Between October 8 and 11, 2026, attackers exploited authentication bypass and remote code execution vulnerabilities in AhsayCBS backup management software to compromise multiple servers. The intrusion involved deploying multiple webshell families with capabilities such as command execution and encrypted payload loading. Attackers installed cryptocurrency miners, tunneling tools, and a custom Python implant communicating with command-and-control infrastructure. They created Microsoft Defender exclusions and accessed backup credentials, targeting backup infrastructure to potentially access hypervisor and domain account credentials. The attack demonstrated operational patience and sophistication beyond typical cryptomining campaigns.