ThreatMon finds AhsayCBS webshells used to build SOCKS tunnels

ThreatMon has disclosed an exposed AhsayCBS workspace containing 1,357 files documenting webshell access. Of 189 AhsayCBS webshell probes, 134 yielded live command output and 55 failed. The majority of live responses came from Windows hosts, principally Server 2019, 2022 and 2016. ThreatMon withheld full webshell URLs and access tokens, saying publishing them would provide access material rather than useful context for defenders.

ThreatMon’s further analysis shows the attacker using two open-source tools, Chisel and GOST, to convert webshell access into SOCKS proxy tunnels routed through a shared VPS. GOST ran a SOCKS proxy on the victim’s local interface while Chisel connected to the operator’s VPS, establishing reverse tunnels that allowed traffic to be routed via the breached server.

The operation included dynamic port usage, with ports changing between deployments, and 141 distinct host identifiers showing positive proxy checks in the workspace. Geolocation covered 131 live webshell IPs across 27 countries, led by the UK (23), the Netherlands (17) and the US (16); Europe accounted for 87 addresses. No evidence of data theft or lateral movement was found, but the presence of SOCKS tunnels on a backup server forms a quiet ingress path.

Defenders are urged to apply CVE-2026-105133 and CVE-2026-105134 fixes, search for unknown JSP files, look for Chisel and GOST binaries, flag outbound connections to unfamiliar VPS hosts, monitor for new local SOCKS listeners and restrict internet exposure of backup management consoles.