Extend the existing Ahsay hunt with MDR observations since ~Oct 7: look for new JSP under AhsayCBS web dirs; PowerShell child of the Java service downloading from captcha-eyw[.]pages[.]dev (challenges.ps1/install.ps1); unexpected .cmd in C:\Users\Public; OpenSSH freshly installed/configured via obfuscated PowerShell; account elevation to SYSTEM; outbound to 38.60.252[.]110, 13.143.164[.]15, 45.142.141[.]160, 74.208.22[.]238, 167.148.88[.]236. File names varied across incidents—prefer behavioral detections over single hashes. Window: from at least 2026-10-04.