Hackers Exploit AhsayCBS Vulnerabilities to Hide Malware in PNG Images and Deploy Stealthy Backdoors

Attackers exploited two vulnerabilities in AhsayCBS backup software to plant webshells and a Python-based backdoor on three servers, all before the vendor had released hotfixes. The attackers used steganography—hiding encrypted malicious code inside PNG image pixel data—and sandbox-evasion techniques to maintain persistence while avoiding detection. This incident highlights the acute danger of zero-day or pre-patch exploitation windows in internet-facing infrastructure, particularly backup systems that often hold privileged access to sensitive data. The fact that three servers were compromised before remediation underscores the need for compensating controls when patches are unavailable.