiple JSP web shells planted across backup servers
The intruder deployed at least five families of Jakarta Server Pages (JSP) web shells on compromised systems. Huntress identified them by filename and capability:
- nsmind.jsp — described as a signed API providing command execution and file transfer via parameters such as exec, cd, upload and download;
- AhsayCBS.jsp — a loader that hides encrypted payloads inside the pixel data of PNG images and executes them from memory; Huntress noted the loader "disguise[d] as an internal image preview service" and that it used only JSP implicit objects and fully qualified class names so it would compile on any servlet container and on JDK 6 and later;
- Keyed command shell — compares a hard-coded key against its own copy and, if matched, runs commands via "cmd.exe";
- Keyed shell with file write — builds on the keyed command shell with the ability to write Base64-decoded bytes to any path the service account can reach, enabling deployment of additional tools;
- status_.jsp or st_.jsp (for example, st_jgaejj.jsp) — used to run commands, recursively delete paths supplied as input, and self-delete via cmd, del and rm parameters.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleThe Python backdoor and active sandbox evasion
The intrusion’s most notable component was a Python-based backdoor named main.py designed to run only on the host where it was staged and to avoid execution in analyst sandboxes or on other machines. The implant computes the SHA‑256 hash of the host MachineGuid and looks for a marker file with the same name in the same directory as the Python implant. If the marker is present, the backdoor runs an embedded x64 DLL in memory that contacts a command‑and‑control server at creepexplosiondarknight[.]com.
Tools, persistence, and ancillary activity observed
Beyond web shells and the Python implant, Huntress observed a broader toolset and persistence mechanisms. The attackers deployed an XMRig miner masquerading as Microsoft Edge and a second XMRig instance named kvm-agent.exe that was configured to restart every minute through a SYSTEM scheduled task; the two miners used different wallets and different mining pools. The chain also configured Microsoft Defender exclusions, served tunneling tools (GOST and Chisel), and staged legitimate remote-access software including AnyDesk, Atera and Splashtop to maintain access.
Impact on backup infrastructure and evidence of credential theft targeting Veeam
Huntress said evidence suggests the actor focused on servers that hold or manage backups. On a related Veeam server within the same environment, researchers observed a command consistent with NetExec’s Veeam credential‑theft module: a PowerShell script, apparently launched remotely through WMI, that queried the VeeamBackup PostgreSQL database for stored credentials and decrypted them with DPAPI. "Backup software holds credentials for hypervisors, repositories and domain accounts," Semon said. Huntress added it could not say how many credentials were retrieved, but that the pairing of an Ahsay foothold with a Veeam credential query "suggested the operator was interested in backup infrastructure on purpose, not by accident."
What this means for technologists, backup administrators, and incident responders
Technologists and security teams should treat hosts running backup management software as high‑value targets: the attackers used zero‑day exploitation, memory‑only loaders, scheduled‑task persistence, tunneling tools and legitimate remote‑access applications to build long‑lived access. Backup administrators and procurement teams will need to confirm that mid‑October 2026 patches from Ahsay Backup were applied and review any Microsoft Defender exclusions for signs of tampering. Incident responders investigating similar intrusions should search for the specific indicators noted by Huntress — the five JSP shell types, a main.py implant that checks for a MachineGuid‑named marker file, scheduled tasks that rerun kvm-agent.exe every minute, and remote queries against VeeamBackup PostgreSQL databases possibly decrypted with DPAPI — and be alert for tunneled connections created by GOST or Chisel.
The attack Huntress described combines rapid opportunistic activity with more deliberate, patient techniques aimed at backup infrastructure: compiled‑agnostic JSP loaders, an implant that refuses to run outside its chosen host, and explicit steps to harvest stored credentials. Those facts leave a pointed question for defenders: how many backup servers that handled domain, hypervisor or repository credentials were exposed to these exploits before the mid‑October patches were applied?
Source: The Hacker News — Attackers Exploit AhsayCBS Flaws to Deploy Sandbox‑Evading Python Backdoor
