Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 Implant

Between October 8 and 11, 2026, attackers exploited authentication bypass and remote code execution vulnerabilities in AhsayCBS backup management software to compromise multiple servers. The intrusion involved deploying multiple webshell families with capabilities such as command execution and encrypted payload loading. Attackers installed cryptocurrency miners, tunneling tools, and a custom Python implant communicating with command-and-control infrastructure. They created Microsoft Defender exclusions and accessed backup credentials, targeting backup infrastructure to potentially access hypervisor and domain account credentials. The attack demonstrated operational patience and sophistication beyond typical cryptomining campaigns.

• Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig CryptominerMalware2026-10-09
• Inside Phexia: A macOS malware delivered through ClickFixMalware2026-11-05
• False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking AppsMalware2026-10-28
• Infostealer VOLTA That Has AI Assess Stolen InformationMalware2026-11-09
• Canto incognito: tracking the PoeLLM malwareMalware2026-10-08