SZB-c72e5c6368
ThreatMon reports AhsayCBS webshell access used for proxy tunnels on 141 hosts
- Status
- Unverified: only social posts report this so far
- Kind
- Breach
- Vendor
- Ahsay
- Product
- AhsayCBS
- First seen
Summary
Per ThreatMon, an exposed workspace's logs show AhsayCBS webshell access was used to set up SOCKS proxy tunnels with Chisel and GOST across 141 hosts. The item is a social media teaser linking to a securityonline.info write-up, and it does not give further detail.
If you use Ahsay
Check whether AhsayCBS is deployed in your environment and identify internet-exposed instances
Review AhsayCBS logs for webshell files, unexpected processes, and connections involving Chisel or GOST
Restrict management interfaces to trusted networks and apply any vendor patches or guidance once available
What the sources say 1
· Mastodon: “An exposed workspace shows AhsayCBS webshell access turned into SOCKS proxy tunnels with Chisel and GOST across 141 hosts, per the logs.” Source