[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNP6duwE3eNlvaBJFPzAyFtM6vlYcXHtWlCopv1GRI5E":3},{"article":4,"iocs":54,"watch_terms":65,"solutions":66,"lesson":160},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"c0b39fa5-adec-4b29-b2bf-1472a570e33c","Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant","inside-an-ahsaycbs-intrusion-hidden-webshells-a-cryptominer-and-a-c2-implant-3c047d","Follow-up on AhsayCBS intrusion: new webshells, a second miner, and a host-bound Python implant found on exploited backup servers.","Following up on earlier AhsayCBS exploitation tied to CVE-2026-105133 and CVE-2026-105134, Huntress discovered a sophisticated intrusion involving five webshell families, two XMRig miners, tunneling tools, and a custom Python implant left on backup servers between October 8–11, 2026. The attacker demonstrated patience and persistence, planting shells across multiple locations and staging various tools despite the initial \"smash and grab\" pattern. Organizations that patched after exploitation remain at risk; artifacts left on disk must be actively hunted and removed, as patches do not automatically remediate already-compromised systems.","Huntress reveals extensive AhsayCBS intrusion with multiple webshells, cryptominers, and Python implant","https:\u002F\u002Fwww.huntress.com\u002Fblog\u002Fahsaycbs-webshells","https:\u002F\u002Fcdn.builder.io\u002Fapi\u002Fv1\u002Fimage\u002Fassets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F35f4213723784bf2b6a8eb95acb9ab15","2026-11-09T14:00:00+00:00","2026-11-09T15:00:26.275972+00:00",9,[17,20,23,25],{"name":18,"type":19},"Ahsay","vendor",{"name":21,"type":22},"AhsayCBS","product",{"name":24,"type":19},"Huntress",{"name":26,"type":27},"Python","technology","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":28,"icon":30,"name":31,"slug":32},null,"Breaches","breaches",[34,39,44,49],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":50},{"id":51,"icon":30,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62],{"type":56,"value":57,"context":58},"cve","CVE-2026-105133","AhsayCBS authentication bypass vulnerability",{"type":56,"value":60,"context":61},"CVE-2026-105134","AhsayCBS unauthenticated remote code execution via \u002Frps\u002Fapi\u002Fjson\u002FUpdateReceivers.do",{"type":43,"value":63,"context":64},"XMRig","Cryptocurrency miner disguised as Microsoft Edge process, found deployed twice in intrusion",[18,24,21],{"controls":67,"vendors":154},[68,97,126],{"slug":69,"name":70,"problem":71,"products":72},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":98,"name":99,"problem":100,"products":101},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":53,"name":127,"problem":128,"products":129},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[155],{"slug":156,"name":24,"logo_path":157,"roles":158},"huntress","\u002Fvendor-logos\u002Fhuntress.png",[159],"reported_by",{"slug":161,"title":162,"body":163,"framework_refs":164,"framework_notes":172},"ahsaycbs-backup-server-compromise-patching-alone-is-not-enough-after-exploitation","AhsayCBS Backup Server Compromise: Patching Alone Is Not Enough After Exploitation","Attackers exploited known vulnerabilities in AhsayCBS backup software to plant multiple webshells, cryptominers, tunneling tools, and a custom Python C2 implant across a four-day window. The critical failure was not just delayed patching, but the assumption that applying a patch after exploitation constitutes full remediation — it does not. Artifacts left on disk by the attacker persist through patching, leaving organizations silently compromised. This incident highlights that backup servers, often trusted and internet-facing, are high-value targets whose compromise can undermine an organization's entire recovery posture. Active threat hunting and forensic validation must follow any patch applied to a system that was exposed during a vulnerability window.",[165,166,167,168,169,170,171],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","CIS Control 17: Incident Response Management","MITRE ATT&CK T1505.003: Server Software Component: Web Shell","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":173,"NIST SP 800-53 SI-2: Flaw Remediation":174,"CIS Control 17: Incident Response Management":175,"OWASP A06:2021 Vulnerable and Outdated Components":176,"CIS Control 7: Continuous Vulnerability Management":177,"MITRE ATT&CK T1505.003: Server Software Component: Web Shell":178,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":179},"NIS2 mandates incident handling measures including detection and post-incident analysis; backup infrastructure is essential-service-adjacent, and the lack of active hunting after known exploitation violates the spirit of these obligations.","SI-2 requires organizations to remediate flaws within defined timeframes and verify remediation effectiveness — this directly addresses both the delayed patching and the false assumption that patching alone removed attacker-planted artifacts.","A mature incident response process would have mandated post-exploitation forensic sweeps after the initial CVE disclosure, catching the webshells, miners, and C2 implant left during the attacker's four-day dwell time.","AhsayCBS was running with unpatched, publicly disclosed vulnerabilities; OWASP A06 specifically calls for tracking and promptly updating components with known CVEs to prevent exactly this type of exploit.","The two AhsayCBS CVEs had patches available; a continuous vulnerability management programme with enforced remediation deadlines would have closed the attack surface before the October intrusion window opened.","Attackers deployed five distinct webshell families across multiple directories — explicit detection and hunting for this technique would have identified persistence before the cryptominer and C2 implant were activated.","A.8.8 requires timely identification and remediation of technical vulnerabilities in information systems, including post-remediation validation — both of which were absent, allowing the attacker's foothold to survive patching."]