Attackers are exploiting two AhsayCBS security flaws to compromise backup management servers, install webshells and run cryptocurrency miners. Researchers observed the activity on October 7, with at least five organisations targeted.
Although vulnerability records list both issues as fixed in version 10.3.2, Huntress found that they also affect version 10.3.4. That was the latest release at the time of its October 9 update.
The findings leave administrators facing active attacks without a confirmed fix in the reported current release.
Attackers Combine Authentication Bypass With Command Injection
AhsayCBS is a backup management platform commonly used by managed service providers and system integrators.
The attacks combine CVE-2026-105133, an authentication bypass vulnerability, with CVE-2026-105134, an operating system command injection flaw. The two issues carry critical and medium severity ratings, respectively.
A public exploit already exists for the authentication bypass. In the observed incidents, attackers used that weakness first to get past authentication.
They then exploited the command injection vulnerability to execute code on the affected server. Together, the AhsayCBS security flaws provided a route from unauthenticated access to malicious activity on the host.
Webshells Provide Access While XMRig Mines Cryptocurrency
After gaining access, the attacker examined the compromised systems and installed Java Server Page webshells. These malicious files provide a way to issue commands remotely.
Huntress also observed the attacker downloading the XMRig cryptocurrency miner under the filename edge.exe.
To maintain the mining operation, the attacker created a service called MicrosoftEdgeUpdateSvc. Despite its legitimate-looking name, the service supported the malicious deployment.
It ran msedge.exe, which researchers identified as a modified copy of the legitimate Non-Sucking Service Manager utility. The attacker therefore used familiar software names to disguise components of the mining setup.
PowerShell Script Hides Mining From Task Manager
The operation also included a PowerShell script named Taskgmr.ps1. Huntress believes the attacker may have used AI assistance to create it, although that assessment remains unconfirmed.
The script stops the mining service whenever Task Manager opens. Once Task Manager closes, it restarts the service.
As a result, someone inspecting resource usage could miss the miner’s activity while the monitoring window remains open.
In addition, the script closes Task Manager at 6 p.m. local time. It also terminates the application if it stays open for more than an hour overnight.
In one incident, the attacker deployed the vulnerable WinRing0x64.sys driver. Researchers believe this likely aimed to give the miner access to additional hardware resources.
Researchers Recommend Restricting Management Access
Because Huntress found version 10.3.4 vulnerable, administrators cannot rely on the earlier fix information alone when assessing exposure.
The researchers recommend limiting access to the AhsayCBS management interface to trusted IP addresses. They also advise checking affected hosts for evidence of compromise.
If investigators confirm an intrusion, Huntress recommends fully restoring the host from a safe backup. Removing the visible miner alone may leave other attacker-installed backdoors in place.
To support investigations, the company has published indicators of compromise and four Sigma detection rules. These resources can help defenders identify activity associated with the observed attacks.
0 responses to “AhsayCBS Security Flaws Exploited to Install Crypto Miners”