Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant.

The activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two vulnerabilities were released by Ahsay Backup in mid-October 2026.

The two vulnerabilities are assessed to have been weaponized as zero-days, with the managed security platform first observing threat actors employing a smash-and-grab approach to deploy web shells and XMRig cryptocurrency miners on compromised systems.

"However, this incident reflects a much larger intrusion with more patience; the operator planted shells in several places, ran two different miners, staged tunneling tools, and installed a custom implant, all on servers whose job is to hold backups," Huntress researcher Jonathan Semon said.

Specifically, the unknown threat actor is said to have left five families of Jakarta Server Pages (JSP, formerly JavaServer Pages) web shells -

"[AhsayCBS.jsp's] disguise as an internal image preview service even extended down to a comment block describing a watermark endpoint," Huntress explained. "The web shell used only JSP implicit objects and fully qualified class names, meaning it would compile on any servlet container and on Java Development Kit (JDK) 6 and later."

exe") that restarts every minute through a SYSTEM scheduled task, while using a different wallet and mining pool.

Source link