Why this matters

On 2026-11-09 Huntress published a follow-up on exploitation of AhsayCBS, the management console for Ahsay backup software. Per Huntress, CVE-2026-105133 is an authentication bypass and CVE-2026-105134 is unauthenticated remote code execution as SYSTEM through /rps/api/json/UpdateReceivers.do. The intrusion it describes affected servers in one environment (Huntress reports the same miner file on two of them) between 2026-10-08 and 2026-10-11, before Ahsay released hotfixes (10.3.4.45 for v10, 9.15.2.70 for v7 through v9). Both CVEs are in CISA’s KEV catalog (added 2026-10-14), and NVD carries only CNA (VulDB) scores. Per Ahsay’s advisory (12 October 2026) the earlier patches, v9.15.2.59 and v10.3.4.0, did not fully address the flaws, so a host patched in early October may still be exposed. The hotfixes are distributed through the Ahsay partner portal and need a reboot after applying.

The point for hunters: patching closes the entry point but does not remove planted files. Huntress states this directly, and the tooling it recovered goes well beyond cryptomining. This playbook turns the post’s “what to check for” list into queries. The rules below are ours, untested starting points to tune against your own telemetry.

What was left behind

Per Huntress, the operator planted five JSP webshell families:

  • A keyed command shell (parameters p, c; wrong key returns a 404) and a variant with file-write parameters w and d.
  • status_<6 letters> shells, which take auth, cmd, del and rm parameters, and st_<6 letters> shells, which drop authentication and the delete function: they take c with no authentication, plus get=env and rm=1. Hunt on the parameters of each variant separately. These shells can delete themselves, so a missing file does not prove absence.
  • nsmind.jsp, an HMAC-signed API with exec, cd, upload and download actions.
  • AhsayCBS.jsp, which extracts an AES-encrypted payload from PNG pixel data and runs it in memory, so access logs look like image traffic.

Other artifacts: a SYSTEM scheduled task named kvm that runs every minute and restarts kvm-agent.exe (an XMRig miner) from C:\Windows\SysWOW64\kvm-agent; a Python implant under the SYSTEM profile launched from a Run key; broad Defender exclusions; gost and chisel tunneling tools staged on disk; and a command consistent with NetExec’s Veeam credential module on a related Veeam server. Huntress has not identified the implant family and did not observe what it does after check-in.

Hunt 1: new JSP files and shell spawns from the Ahsay service

Huntress names cbssvcX64.exe as the service process and says a parent-child pattern of it spawning a command shell is already covered by an earlier Huntress Sigma rule. Our version:

title: AhsayCBS Service Spawns Command Shell
id: 5d1e8a42-7b3c-4f90-a6e1-2c9b0d4f7a18
status: experimental
description: Untested starting point. Command shell child of the AhsayCBS service process
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\cbssvcX64.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
  condition: selection
falsepositives:
  - Ahsay maintenance scripts run by the service
level: high

For file creation, in Defender XDR:

DeviceFileEvents
| where Timestamp > ago(30d)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has_any (@"\webapps\cbs\", @"\webapps\rps\")
| where FileName endswith ".jsp"
| project Timestamp, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine

Our judgement: any .jsp written outside an Ahsay upgrade is suspect. Huntress also describes copies of the install outside the live path, not served by the web app, as a reliable tell: ahsay_* folders and opt, usr, home or srv directories at the drive root of a Windows host. (“Decoy” is our shorthand, not Huntress’s.) The DeviceFileEvents and DeviceProcessEvents queries need Microsoft Defender for Endpoint on the Ahsay host; many backup servers are unmanaged, so adapt them to your EDR or Sysmon data.

Hunt 2: the every-minute SYSTEM task and Defender exclusions

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create"
| where ProcessCommandLine has "tasklist" and ProcessCommandLine has_any ("/sc minute", "/mo 1")
| where ProcessCommandLine has_any ("SYSTEM", "/ru")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
DeviceProcessEvents
| where Timestamp > ago(30d)
| where ProcessCommandLine has_any ("Add-MpPreference", "Set-MpPreference")
| where ProcessCommandLine has "ExclusionPath" or ProcessCommandLine has "ExclusionProcess"
| where ProcessCommandLine has_any (@"C:\ProgramData", @"C:\Windows", "cbssvcX64")

Our assessment: a scheduled-task query will miss tasks created through COM or XML import, so also review the task list directly on exposed hosts.

Hunt 3: implant behaviors

Huntress lists two behaviors that survive file cleanup: python.exe or pythonw.exe running from a path under the SYSTEM profile (we match \config\systemprofile\ below, our reading of that wording), and public DNS-over-HTTPS resolver traffic from a non-browser process. The C2 it reports is hxxps://creepexplosiondarknight[.]com/d.

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("python.exe", "pythonw.exe")
| where FolderPath has @"\config\systemprofile\"
| project Timestamp, DeviceName, FolderPath, ProcessCommandLine, InitiatingProcessFileName

For the DoH check, join DeviceNetworkEvents on RemoteUrl containing your resolver list and exclude browsers; tune to your environment.

Response notes

If you find any of the above, Huntress recommends a full re-image from a trusted backup and rotating credentials stored on or reachable from the server, including those saved in AhsayCBS and in backup software on the same network. We did not verify that guidance independently. Given the Veeam credential query Huntress saw, our assessment is to treat any backup platform sharing credentials with a compromised Ahsay host as in scope.

Huntress did not see logs showing nsmind.jsp download in use and says it cannot tell what, if anything, was taken. Exploitation detail comes from the Huntress post alone. Both CVEs are in CISA KEV (added 2026-10-14) and the hotfixes are confirmed by Ahsay’s advisory (12 October 2026). NVD shows only CNA (VulDB) scores. We did not open the cve.org records or Huntress’s earlier post.

Sources