{
  "id": 19356245,
  "title": "Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor",
  "url": "https://urgent.news/2026/11/10/attackers-exploit-ahsaycbs-flaws-to-deploy-sandbox-evading-python",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-10T16:00:55.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/11/attackers-exploit-ahsaycbs-flaws-to.html"
  },
  "original_language": "en",
  "account": "In October 2026, cybersecurity researchers uncovered a sophisticated attack that exploited two vulnerabilities in AhsayCBS, an online backup service. The vulnerabilities, CVE-2026-105133 and CVE-2026-105134, were patched by Ahsay Backup mid-month, but the threat actors weaponized them as zero-days. Huntress, a managed security platform, observed the threat actors deploying web shells and cryptocurrency miners on compromised backup servers. The attackers left five families of Jakarta Server Pages (JSP) web shells, one of which disguised itself as an internal image preview service. The Python backdoor, named main.py, was designed to evade detection by running only on the infected host and preventing execution in sandbox environments. The backdoor computed the SHA-256 hash of the host's MachineGuid to create a unique marker file, then executed an embedded x64 DLL in memory to establish a command-and-control (C2) connection. Additionally, the attackers set up Microsoft Defender exclusions and distributed tunneling tools and remote access software to maintain persistent access. Notably, the intrusion targeted backup servers, suggesting the threat actors were specifically interested in backup infrastructure. The intrusion was linked to a Veeam server, where the threat actors used PowerShell scripts to query the VeeamBackup PostgreSQL database for stored credentials, potentially retrieving sensitive information. This incident highlights the importance of robust identity visibility and AI threat readiness to defend against increasingly sophisticated cyber threats.",
  "summary": "Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant. The activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}