AhsayCBS Webshells: Huntress Finds Hidden Backdoors, a Second Cryptominer and a Python Implant on Hacked Backup Servers, and What to Check

Huntress has published a second report on hacked AhsayCBS backup servers. It shows that installing Ahsay's hotfix does not undo what attackers already left behind. On three servers belonging to one organization, researchers found layered webshells, a second cryptominer, remote access tools and a Python implant built to load hidden code, all on the machines that hold customer backups.

If your company or your IT provider runs AhsayCBS, patching was step one. Step two is checking each server for leftovers, and Huntress's report says what to look for.

What happened to AhsayCBS servers

AhsayCBS is the server console for Ahsay's backup software, which IT teams and service providers use to back up client machines. On October 8, 2026, Huntress reported attackers exploiting two flaws. CVE-2026-105133 is an authentication bypass. CVE-2026-105134 allows remote code execution as SYSTEM with no login, through the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do. Huntress first saw exploitation on October 7, 2026, at 23:20 UTC, and by October 8 it had seen five organizations targeted.

Ahsay's own advisory, updated October 12, 2026, says its earlier patches, v9.15.2.59 and v10.3.4.0, "did not fully address" the two vulnerabilities. It tells customers to install new hotfixes and reboot.

On November 9, 2026, Huntress published a follow-up about one environment where three AhsayCBS servers were breached between October 8 and October 11, 2026, before the hotfixes were available. Huntress ties this intrusion to the first campaign through shared webshell locations, an exploit source address and matching files, but presents that as a link, not a certainty.

What Huntress found on the hacked AhsayCBS servers

Huntress says it found the following on disk or in logs:

• Several webshells, in layers. These include a basic keyed command shell; shells with random six-letter names starting status_ or st_ that can run commands, delete files and delete themselves; nsmind.jsp, which only accepts signed requests; and AhsayCBS.jsp, which reads encrypted code hidden in the pixels of uploaded PNG images and runs it in memory. Copies sat under webapps\cbs and webapps\rps, plus odd folders such as C:\opt, C:\usr, C:\home and C:\ahsay_tf. Huntress says the operator appears to have upgraded from the basic shell to nsmind.jsp.
• A second cryptominer. kvm-agent.exe is a build of XMRig, an open-source Monero miner, that mines through SupportXMR pools over port 443. A SYSTEM scheduled task named kvm restarts it every minute, and its start time was backdated. This is a different miner from the one disguised as Microsoft Edge in Huntress's first report.
• Remote access and tunneling tools. These include gost and chisel, AnyDesk, Atera and Splashtop, a local account named wdguest, and a Mimikatz package (a well-known password theft tool) on disk.
• Antivirus blind spots. Microsoft Defender exclusions covered C:\ProgramData, C:\Windows, temp folders and the AhsayCBS service process cbssvcX64.exe.
• A Python implant file. A script, main.py, sat in a standalone Python install under the SYSTEM profile and was set to start from a Run registry key.

What the Python implant is designed to do

Huntress studied this implant's code. It did not watch it run. According to that code, the script looks for a marker file named after a hash of the machine's unique ID, and quits if the file is missing. Huntress describes this as a way to stay quiet on sandboxes and analysts' machines. If the marker is present, the code loads a 673 KB blob into memory that contains a loader and a 64-bit Windows DLL. The DLL's command server is creepexplosiondarknight[.]com, and its strings suggest it looks up addresses over encrypted DNS through Quad9 and Google.

Huntress states plainly: "We have not identified the malware family and have not watched the implant run," and "We did not find a marker file in the folder we collected." So whether this implant ever executed on these servers is unknown.

What is not known

• Whether data was taken. nsmind.jsp has a download function, but Huntress "did not see logs showing download in use, so we cannot say what, if anything, was taken."
• Whether backup credentials were stolen. On a Veeam server in the same environment, Huntress saw activity it calls "consistent with NetExec's Veeam credential-theft module": a PowerShell script, apparently launched remotely, that queried Veeam's database for stored credentials. That wording describes a resemblance, not a confirmed match. Huntress says it "cannot say how many of those credentials were retrieved," and whether the attempt worked at all is not confirmed.
• Whether the Python implant ran, as covered above.
• How many organizations are affected beyond the five in Huntress's first report.
• The v9 hotfix. Huntress says it verified that 10.3.4.45 blocks the entry point it saw. Its posts do not say it tested 9.15.2.70 the same way.

Why a hacked backup server matters for a business

A backup server reaches every machine it protects, stores the credentials it needs to get there, and is often trusted by security tools. That trust is exactly what the Defender exclusions here exploited. An attacker inside a backup server is placed to read company data, use stored passwords elsewhere, or delete backups before a ransomware attack. If an IT provider backs up your business with AhsayCBS, your data sits on their server, so this is your question to ask even if you never log in to it.

AhsayCBS: what to do this week

Huntress's report lists file hashes and additional indicators for your security tools.

AhsayCBS questions people are asking

Is AhsayCBS safe after the hotfix?

The hotfix closes the way in that Huntress saw being exploited. It does not remove webshells, miners, accounts or implants that were planted before you patched. Huntress notes that patching does not remove files an attacker has already planted.

Which AhsayCBS versions are affected?

Ahsay says its earlier patches, v10.3.4.0 and v9.15.2.59, did not fully address CVE-2026-105133 and CVE-2026-105134. Install 10.3.4.45 on v10, and 9.15.2.70 on v7 through v9.

How do I check if my AhsayCBS server was hacked?

Work through the table above: unexpected JSP files, ahsay_* folders, a one-minute SYSTEM task, unfamiliar Defender exclusions, a standalone Python install under the SYSTEM profile, and unknown remote access tools.

Were backups or customer data stolen?

Unknown. Huntress found tools that could download files, but saw no logs showing they were used.

My IT provider runs our backups. What should I ask?

Ask whether they use AhsayCBS, which hotfix is installed and when, whether they checked for the artifacts Huntress listed, and whether they changed stored credentials.

The bigger lesson

A patch closes the door. It does not search the house. Any server exposed to the internet during a period of active attacks needs a check for leftovers after patching, and backup servers deserve that check first, because they hold the keys to everything else.

For help reviewing your servers and backups, see security hardening or request a quote.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: Huntress: Inside an AhsayCBS Intrusion; Huntress: Threat Actors Exploit Critical AhsayCBS Flaws; Ahsay: CVE-2026-105133 and CVE-2026-105134 patch update.