---
title: Hunt: AhsayCBS post-exploit from Bitdefender MDR (JSP webshells, Public\*.cmd, OpenSSH via obfuscated PowerShell) | ctxsec
url: https://ctxsec.com/items/hunt-ahsay-bitdefender-mdr
description: ""
status: "hunt idea (MDR)"
published: 2026-10-15
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-ahsay-bitdefender-mdr.md)

hunt idea (MDR)

2026-10-15

### Hunt: AhsayCBS post-exploit from Bitdefender MDR (JSP webshells, Public\*.cmd, OpenSSH via obfuscated PowerShell)

Extend the existing Ahsay hunt with MDR observations since ~Oct 7: look for new JSP under AhsayCBS web dirs; PowerShell child of the Java service downloading from `captcha-eyw[.]pages[.]dev` (`challenges.ps1`/`install.ps1`); unexpected `.cmd` in `C:\Users\Public`; OpenSSH freshly installed/configured via obfuscated PowerShell; account elevation to SYSTEM; outbound to 38.60.252[.]110, 13.143.164[.]15, 45.142.141[.]160, 74.208.22[.]238, 167.148.88[.]236. File names varied across incidents—prefer behavioral detections over single hashes. Window: from at least 2026-10-04.

Sources: [Bitdefender: AhsayCBS exploitation chain](https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134)