Attackers exploited two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, in AhsayCBS to deliver a Python-based implant. The vulnerabilities allowed for authentication bypass and unauthenticated remote code execution, according to sources.
The attack was observed by Huntress between October 8 and October 11, 2026. The threat actor deployed multiple web shells and XMRig cryptocurrency miners on compromised systems, utilizing tunneling tools and remote access software to establish persistent access.
The Python backdoor was specifically designed to run only on the host it was staged on and prevent execution in a sandbox environment.
The attackers may have targeted servers holding or managing backups, as indicated by the presence of Veeam credential-theft module commands.
Ahsay Backup released patches for these vulnerabilities in mid-October 2026.