Huntress reports AhsayCBS intrusion with webshells, miner and C2 implant

What happened

Huntress reports, in a blog post dated November 9, 2026, that it analyzed tooling recovered from three AhsayCBS servers in a single environment, which it says were breached between October 8 and October 11, 2026 (Huntress). Huntress says this is a follow-up to its October 8, 2026 report that threat actors were exploiting CVE-2026-105133 and CVE-2026-105134 in AhsayCBS, the management console for Ahsay’s backup software (Huntress).

Huntress describes CVE-2026-105133 as an authentication bypass and CVE-2026-105134 as unauthenticated remote code execution as SYSTEM through /rps/api/json/UpdateReceivers.do (Huntress).

Huntress says the operator left the following on the servers (Huntress):

• Five families of Jakarta Server Pages (JSP) webshells, including nsmind.jsp, described as a signed file-transfer API, and AhsayCBS.jsp, described as a loader that hides encrypted payloads in the pixel data of PNG images and runs them from memory.
• A second XMRig miner that restarts every minute through a SYSTEM scheduled task, using a wallet and mining pools that differ from those in Huntress’s first post.
• A Python implant that Huntress says appears to run only on the host it was staged on. It needs a marker file named after the SHA-256 of the machine’s MachineGuid, then runs an embedded x64 DLL in memory that contacts a command-and-control (C2) server.
• Tunneling tools, remote access software, broad Defender exclusions, and a command consistent with NetExec’s Veeam credential-theft module. Huntress says this suggests the operator may have targeted backup infrastructure in particular.

Huntress says it tied the activity to the AhsayCBS campaign because the webshells sat inside AhsayCBS’s own web directories, the access logs show an exploit source address listed in its first post, and one server held files matching that post’s indicators (Huntress).

Huntress says Ahsay has since released hotfixes, 10.3.4.45 for v10 and 9.15.2.70 for v7 through v9, and that it verified 10.3.4.45 blocks the entry point it saw. It also says hotfixes do not remove files an actor has already planted (Huntress).

Not confirmed: the identity of the affected organization, the identity of the operator, and what data, if any, was taken. The attribution and exploitation details come from Huntress alone. No Ahsay advisory or NVD record text was among the sources provided, so a severity score for the CVEs is not confirmed. The source text available was truncated, so the full indicator list is not reproduced here.

Am I affected?

Per Huntress, you may be affected if you run AhsayCBS and it was reachable and unpatched at or before the October 8 to 11, 2026 window it describes. Huntress says the hotfixes cover v10 (10.3.4.45) and v7 through v9 (9.15.2.70) (Huntress).

Patched servers may still carry leftovers. Huntress advises that if your AhsayCBS servers were exposed before patching, it is worth searching for the artifacts in its post (Huntress).

What to do now

1. Apply the Ahsay hotfix for your version: 10.3.4.45 for v10, or 9.15.2.70 for v7 through v9, as reported by Huntress (Huntress).
2. Search the AhsayCBS web directories for unexpected JSP files. Huntress names nsmind.jsp, AhsayCBS.jsp, files named status_ followed by six random letters, and a smaller variant named st_ followed by further characters.
3. Remember that one webshell family can delete itself after use, so Huntress notes that a missing file does not prove it was never present. Check AhsayCBS access logs for requests to /rps/api/json/UpdateReceivers.do as well.
4. Look for a SYSTEM scheduled task that restarts a miner every minute, broad Windows Defender exclusions, unfamiliar tunneling or remote access tools, and an unexpected Python implant with a marker file named after a SHA-256 hash.
5. Because Huntress suggests the operator may have targeted backup infrastructure, review credentials used by or stored on the backup servers. This is a precaution inferred from that suggestion, not a confirmed finding.
6. For the full indicator list and recovered file details, read the original Huntress post.

Sources

• Huntress: Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant
• NVD: CVE-2026-105133
• NVD: CVE-2026-105134