Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant

Threat actors exploited authentication bypass and unauthenticated remote code execution vulnerabilities in the AhsayCBS management console, specifically CVE-2026-105133 and CVE-2026-105134, between October 8 and October 11, 2026. The investigation uncovered a sophisticated intrusion involving the planting of webshells, remote code execution via an API endpoint, installation of miners, staging of tunneling tools, and deployment of a custom implant on servers designated for backup management.
The webshells observed varied in design: some functioned as simple command execution shells using parameters, others allowed writing data to arbitrary paths, and some were designed to delete themselves or execute commands recursively. One webshell was specifically engineered to process uploaded PNG files by extracting pixel data to run encrypted code in memory using Java features. Furthermore, a second miner was deployed, which utilized a scheduled task named kvm running as SYSTEM to ensure persistence through automated restarts.
The infrastructure observed suggests an actor with patience, planting multiple artifacts across the compromised systems rather than just executing a single exploit. The presence of these artifacts, combined with evidence of credential querying against backup software databases, indicates an intent targeting the integrity and access of backup infrastructure, not merely data exfiltration.

* Exploitation occurred between October 8 and October 11, 2026.
* The exploited vulnerabilities were CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (unauthenticated remote code execution as SYSTEM) in AhsayCBS.
* Webshells were found in directories such as webapps\cbs and webapps\rps, and also in Linux-style paths like /opt/AhsayCBS, /usr/local/AhsayCBS, and /home/ahsay/AhsayCBS.
* Shells included variants that used parameters for command execution (cmd.exe), file manipulation (del, rm), and a variant allowing data writing.
* One webshell, AhsayCBS.jsp, operated by processing uploaded PNG files, extracting pixel data to run encrypted code in memory using AES.
* A second miner, kvm-agent.exe, was observed configured similarly to XMRig, utilizing a scheduled task named kvm running as SYSTEM for persistence.
* An implant file, main.py, was found under the SYSTEM profile and executed via explorer.exe.
* Tunneling tools like gost and chisel were staged in .st folders as wusta.exe and wustb.exe.
* The intrusion targeted servers managing backups, with an activity suggesting credential theft from a Veeam PostgreSQL database via WMI-launched PowerShell.
* Microsoft Defender exclusions were found covering system paths and the AhsayCBS service process (cbssvcX64.exe).

The narrative of this intrusion moves beyond simple vulnerability exploitation to demonstrate a methodical campaign focused on deep, persistent control over critical infrastructure. The variety of webshell families—from simple command execution shells to complex, memory-resident loaders disguised as image services—indicates an actor prioritizing adaptability across diverse environments, rather than relying on a single exploit chain. This complexity points toward a highly capable adversary willing to tailor tooling for specific operating systems and application contexts.
The integration of persistence mechanisms, such as the scheduled task running as SYSTEM, alongside data-centric objectives like querying backup credentials suggests a strategic pivot from simple access to long-term presence within an environment whose primary function is data management. The ability to find shell artifacts outside the live installation path further confirms that the adversary sought ubiquity, attempting to place footholds wherever AhsayCBS components were expected, indicating an understanding of deployment patterns.
The final phase, involving the custom Python implant that checks for a host-specific marker file and then performs reflective code loading, signals a commitment to stealth and environmental awareness. This mechanism implies an effort to evade static analysis tools by tailoring the payload based on the host's specific configuration (MachineGuid). The simultaneous presence of exfiltration channels (tunneling tools) and internal reconnaissance (credential access) against backup infrastructure suggests that the ultimate goal was systemic disruption or high-value compromise, leveraging the trust inherent in backup systems.
Bridge questions: If an actor prioritizes planting artifacts across multiple potential installation paths rather than sticking to a single known vector, what does this reveal about their operational playbook for exploiting proprietary software? How does the observed correlation between AhsayCBS compromise and Veeam credential access change the standard assumption that backup systems are isolated security perimeters? What intelligence gaps exist regarding the full lifecycle of an artifact planted on a host before it is discovered?