Do Son 
Regional breakdown of the geolocated webshell IP addresses | Image: ThreatMon
TL;DR
ThreatMon recovered an exposed attacker workspace with 1,357 files that track AhsayCBS webshell access. Of 189 webshell probes, 134 got live responses. The operator’s tools then tried to turn that access into SOCKS proxy tunnels routed through a shared VPS.
What happened
AhsayCBS is a backup management platform that many managed service providers use. In October 2026, researchers reported CVE-2026-105133 and CVE-2026-105134. Together, the flaws can lead to remote code execution and JSP webshell deployment.
Huntress documented attacks starting October 7 and published hotfix guidance. Bitdefender also described exploitation. However, ThreatMon stresses that those reports “do not establish that the operator in our recovered dataset was responsible.”
Checking the webshells
One results file held 189 AhsayCBS webshell checks. Of those, 134 returned live command output, while 55 failed. Most live responses came from Windows hosts, led by Server 2019, 2022, and 2016.
ThreatMon withheld the full webshell URLs and access tokens. It says publishing them “would provide access material rather than useful context for defenders.”
From shell to proxy
Next, a shared framework took over. First, it confirmed that a webshell or exploit could run commands. Then it identified the operating system and pulled down two open-source tools, Chisel and GOST.
GOST ran a SOCKS proxy on the victim’s local interface. Meanwhile, Chisel connected out to the operator’s VPS and set up a reverse tunnel. As a result, the operator could route traffic through the victim server. A final check confirmed whether the route worked.
ThreatMon notes that the ports changed between deployments. So static port matching alone “will therefore miss part of the activity.”
Trying to keep the access
One script aimed to keep a chosen webshell while removing others. It could also prepare a hotfix. However, all 134 records ran in dry-run mode. ThreatMon found no proof that any systems were patched or that rival webshells were deleted.
Who is behind it
ThreatMon does not name the operator. It recovered an SSH key comment that it calls only an “attribution lead.” The firm also does not tie this workspace to the attacks reported by Huntress or Bitdefender.
More than one target
The workspace held code for other recent flaws too. Targets included Frappe, Nextcloud, WordPress The Grid, Cisco Catalyst SD-WAN, GitLab, Joomla YOOtheme Pro, and the OpenHands SDK. The evidence varies widely. For example, 2,218 Cisco SD-WAN hosts were probed, but none was marked as a real hit. Similarly, every Nextcloud backdoor transfer failed. OpenHands produced four new hosts with positive proxy checks.
Impact and scale
The operator’s result files report positive proxy checks for 141 distinct host identifiers. ThreatMon cautions that these “are records recovered from the workspace, not independently confirmed victim counts.”
In one detailed sample, 36 of 45 deployment records reported a working proxy across 24 hosts. Command output showed Windows SYSTEM and Linux root access. In addition, the Chisel server log held 936 reverse-mapping messages. ThreatMon says these do not equal 936 unique tunnels.
Geolocation covered 131 of the live webshell IPs across 27 countries. The UK led with 23, followed by the Netherlands with 17 and the US with 16. Europe accounted for 87 of the addresses.
Notably, ThreatMon found no evidence of data theft or lateral movement across the operation. Still, SOCKS proxy tunnels on a backup server give attackers a quiet route into a network. They can also hide the operator’s real location behind the victim’s own address.
How to stay protected
Defenders should consider these steps:
- Apply AhsayCBS fixes for CVE-2026-105133 and CVE-2026-105134 right away.
- Search AhsayCBS web folders for unknown JSP files.
- Hunt for Chisel and GOST binaries or processes on servers.
- Flag outbound connections from backup servers to unfamiliar VPS hosts.
- Watch for new local SOCKS listeners, and avoid relying on fixed port numbers.
- Restrict internet exposure of backup management consoles.
In short, AhsayCBS webshell access can become a hidden network exit within minutes. MSPs should treat any exposed backup server as a priority to review.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
