Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor

Cybersecurity researchers at Huntress have revealed a sophisticated attack targeting AhsayCBS backup software, exploiting two previously unknown vulnerabilities to deploy a stealthy Python-based backdoor. This attack is significant as it demonstrates how threat actors can infiltrate backup systems, which are critical for data recovery and business continuity, thereby posing a substantial risk to organizations relying on these systems.

The attack, observed in early October 2026, utilized a chain of vulnerabilities, CVE-2026-105133 and CVE-2026-105134, which have since been patched by Ahsay Backup. These flaws allowed attackers to bypass authentication and execute arbitrary commands on affected systems. Huntress noted that the attackers initially used a smash-and-grab approach to deploy web shells and cryptocurrency miners on compromised systems, but later expanded their intrusion tactics.

The attackers employed five families of Jakarta Server Pages (JSP) web shells, disguised as legitimate services, to maintain access. These web shells were crafted to compile on any servlet container using Java Development Kit 6 and later. The attackers' use of XMRig miners, including one masquerading as Microsoft Edge, and another that restarts every minute via a SYSTEM scheduled task, indicates a focus on persistent and stealthy operations.

A key element of the attack was the deployment of a Python backdoor, designed to evade detection by running only on the intended host. This backdoor computes the SHA-256 hash of the host's MachineGuid and checks for a specific marker file before executing an embedded DLL that contacts a command-and-control server. Such tactics are aimed at avoiding analysis in sandbox environments and evading security tools.

The attackers also targeted backup infrastructure, as evidenced by activities on a related Veeam server. They reportedly used a PowerShell script to query the VeeamBackup PostgreSQL database for stored credentials, suggesting a deliberate effort to compromise backup environments. Ahsay Backup has responded by releasing version 10.3.6.1, which includes security hardening updates, and has urged users to apply these fixes to protect their systems.

Ahsay revealed that it began receiving reports of unauthorized access to AhsayCBS servers on October 9, 2026, leading to the release of hotfixes shortly after. Indicators of compromise have been shared with customers to help identify affected systems. If malicious activity is detected, Ahsay advises reinstalling the operating system, updating to the latest version of AhsayCBS, and restoring from a backup prior to the compromise.

Backup systems are a prime target for attackers because they often contain sensitive data and access credentials for other critical systems. Exploiting vulnerabilities in such systems can allow attackers to gain a foothold in an organization’s network, potentially leading to data theft or ransomware attacks.