thehackernews.com
Nov 10, 2026
Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
AI-summarised brief · reviewed before publication
Cybersecurity researchers revealed that attackers exploited two newly patched AhsayCBS vulnerabilities (CVE‑2026‑105133 and CVE‑2026‑105134) to deploy a Python backdoor on backup servers. The operation, observed by Huntress in October 2026, involved a chain that bypassed authentication, installed web shells, and ran two XMRig cryptocurrency miners. The custom implant, “main.py,” evaded sandbox analysis by checking the host’s MachineGuid hash and launched an embedded DLL to contact a C2 server. The attackers also configured Defender exclusions and used tunneling tools for persistence.
💡 Why It Matters
- · The breach shows attackers targeting backup infrastructure, a critical asset that can expose vast credential stores.
- · It underscores the need for hardened backup systems and vigilant monitoring of privileged access.
