Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
Attackers are exploiting two critical vulnerabilities in AhsayCBS backup software to deploy a sophisticated Python backdoor designed to evade sandbox detection, with patches now available.
Security researchers have uncovered a sophisticated attack campaign that leveraged two critical vulnerabilities in AhsayCBS backup software to deploy a custom Python backdoor. The exploitation chain, observed in October 2026, targets CVE-2026-105133 and CVE-2026-105134, allowing attackers to bypass authentication and execute arbitrary commands on affected systems. Ahsay Backup released patches for these flaws in mid-October 2026.
Initially, threat actors employed a "smash-and-grab" approach, deploying web shells and XMRig cryptocurrency miners. However, the observed incident revealed a more persistent and patient operator who planted multiple web shells, ran different miners, staged tunneling tools, and ultimately installed a custom implant on servers responsible for holding backups. This indicates a targeted effort to compromise sensitive backup data.
The attackers deployed a variety of Jakarta Server Pages (JSP) web shells, including "nsmind.jsp" for command execution and file transfer, and "AhsayCBS.jsp" which could hide encrypted payloads within PNG image data and execute them from memory. Other deployed shells included keyed command shells for executing commands and writing files, and status-related shells for command execution and self-deletion.
Beyond the initial web shells, the campaign also deployed two distinct XMRig cryptocurrency miners. One miner masqueraded as Microsoft Edge, while a second, named "kvm-agent.exe," was configured to restart every minute via a SYSTEM scheduled task, utilizing a different wallet and mining pool to obfuscate its activity.
The most notable component of the attack is the custom Python backdoor, codenamed "main.py." This implant is engineered to run exclusively on the host it is staged on, actively preventing execution within sandbox environments or on analyst machines. It achieves this by calculating the SHA-256 hash of the host's MachineGuid and checking for a marker file with the same name in its directory.
To further evade detection and maintain persistence, the attackers configured Microsoft Defender exclusions and deployed tunneling tools like GOST and Chisel. They also installed legitimate remote access software such as AnyDesk, Atera, and Splashtop, facilitating ongoing access to compromised environments. Evidence suggests the threat actor specifically targeted servers managing backups.
In a related incident on a Veeam server within the same environment, commands consistent with NetExec's Veeam credential-theft module were observed. This involved a PowerShell script querying the VeeamBackup PostgreSQL database for stored credentials, which were then decrypted using DPAPI. The attackers' interest in backup infrastructure, evidenced by the Ahsay foothold and Veeam credential theft, suggests a deliberate focus on compromising backup systems and the sensitive data they hold.