NetExec

Threat Actors Exploit AhsayCBS Zero-Days CVE-2026-105133 and CVE-2026-105134 to Deploy Sandbox-Evading Python Backdoor

Cybersecurity researchers at Huntress have detailed an October 2026 intrusion that chained two patched vulnerabilities in AhsayCBS to bypass authentication and execute arbitrary commands. The attackers deployed multiple JSP web shells, two variants of the XMRig cryptocurrency miner, tunneling tools, and a custom Python backdoor designed to evade sandboxes by verifying the host's MachineGuid hash. Patches for CVE-2026-105133 and CVE-2026-105134 were issued by Ahsay Backup in mid-October 2026 after the flaws were exploited as zero-days. The operation showed notable persistence on backup servers, including Microsoft Defender exclusions, scheduled tasks, and legitimate remote access software. Huntress also observed related activity on a Veeam server involving credential theft from the PostgreSQL database using NetExec and DPAPI decryption. The campaign targeted backup infrastructure specifically rather than conducting opportunistic smash-and-grab operations.