Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor

In October 2026, cybersecurity researchers uncovered a sophisticated attack that exploited two vulnerabilities in AhsayCBS, an online backup service. The vulnerabilities, CVE-2026-105133 and CVE-2026-105134, were patched by Ahsay Backup mid-month, but the threat actors weaponized them as zero-days. Huntress, a managed security platform, observed the threat actors deploying web shells and cryptocurrency miners on compromised backup servers.

The attackers left five families of Jakarta Server Pages (JSP) web shells, one of which disguised itself as an internal image preview service. The Python backdoor, named main.py, was designed to evade detection by running only on the infected host and preventing execution in sandbox environments. The backdoor computed the SHA-256 hash of the host's MachineGuid to create a unique marker file, then executed an embedded x64 DLL in memory to establish a command-and-control (C2) connection.

Additionally, the attackers set up Microsoft Defender exclusions and distributed tunneling tools and remote access software to maintain persistent access. Notably, the intrusion targeted backup servers, suggesting the threat actors were specifically interested in backup infrastructure. The intrusion was linked to a Veeam server, where the threat actors used PowerShell scripts to query the VeeamBackup PostgreSQL database for stored credentials, potentially retrieving sensitive information.

This incident highlights the importance of robust identity visibility and AI threat readiness to defend against increasingly sophisticated cyber threats.