AhsayCBS Vulnerability: Hacked Backup Servers Kept Hidden Webshells and a Python Backdoor, and What to Check After Patching

Attackers broke into AhsayCBS backup servers in October through two flaws that need no login. A report published on November 9, 2026 shows what they left behind: five families of hidden webshells, a cryptocurrency miner and a Python backdoor. If your business, or the company that backs up your data, runs AhsayCBS, installing the hotfix does not remove anything already planted. Any server that was exposed before October 12 needs to be checked as well as patched.

AhsayCBS is the server side of Ahsay's backup software. Many IT providers run it to store their customers' backups, so a business can depend on it without ever logging in to it.

What happened to AhsayCBS backup servers

Two vulnerabilities are behind this. CVE-2026-105133 is an authentication bypass in the AhsayCBS API. CVE-2026-105134 is a command injection flaw in the Replication Receiver component, reached through /rps/api/json/UpdateReceivers.do. Chained together, they let an attacker with no account run commands on the server as SYSTEM, the highest level of access on Windows.

Security firm Huntress first saw the chain used on October 7, 2026 at 23:20 UTC. On October 8 it reported that five organizations had been targeted. Ahsay's first fixes, v9.15.2.59 and v10.3.4.0, did not work: in its October 12 announcement, Ahsay says they "did not fully address" the two flaws, and it replaces them with new hotfixes. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 14.

Huntress's follow-up report covers one organization with three AhsayCBS servers. They were exploited between October 8 and October 11, before working hotfixes existed. That report is the subject of this post.

AhsayCBS attack: what is confirmed and what is not

What the attackers left behind on AhsayCBS

Five webshell families

Huntress found malicious JSP files in the webapps\cbs and webapps\rps folders of the AhsayCBS install. A webshell is a script on the web server that gives an attacker a command line through the browser. The five families range widely:

• a basic password-protected shell that shows a 404 error to anyone without the key
• versions that can also write files or delete themselves
• nsmind.jsp, which only accepts signed requests and supports file uploads and downloads
• AhsayCBS.jsp, a loader that hides its encrypted code inside the pixels of PNG images

Copies also turned up in Linux-style folders such as C:\opt and C:\usr on the Windows server, and in folders named ahsay_poc_*, ahsay_th and ahsay_t0.

A miner that restarts every minute

A second XMRig cryptocurrency miner, kvm-agent.exe, ran from C:\Windows\SysWOW64\kvm-agent\. A SYSTEM scheduled task named kvm checked on it every minute and restarted it if it had stopped. Huntress's earlier report described a different miner disguised as Microsoft Edge.

A Python backdoor that only runs on one machine

The attackers installed a private copy of Python under the SYSTEM profile and launched a script, main.py, from a registry Run key. The script exits unless it finds a marker file tied to that specific computer, which makes it harder to study anywhere else. It loads a hidden program that contacts a command server at creepexplosiondarknight[.]com.

Defender exclusions, remote access tools and Veeam

The attackers added Microsoft Defender exclusions for C:\ProgramData, C:\Windows, temp folders and the AhsayCBS service cbssvcX64.exe. They also left behind:

• the tunnelling tools gost and chisel
• remote access software: AnyDesk, Atera and Splashtop
• a local account named wdguest
• a Mimikatz package

On a related Veeam server, Huntress saw a script query the Veeam database and decrypt stored credentials.

Which AhsayCBS versions are fixed

Ahsay says to apply the hotfix and then reboot the server. Both hotfixes are available only to Ahsay partners through the Partners Portal. If a provider runs your backups, ask them which build is installed.

How to check an AhsayCBS server for compromise this week

Huntress notes that patching blocks new break-ins but does not remove files that are already there. Work through this list:

• Confirm the build is 10.3.4.45 or 9.15.2.70, and that the server was rebooted afterwards.
• Limit the AhsayCBS management interface to trusted IP addresses or put it behind a VPN, as Huntress recommends.
• Look for unexpected .jsp files in webapps\cbs and webapps\rps, and for folders named ahsay_*, folders named with timestamps, and C:\ahsay_tf.
• List scheduled tasks that run as SYSTEM, especially any that repeat every minute, such as one named kvm.
• Review Microsoft Defender exclusions for entries nobody on your team added.
• Check for python.exe or pythonw.exe running from the SYSTEM profile, and for unknown remote access tools or a wdguest account.
• Watch for cbssvcX64.exe starting a command prompt.
• Search DNS and firewall logs for creepexplosiondarknight[.]com.

If you find any of these, Huntress advises re-imaging the server from a trusted backup. Then change every password stored on the server or reachable from it, including those saved in AhsayCBS and in other backup software.

Why backup server security matters for a business network

Businesses often treat a backup server as a quiet machine that just runs on its own. Attackers see it differently. It runs with high privileges, it holds copies of company data, and it usually stores the passwords it needs to reach other systems. In this case the attackers used it as a base: they hid tools there, added antivirus exclusions, and moved on to a Veeam server to go after stored credentials.

That means two things for a business. First, a backup server that can be reached from the internet needs patching as fast as your firewall or email gateway. Second, after a break-in, check the backups themselves before you trust them for a restore. We covered first patches that do not finish the job in Updated Is Not the Same as Patched. We covered who is responsible for patching systems a vendor or provider runs in Who Is Patching the Software That Runs Your Business?.

AhsayCBS vulnerability questions people are asking

Is AhsayCBS being actively exploited?

Yes. CISA listed CVE-2026-105133 and CVE-2026-105134 as known exploited on October 14, 2026. Huntress first saw attacks on October 7.

Which AhsayCBS version fixes CVE-2026-105134?

According to Ahsay, the fixes are 10.3.4.45 for v10 and 9.15.2.70 for v7 to v9. The earlier builds 10.3.4.0 and 9.15.2.59 are not enough.

If I patched AhsayCBS, am I safe?

Patching stops new attacks through these flaws. It does not remove webshells, tasks or backdoors planted before you patched, so you still need to check the server.

Could my business be running AhsayCBS without knowing it?

Possibly. Many IT and backup providers host AhsayCBS for their customers. Ask your provider whether they use it and which build is installed.

Was customer data stolen in the AhsayCBS attacks?

That is not confirmed. Huntress found a webshell with a download feature but no logs showing it was used to take data.

The bigger lesson

Backups are your recovery plan, and that is exactly why attackers want to hide inside them. Patch the backup server like any other system that faces the internet. When a flaw was exploited before a fix existed, check what was left behind instead of assuming the update cleaned it up.

Lock down your backup and server setup with security hardening, or get a quote for a review.

Get security alerts by email, with the free checklist, at /security-alerts.

Sources: Huntress: Inside an AhsayCBS Intrusion; Huntress: AhsayCBS flaws exploited; Ahsay patch announcement; CISA KEV alert, October 14, 2026.