Critical AhsayCBS Flaws Let Attackers Deploy Webshells, XMRig Miners

Key Takeaways

• Attackers are actively exploiting two critical vulnerabilities in AhsayCBS backup servers.
• The flaws allow for remote command execution, webshell deployment, and the installation of XMRig cryptocurrency miners.
• Managed Service Providers (MSPs) and System Integrators using Ahsay Cloud Backup Server are primarily affected.
• Versions of AhsayCBS up to 10.3.4 are vulnerable, despite earlier vendor guidance suggesting otherwise for 10.3.4.
• A confirmed fix is still pending, necessitating immediate mitigation strategies for affected organizations.

Cybercriminals are actively leveraging two significant vulnerabilities within AhsayCBS backup server software to compromise systems. These exploits enable attackers to execute arbitrary commands, establish persistent webshells, and deploy XMRig cryptocurrency miners, often disguised as legitimate Microsoft Edge processes.

Initial Observations and Scope of Attack

Security firm Huntress first detected active exploitation of these flaws on October 7, 2026, at 23:20:15 UTC. Within 24 hours, by October 8, their researchers had identified five distinct organizations targeted in this campaign. The attackers’ initial actions involved reconnaissance of the compromised systems and setting up tools to maintain unauthorized access.

The campaign specifically targets Ahsay Cloud Backup Server, a crucial management platform widely utilized by Managed Service Providers (MSPs) and System Integrators. This platform is central to administering backup users, policies, and various operational tasks. According to Huntress’s investigation, all versions of AhsayCBS up to and including 10.3.4 are susceptible to these attacks, contradicting earlier information that had labeled version 10.3.4 as secure.

The Vulnerabilities: CVE-2026-105133 and CVE-2026-105134

The attack chain exploits two distinct vulnerabilities: CVE-2026-105133 and CVE-2026-105134. CVE-2026-105133 is an authentication bypass flaw of medium severity found within the checkSysPwd function. This is then chained with CVE-2026-105134, a critical vulnerability residing in the Replication Receiver endpoint, specifically at /rps/api/json/UpdateReceivers.do.

When combined, these vulnerabilities allow malicious actors to circumvent login procedures and execute commands with NT AUTHORITYSYSTEM privileges. This level of access grants them extensive control over the compromised Windows host.

The National Vulnerability Database (NVD) entry for CVE-2026-105134, published on October 4, assigns a critical CVSS 4.0 score of 9.3, explicitly detailing a remote command injection vulnerability. Crucially, the NVD entry still incorrectly identifies version 10.3.4 as containing a fix. However, Huntress’s update on October 8 clearly states that version 10.3.4 remains vulnerable, creating conflicting guidance that administrators must carefully consider when assessing their exposure.

Post-Exploitation Tactics: Webshells and XMRig Miners

Upon successful exploitation, attackers configure a malicious replication receiver and deploy Java Server Page (JSP) webshells directly into the application’s web directory for persistent access. Huntress also observed suspicious commands originating from cbssvcX64.exe, the legitimate AhsayCBS service executable, indicating its misuse by the attackers.

This attack methodology, involving JSP webshells followed by the deployment of mining tools, bears a resemblance to earlier z0Miner campaigns targeting WebLogic servers. While the operational pattern is similar, this does not conclusively link the current campaign to the same threat actors.

Attackers download several files from an Alibaba Cloud Object Storage endpoint into temporary directories. These include Taskgmr.ps1, edge.exe, msedge.exe, and config.json. The file edge.exe is identified as the XMRig cryptocurrency miner, while msedge.exe is a modified version of NSSM (Non-Sucking Service Manager), a legitimate utility designed to run applications as Windows services. The NSSM binary is disguised to appear as Microsoft Edge.

A new Windows service named “MicrosoftEdgeUpdateSvc” is then created to execute the camouflaged NSSM binary with SYSTEM privileges. This service ensures the XMRig miner remains active and automatically restarts it in case of crashes or system reboots. The miner subsequently connects to xmr.kryptex[.]network and 51.195.127[.]124 on port 8029 to participate in Monero mining. This tactic of deploying webshells followed by cryptocurrency miners is a common strategy observed in attacks against exposed web servers, turning them into illicit revenue streams.

The PowerShell script, Taskgmr.ps1, is designed to evade detection. It actively monitors for the opening of Task Manager and promptly halts the mining service when the utility is active. Mining operations resume once Task Manager is closed. The script also includes logic to close Task Manager at 18:00 local time or if it has been open for more than an hour overnight. Huntress noted comments within the script that suggest possible AI assistance in its creation, though this is not definitive proof of AI authorship.

In one incident, attackers utilized certutil.exe to download WinRing0x64.sys, a legitimate but vulnerable driver. Huntress concluded that the driver’s deployment aimed at enhancing mining performance through low-level hardware access, rather than disabling security tools.

What You Should Do

• Restrict Access: Immediately limit administrative access to AhsayCBS servers to only trusted IP addresses, preferably via a Virtual Private Network (VPN).
• Verify Patch Status: Do not rely solely on the NVD entry for CVE-2026-105134. Assume AhsayCBS versions up to 10.3.4 are vulnerable. Contact Ahsay support for definitive patching guidance.
• Hunt for Indicators of Compromise (IoCs): Scan your systems for the presence of the identified malicious files and network connections:
  • Payload hosting domain: imagefiles-backup.oss-ap-southeast-7.aliyunc[.]com
  • Mining pool: xmr.kryptex[.]network:8029
  • Mining pool IP: 51.195.127[.]124:8029
  • Windows service: MicrosoftEdgeUpdateSvc
  • PowerShell script: %TEMP%Taskgmr.ps1 (SHA-256: 481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21)
  • Miner artifact: %TEMP%edge.exe (SHA-256: 4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d)
  • Persistence artifact: %TEMP%msedge.exe (SHA-256: 05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034)
  • Driver artifact: %TEMP%WinRing0x64.sys
• Incident Response: If a compromise is suspected or confirmed, isolate the affected hosts immediately. Rebuild compromised systems from trusted backups to ensure complete removal of malicious components.
• Enhance Monitoring: Implement enhanced logging and monitoring for suspicious process execution, new service creation, and outbound network connections from your AhsayCBS servers.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.