Hackers Exploit AhsayCBS Vulnerabilities to Hide Malware in PNG Images and Deploy Stealthy Backdoors

Hackers exploiting AhsayCBS backup servers have planted webshells, hidden encrypted code inside PNG images, and staged a Python implant designed to run only on its intended host.

The findings show an intrusion that extended beyond cryptocurrency mining, giving attackers several ways to keep access to systems responsible for protecting an organization’s backups.

The attack affected three AhsayCBS servers in one organization between October 8 and October 11, 2026, before vendor hotfixes became available.

Attackers exploited CVE-2026-105133, an authentication bypass, and CVE-2026-105134, which allowed unauthenticated remote code execution with SYSTEM privileges. The combination exposed both the backup platform and the sensitive access it could provide.

Researchers from Huntress identified five webshell families, a second cryptocurrency miner, and a host-bound Python implant during their investigation.

In a technical report published November 9, researcher Jonathan Semon described tooling that concealed commands, supported file transfers, and weakened endpoint protection.

However, the team could not confirm every payload’s behavior or establish whether attackers stole backup data.

Hackers Exploit AhsayCBS Vulnerabilities

The most distinctive webshell posed as an internal image-preview service. Instead of accepting obvious command parameters, it processed uploaded PNG files and extracted hidden information from their pixels.

This approach resembles earlier PNG malware concealment techniques reported in other campaigns, although Huntress did not attribute this intrusion to those operators.

The loader read the least-significant bit from each pixel’s red, green, and blue values, then assembled those bits into bytes. It reconstructed a four-byte payload length followed by encrypted content.

A hardcoded AES key unlocked the data using Java’s default AES transformation, which Huntress identified as ECB mode with PKCS5 padding.

On the first request, a custom Java class loader placed the decrypted class in memory and returned a cover image. Later requests passed data into that class and triggered execution.

Results were encrypted and embedded into another PNG, making the exchange look like image traffic rather than a conventional command session. The technique matters because the executable functionality arrives inside requests and runs in memory.

Related Earth Sirrush PNG campaigns demonstrate how image concealment also appears in espionage operations, but that similarity does not establish a connection. Huntress examined this loader, not its delivered class, so the commands executed through it remain unknown.

Another recovered webshell behaved like a remote administration API. It checked an API token, timestamp, nonce, and HMAC-SHA256 signature before accepting requests.

Behind those checks, attackers could execute commands, change directories, and transfer files in chunks, with support for files up to 4 GB. Huntress found no logs proving that its download function was used.

Host-Bound Backdoors, Backup Access, and Recovery

A separate Python implant introduced another concealment layer. Its wrapper combined Base64 encoding, LZMA compression, and a marshaled Python code object.

Before continuing, it calculated a SHA-256 value from the host’s MachineGuid and checked for a matching marker file. Without that file, the script exited, potentially preventing execution in an analyst’s sandbox.

If the marker existed, the code would copy a 673 KB blob into executable memory and start a thread. A reflective loader then mapped an embedded x64 DLL.

Static analysis revealed command-and-control information and strings consistent with DNS-over-HTTPS, but Huntress neither observed the implant running nor identified its malware family.

The attackers also deployed another XMRig miner with a SYSTEM-level scheduled task that checked every minute and restarted it when necessary.

Tunneling utilities, remote access software, and broad Microsoft Defender exclusions provided additional ways to operate while reducing security visibility across the compromised servers.

On a related Veeam server, investigators observed a command consistent with NetExec’s credential-theft module. It queried stored backup credentials and used DPAPI decryption.

Separate reporting on Veeam backup credential exposure explains why these environments are valuable targets, although that vulnerability was not identified as this intrusion’s entry point.

Ahsay released hotfix 10.3.4.45 for version 10 and 9.15.2.70 for versions 7 through 9. Huntress verified that the version 10 hotfix blocked the observed entry point.

Patching does not remove existing backdoors: exposed organizations should investigate suspicious server activity, unauthorized exclusions, and persistence mechanisms. Where compromise is found, Huntress recommends rebuilding from trusted backups and rotating reachable credentials.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Exploit AhsayCBS Vulnerabilities to Hide Malware in PNG Images and Deploy Stealthy Backdoors appeared first on Cyber Security News.