AhsayCBS Backup Servers Breached Through CVE-2026-105133 and CVE-2026-105134 Held More Than a Miner: Huntress Found Webshells, a Python Implant, Tunnels and a Veeam Credential Query
If you run AhsayCBS, the backup server many managed service providers use, confirm it has Ahsay's hotfix (10.3.4.45 for version 10, 9.15.2.70 for versions 7 to 9) and then check it for planted files, because a patch does not remove a shell that was already in. Huntress published a second report on November 9 about three AhsayCBS servers in one environment that were broken into between October 8 and 11, before the hotfixes existed. The attackers left more than a crypto miner: webshells, a Python implant, tunnelling tools and signs that they went after stored backup credentials.
What has been reported
The primary sources are Huntress's two reports (October 8, updated October 12, and November 9) and Ahsay's notice of October 12, read for us by an agent. The Hacker News report of November 10 repeats them. The two flaws are in CISA's exploited-vulnerabilities catalog; our copy shows both added on October 14.
The flaws: CVE-2026-105133 is an authentication bypass in the API component. CVE-2026-105134 is a command injection that runs commands as the system account through the Replication Receiver's /rps/api/json/UpdateReceivers.do endpoint. CISA's entries say they can be chained. Huntress's November report says the attackers chained both against internet-exposed AhsayCBS.
Versions and fixes, per Ahsay and Huntress: Huntress says versions up to 10.3.4 are affected, and Ahsay says its earlier patches (9.15.2.59 and 10.3.4.0) did not fully fix the two flaws. Hotfix 10.3.4.45 covers version 10 and 9.15.2.70 covers versions 7 to 9. Both are behind Ahsay's partner portal, and a reboot is needed after applying. Huntress says it verified that 10.3.4.45 blocks the entry point it saw.
First wave (October 8): Huntress saw five organizations targeted, with scouting, JSP webshells and an XMRig miner dressed up as Microsoft Edge (a service named MicrosoftEdgeUpdateSvc), a script that hides and kills Task Manager at 18:00, and a vulnerable driver used to boost mining. Exploitation began October 7 at 23:20 UTC, per Huntress.
The November report, from three servers in one environment: five families of JSP webshells, some with hard-coded or per-host secrets so only the attacker can use them; a second miner (kvm-agent.exe) run from a system scheduled task named kvm every minute; a Python implant (main.py) that only runs when a marker file named after a hash of the machine's identity exists, then loads a DLL in memory that contacts a command-and-control domain; the tunnelling tools GOST and Chisel; the remote-access tools AnyDesk, Atera and Splashtop; Microsoft Defender exclusions; a local account named wdguest; and Mimikatz on disk. Huntress also saw a command consistent with a tool's Veeam module that queried the Veeam backup database and decrypted stored credentials. It says it cannot tell how many credentials were obtained.
Scope: Huntress says this was one environment and that it "reflects a much larger intrusion with more patience" than the miners alone suggest. It describes AhsayCBS as used mainly by managed service providers. No total count of exposed or compromised servers is published.
What it means
A backup server holds the keys to everything it backs up, and a managed provider's backup server holds those keys for many customers. Mining is the noisy part of this intrusion; the tunnels, the implant and the credential query are the part that matters. The timeline is the lesson: the break-ins happened on October 8 to 11, the hotfixes arrived on October 12, and a defender who patched on October 13 and stopped there would still have the attackers' shells and scheduled tasks.
What to do
Apply Ahsay's hotfix, then reboot. If you cannot, restrict the AhsayCBS management interface to a VPN or a short list of trusted addresses.
Hunt before you trust the patch. Look for JSP files you did not install under the webapps\cbs and webapps\rps folders, a scheduled task named kvm, a local account named wdguest, new Defender exclusions, a service named MicrosoftEdgeUpdateSvc, an edge.exe or msedge.exe outside the real Edge folder, and a python.exe running as the system account.
Search the AhsayCBS access logs from October 1 onward for requests to UpdateReceivers.do.
If you find any of it, Huntress recommends re-imaging from a trusted backup. Rotate every credential the server stored or could reach, including backup software, Veeam and anything in the same network.
Block the command-and-control domain and the other indicators listed in the sources. We list the ones that matter in the feed section below.
If you are a managed provider, tell the customers whose data sat on an affected server, and check the backup repositories for tampering before you need a restore.
What is not known
How many AhsayCBS servers have been broken into, and by whom: Huntress does not attribute this. Whether the credentials the attackers went after were taken. Whether the November intrusion and the October 8 wave are the same operator. How the single environment was chosen. Huntress's page does not say which of the two flaws was the first step for that environment; it says both were chained.
How we know, and how we checked
We read both Huntress reports, Ahsay's notice and The Hacker News through an agent; the indicator list for the November report was read verbatim from the page. We did not test AhsayCBS. We checked our own feed: the October 8 indicators, including the Hong Kong address 177.4.12.11 and the disguised miner's hash, have been in it since October 15, from Huntress, and ThreatFox listed 177.4.12.11 on October 3 before Huntress published, per our record, which is ThreatFox's and not ours. Today we added six indicators from the November report, credited to Huntress: the implant's command-and-control domain, and the hashes of the second miner, the Python implant, its DLL and two of the webshells. We did not add the mining pools, the cloud storage host used in the first wave, the tunnelling tools' hashes (they are ordinary tools) or any secret the report publishes. Our edge check over October 1 to today for UpdateReceivers.do and the /rps/ and /obs/ paths found no match among 197,614 blocked requests, 49,964 decoy hits and 1,720 origin captures. We run no AhsayCBS, so that says only that these three sources saw no such request.
Sources
Huntress, "AhsayCBS flaws exploit," October 8, 2026 (updated October 8 and 12). Huntress, "Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant," November 9, 2026. Ahsay, patch notice for CVE-2026-105133 and CVE-2026-105134, October 12, 2026. CISA Known Exploited Vulnerabilities catalog entries for both CVEs. The Hacker News, "Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor," November 10, 2026.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments