Attackers exploit AhsayCBS flaws to mine cryptocurrency on backup servers

Attackers exploited vulnerabilities in Ahsay Cloud Backup Suite (AhsayCBS) to install cryptocurrency-mining malware on business backup servers, according to security researchers at Huntress. The malware included XMRig, an open-source miner used to mine Monero.

Huntress said two AhsayCBS flaws were publicly disclosed on October 4, 2026. CVE-2026-105113 affects the checkSysPwd function and can cause improper authentication. CVE-2026-105134 affects the Replication Receiver component and could allow unauthenticated remote code execution as NT AUTHORITY/SYSTEM.

Researchers said attackers began exploiting the flaws three days after disclosure. They used an authentication bypass to configure a malicious receiver, then placed a Java Server Page (JSP) webshell in the application directory. The webshells deployed additional executables, including XMRig. Attackers disguised the miner as a Microsoft Edge process and a fake Edge update service. A script reportedly shut it down when Task Manager opened and closed Task Manager after an hour.

As of October 8, at least five organizations had been targeted, Huntress said. The source reports that AhsayCBS versions through 10.3.4 are affected and that the vulnerabilities have been mitigated. Huntress advises users to apply the patch and restrict management-interface access to trusted IP addresses or require a VPN. It also recommends re-imaging affected hosts from a trusted backup if indicators of compromise are found.