Ethical Hacking News
A highly sophisticated Python-based backdoor has been deployed on systems by exploiting two vulnerabilities in AhsayCBS. The backdoor is designed to evade sandbox detection and has been found to have several features that make it highly sophisticated. The incident highlights the importance of keeping software up to date and patching vulnerabilities as soon as they are identified.
The AhsayCBS managed security platform was exploited by hackers to deploy a highly sophisticated Python-based backdoor. The two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, were identified by Huntress in October 2026 and allowed the attackers to bypass authentication and execute arbitrary commands. The backdoor was designed to evade sandbox detection and was found to have several features that make it highly sophisticated, including Microsoft Defender exclusions and tunneling tools. The attackers targeted servers holding or managing backups, using a smash-and-grab approach and planting shells in several places. The vulnerability was patched by Ahsay Backup in mid-October 2026, but the attackers were able to exploit the zero-day vulnerabilities to deploy the backdoor. The incident highlights the importance of keeping software up to date and patching vulnerabilities as soon as they are identified.
The security landscape has recently witnessed a concerning development, as hackers have successfully exploited two vulnerabilities in AhsayCBS, a managed security platform, to deploy a highly sophisticated Python-based backdoor. The backdoor, which is designed to evade sandbox detection, has been found to be highly sophisticated and has left security researchers scrambling to understand its inner workings.
The two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, were identified by Huntress, a cybersecurity firm, in October 2026. These vulnerabilities were found to have been weaponized as zero-days, allowing the attackers to bypass authentication and execute arbitrary commands on affected systems. The attackers, who were observed by Huntress in October 2026, used a chain of exploits to deploy the backdoor, which involved exploiting the CVE-2026-105133 vulnerability to bypass authentication and then using the CVE-2026-105134 vulnerability to execute arbitrary commands.
The backdoor, which is designed to run only on the host it is staged on and prevent it from executing within a sandbox or an analyst's machine, achieves this by computing the SHA-256 cryptographic hash of the host's MachineGuid and looking for a marker file with the same name in the same directory housing the Python implant. If the marker file is found, the backdoor runs an embedded x64 DLL in memory that contacts a command-and-control (C2) server. The C2 server is believed to be operated by the attackers, who use it to receive instructions and transmit stolen data.
The backdoor has been found to be highly sophisticated, with features such as the ability to configure Microsoft Defender exclusions, serve tunneling tools, and establish persistent access using legitimate remote access software such as AnyDesk, Atera, and Splashtop. The attackers have also been found to have planted shells in several places, run multiple miners, staged tunneling tools, and installed custom implants on servers that hold or manage backups.
The attack, which was carried out by an unknown threat actor, is believed to have targeted servers holding or managing backups. The attackers used a smash-and-grab approach to deploy web shells and XMRig cryptocurrency miners on compromised systems, but the incident reflects a much larger intrusion with more patience. The operator planted shells in several places, ran multiple miners, staged tunneling tools, and installed a custom implant, all on servers whose job is to hold backups.
The vulnerability was patched by Ahsay Backup in mid-October 2026, but the attackers were able to exploit the zero-day vulnerabilities to deploy the backdoor. The incident highlights the importance of keeping software up to date and patching vulnerabilities as soon as they are identified.
In an interview, Jonathan Semon, a Huntress researcher, stated, "The activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems." Semon also stated that the threat actor may have targeted servers holding or managing backups, and that the pairing of an Ahsay foothold with a Veeam credential query suggested the operator was interested in backup infrastructure on purpose, not by accident.
The incident highlights the importance of cybersecurity and the need for organizations to stay vigilant and keep their software up to date. It also highlights the sophistication and creativity of modern cyberattacks, which can have serious consequences for organizations and individuals.
A highly sophisticated Python-based backdoor has been deployed on systems by exploiting two vulnerabilities in AhsayCBS. The backdoor is designed to evade sandbox detection and has been found to have several features that make it highly sophisticated. The incident highlights the importance of keeping software up to date and patching vulnerabilities as soon as they are identified.
Related Information:
https://www.ethicalhackingnews.com/articles/AhsayCBS-Flaws-Exploited-to-Deploy-Highly-Sophisticated-Sandbox-Evading-Python-Backdoor-ehn.shtml
https://thehackernews.com/2026/11/attackers-exploit-ahsaycbs-flaws-to.html
Published: Tue Nov 10 11:26:34 2026 by llama3.2 3B Q4_K_M
