Estimated reading time: 7 minutes
Attackers broke into three AhsayCBS backup servers before a fix existed. They read the backup user database and held domain administrator credentials, Huntress told CINI. Nobody noticed for at least nine days. Patching closes the door, Huntress says. It doesn’t remove what is already inside.
Backups are the recovery plan. Insurers ask about them for that reason. A new Huntress investigation shows what happens when the backup servers themselves are the target.
Huntress examined three AhsayCBS servers in a single environment. AhsayCBS is the management console for Ahsay’s backup software. Attackers exploited two flaws in it between Oct. 8 and Oct. 11. That was before Ahsay released its hotfixes, Huntress says.
Jonathan Semon, principal SOC analyst at Huntress, wrote the research. “Targeting backups is a well-documented step in ransomware intrusions because it removes the victim’s recovery option,” he told CINI. Huntress sells managed detection and response, largely to managed service providers (MSPs) and smaller businesses.
What The Intruder Left On The Backup Servers
Huntress first reported the attacks in October. Those early cases were quick: a webshell, then a cryptocurrency miner. This intrusion showed more patience, Semon writes.
The operator planted five families of webshells. One hid encrypted code inside the pixels of PNG images. Its traffic looked like ordinary image requests. Another worked like a small remote administration service. It could move files of up to 4 GB off the server in small chunks.
The servers also held two miners, tunneling tools, and three remote access programs. A custom implant was built to run only on the machine it was staged on. It contacted a command-and-control server.
The operator also added broad Microsoft Defender exclusions. Those covered system folders and the backup service itself. They cut Defender’s ability to scan those locations, Semon writes. MITRE now tracks that kind of interference as its own attack tactic, CINI reported.
Nine To 12 Days Before Anyone Noticed
The first server was exploited on Oct. 8 and the last on Oct. 11, Semon told CINI. Huntress agents went into the environment on Oct. 20.
“Our detections started firing almost immediately, with the operator tooling still active,” he said. “That works out to roughly 9 to 12 days of access before detection, though we had no visibility earlier.”
“It was found because Huntress was installed,” Semon said. That is a vendor describing its own product. It also raises a plain question for any company. Is anything watching the backup server?
The Defender exclusions might not have raised an alarm on their own. Defender Antivirus records exclusion changes in its logs. To Huntress’s knowledge, it doesn’t raise an alert by default, Semon said. Tamper protection only blocks changes to exclusions managed through Microsoft’s Intune service. Exclusions added locally or through Group Policy “generally aren’t covered,” he said.
An EDR tool with tampering detections would likely flag the change, Semon said. He couldn’t be certain here. The exclusions were already in place when Huntress arrived.
Backup Data Treated As Potentially Exposed
CINI asked whether the operator used the file-transfer webshell to take backup data.
“We didn’t see evidence that the download function was being used, but we can’t rule it out,” Semon said. This was a post-compromise review. Huntress had only the logs that survived.
Those logs showed “the backup user database being read and backup storage being searched,” he said. “We treat backup data and the credentials of backup users on those servers as potentially exposed.”
That gap between “not seen” and “ruled out” matters after an incident. Decisions about notifying customers and regulators often rest on what the logs can prove.
Domain Admin Credentials And The Ransomware Question
On a related Veeam server, Huntress saw a command consistent with a known credential-theft tool. It queried Veeam’s database for stored credentials. Backup software holds logins for hypervisors, storage, and domain accounts.
Huntress can’t say how many credentials were pulled or whether the operator used them. But there is a further finding. “Secondary investigation did find the operator holding domain administrator credentials, so credential use in the environment is likely,” Semon told CINI.
Huntress found no ransomware. “We have not seen ransomware deployed in the data we have, and we can’t say what this operator intended,” Semon said.
CINI asked whether the miners were the goal or a cover. “I want to answer ‘yes,'” Semon said. “But the truth is, I can’t say.”
Miners are cheap and may have been “a quick way to monetize access,” he said. The rest of the toolkit “goes well beyond what mining needs, suggesting the operator wanted durable access.” Huntress has not attributed the activity to a named actor.
One Backup Server, Many Clients
Semon declined to identify the organization, citing privacy. He would not say how many clients it served. He did describe how the product is used.
“AhsayCBS is built mainly for MSPs and backup providers,” he said. “One server can manage backups for many separate client accounts, so a single compromised server can touch many downstream organizations.”
For insurers, that is accumulation risk. One provider’s breach can reach many policyholders at once. Insurers cannot yet see that kind of aggregation, Nudge Security’s Russell Spitler told CINI.
Huntress can only count servers running its agent. Since early October, its detections tied to this activity have flagged 17 endpoints across 15 organizations, Semon said. Huntress doesn’t treat any as confirmed without verification. It can’t say how many exposed servers remain unpatched.
Get The Cyber Insurance News Upload Delivered
Subscribe to our weekly newsletter!
Why A Patch Doesn’t Close The Claim
These servers were attacked before a complete fix existed. Ahsay released complete fixes on Oct. 12, according to a Bitdefender advisory CINI covered last month. No patch deadline can cover the days before a fix exists.
Patching afterward doesn’t undo the break-in either. “Patching closes the entry point. It does not clean up what already happened,” Semon writes. Some webshells could delete themselves after use. A clean-looking disk doesn’t prove the server was never breached, he notes.
For any confirmed compromise, Huntress recommends a full re-image from a trusted backup. It also recommends rotating every credential stored on or reachable from the server.
Recovery plans rarely assume the backup system is the casualty. Cohesity found recoveries already take twice as long as planned. Travelers’ Matthew Butler told the CINI podcast to keep one backup copy offline, offsite, or immutable. This case shows why.
Cyber Insurance News Podcast
The Ransom Bot Answers At 3 A.M. – Ransomware crews now use AI chatbots in negotiations, Travelers’ Matthew Butler says. The bots take away the hours a victim needs to check backups.
Read the story | Watch on YouTube | Listen on Spotify | Apple Podcasts | Amazon Music
FAQ – Backup Servers
What happened to the AhsayCBS backup servers?
Attackers exploited two flaws in three AhsayCBS backup servers between Oct. 8 and Oct. 11, 2026, before hotfixes existed, Huntress found.
How long were attackers inside the backup servers?
Roughly 9 to 12 days before detection, Huntress told CINI. Its agents were deployed on Oct. 20.
Was backup data stolen?
Huntress saw no evidence of downloads but can’t rule it out. Logs showed the backup user database being read, so it treats the data as potentially exposed.
Does patching remove the attackers?
No. Patching closes the entry point. It doesn’t remove files already planted. Huntress recommends a full re-image and credential rotation after a compromise.
Was this a ransomware attack?
Huntress saw no ransomware deployed. It notes that targeting backups is a well-documented step in ransomware intrusions.
Why do backup servers matter for cyber insurance?
Backups drive recovery time and business interruption losses. AhsayCBS is built mainly for MSPs, so one server can touch many client organizations.
Related Cyber Insurance Posts
- FortiBleed Targeted At Least 13,000 Fortinet Devices, Lumen Tells CINI
- No Deductible – Huntress And Acrisure Make Moves in Cyber Insurance(Opens in a new browser tab)
- Silent Push 6.0 Gives Cyber Underwriters Sharper Threat Intelligence(Opens in a new browser tab)
- Executive Exposure Starts At Home. A Family Password Can Lead To The Company, 360 Privacy Says.(Opens in a new browser tab)
- AI Wrote This Ransomware Crew’s Tools. Stolen Passwords Got It In.(Opens in a new browser tab)