Unpatched AhsayCBS flaws exploited to deploy webshells and crypto miners

Threat actors are exploiting two unpatched vulnerabilities in the AhsayCBS backup management platform to install webshells and cryptocurrency-mining software, according to BleepingComputer.

The activity was observed on October 7 and targeted at least five organizations. AhsayCBS is typically used by managed service providers and system integrators. The flaws are tracked as CVE-2026-105133, an authentication bypass with a public exploit, and CVE-2026-105134, which can enable OS command injection.

Both vulnerabilities were reported as fixed in AhsayCBS 10.3.2. However, managed detection and response company Huntress said Ahsay 10.3.4, described as the latest version, is also affected. Huntress observed attackers chaining the flaws: first bypassing authentication, then executing code.

After gaining access, the attackers performed reconnaissance, installed Java Server Page (JSP) webshells and downloaded the XMRig miner disguised as edge.exe. The miner persists through a service named MicrosoftEdgeUpdateSvc, which runs msedge.exe. Huntress identified that executable as a modified copy of the Non-Sucking Service Manager (NSSM) utility.

A PowerShell file named Taskgmr.ps1, which Huntress believes may have been AI-assisted, conceals mining by stopping the service when Task Manager opens and restarting it when it closes. The script also terminates Task Manager at 6 p.m. local time or if it stays open for more than an hour overnight. In one case, the attacker deployed the vulnerable WinRing0x64.sys driver, likely to make more hardware resources available to the miner.

BleepingComputer said it had contacted AhsayCBS for comment but had not received a response by publication. Huntress provided indicators of compromise and four Sigma rules to help detect the activity.