Attackers exploiting AhsayCBS backup servers deployed five webshell families, persistent cryptocurrency miners, tunneling utilities, and a custom Python implant across three servers in one organization. Huntress’s follow-up investigation covers intrusions between October 8 and October 11, 2026, revealing a broader operation than the cryptomining activity initially reported. The findings underscore a remediation gap: installing security […]
Read the original article:
AhsayCBS Hackers Plant Multiple Webshells and Secret Crypto Miners That Survive Security Patching
