Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor

Threat actors exploited two zero-day vulnerabilities, CVE-2026-105133 and CVE-2026-105134, in AhsayCBS to gain unauthorized access and execute arbitrary commands on backup servers. The attackers deployed multiple JSP web shells, cryptocurrency miners, and a custom Python-based backdoor designed to evade sandbox analysis by checking the host's MachineGuid and presence of a marker file. The backdoor loads an in-memory x64 DLL that communicates with a C2 server, while the attackers also deployed tunneling tools and remote access software to maintain persistence and potentially harvest credentials from backup systems, including Veeam servers.

AI-extracted · verify before operational use