Attackers got into AhsayCBS backup servers before a fix existed, then planted hidden tools and a custom backdoor. Businesses using it should act now.
Attackers broke into company backup servers by using two security flaws in AhsayCBS, a backup management program, and left behind hidden access tools and a custom backdoor. Security firm Huntress saw the attacks in early October 2026. Ahsay released fixes in mid-October. Researchers believe the flaws were used as zero-days, meaning attackers exploited them before any fix was available.
The two flaws are tracked as CVE-2026-105133 and CVE-2026-105134. Used together, they let an attacker skip the login step and run commands on the server. At first, Huntress saw a smash-and-grab pattern: web shells (small files that give an attacker remote control through a web page) and cryptocurrency miners, which use a computer's power to earn coins for someone else.
Huntress says the intrusion was far larger and more patient. The operator planted web shells in several places and ran two different miners. One miner posed as Microsoft Edge. The other, called kvm-agent.exe, restarted every minute through a scheduled task. The attacker also set up tunneling tools and installed a custom implant, all on servers whose job is to hold backups.
The custom backdoor is a Python program called main.py. It is built to run only on the machine it was placed on, so it will not work inside a security researcher's test environment. If it runs, it loads code in memory and contacts a remote control server. On a nearby Veeam backup server, Huntress also saw a command consistent with stealing stored credentials. Huntress cannot say how many were taken.
The risk falls on businesses and IT providers running AhsayCBS, and on anyone with a Veeam backup server in the same environment. Backup software often stores logins for other systems, so a break-in can open doors well beyond the backups. Huntress said the pairing of the two suggested the attacker was after backup infrastructure on purpose. Organizations that do not use AhsayCBS are not in the path of this attack as described.
Patching is the first move, but it does not remove anything already planted. The alert above lists the updates, the signs to look for and the passwords to change.
Still unknown is who is behind the attacks and how many organizations were hit. Huntress also does not know how many Veeam credentials were taken. Teams running either product should treat any server that was exposed in October as possibly compromised until they have checked it.
If you run AhsayCBS, install the October 2026 updates and check the server for planted tools, since patching alone will not remove them.
Fingerprint launched Fraud Score, which learns from a business's own confirmed fraud cases and, in one customer test, caught nearly 50% more fraud.
Read more: Fingerprint's new fraud tool learns from each business's own casesSPH Media, a Singapore publisher, was hit by a cyber-attack days after hackers got into Singapore Airlines flight bookings. Details are still thin.
Read more: Singapore publisher SPH Media hit by cyber-attack days after airline breachTrump Media sells a service that shows Trump's posts to paying customers first, and it may now be a big part of the company's income. Here is why investors should care.
Read more: Trump Media earns big money selling early access to Trump's posts
