Hackers Exploit Critical AhsayCBS Flaws to Deploy Webshells and XMRig Miners

Hackers are exploiting two flaws in AhsayCBS backup servers to run commands, plant webshells, and install XMRig cryptocurrency miners disguised as Microsoft Edge.

Huntress first observed exploitation on October 7, 2026, at 23:20:15 UTC. By October 8, its researchers had seen five organizations targeted, with attackers checking systems and setting up tools to maintain access.

The campaign targets Ahsay Cloud Backup Server, a management platform used by managed service providers and system integrators. Administrators use it to manage backup users, policies, and operations. According to Huntress’s investigation, versions up to 10.3.4 are affected, including a release previously described as safe.

The attack chains CVE-2026-105133, a medium-severity authentication flaw in the checkSysPwd function, with CVE-2026-105134, a critical flaw in the Replication Receiver endpoint at /rps/api/json/UpdateReceivers.do.

Together, they let attackers bypass login checks and execute commands as NT AUTHORITY\SYSTEM, giving them broad control over the Windows host.

Hackers Exploit Critical AhsayCBS Flaws

The NVD entry for CVE-2026-105134, published October 4, lists a CVSS 4.0 score of 9.3 and describes remote command injection. It still identifies version 10.3.4 as a fix.

However, Huntress’s October 8 update says that the version remains vulnerable, making the conflicting guidance important for administrators assessing exposure.

After gaining access, attackers configured a malicious replication receiver and placed Java Server Page webshells inside the application’s web directory. Huntress also detected suspicious commands launched by cbssvcX64.exe, the AhsayCBS service executable.

This pattern resembles earlier z0Miner attacks against WebLogic servers, where attackers used JSP webshells to maintain access before deploying mining tools. That similarity describes a shared method, not evidence that the campaigns involve the same operators.

Attackers downloaded Taskgmr.ps1, edge.exe, msedge.exe, and config.json into temporary folders from an Alibaba Cloud Object Storage endpoint. The file edge.exe was XMRig, while msedge.exe was a modified copy of NSSM, a legitimate utility that keeps other programs running.

A newly created Windows service, MicrosoftEdgeUpdateSvc, ran the disguised NSSM binary with SYSTEM privileges. It kept the miner active and restarted it after crashes or reboots. The miner connected to xmr. kryptex[.]network and 51.195.127[.]124 on port 8029.

The use of webshells followed by Monero mining also appears in earlier Apache web server coinminer attacks, highlighting how exposed servers can become income sources for attackers.

The PowerShell script monitored Task Manager and stopped the mining service whenever users opened it. Mining resumed after Task Manager was closed.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

The script also closed Task Manager at 18:00 local time or after it stayed open overnight for over an hour. Huntress described its comments as suggesting AI assistance, not proving AI authorship.

In one incident, attackers downloaded WinRing0x64.sys, a legitimate but vulnerable driver, using certutil.exe. Huntress linked its use to improved mining performance through low-level hardware access, not to turning off security tools.

Organizations should restrict management access to trusted IP addresses or a VPN while awaiting a confirmed fix. Investigate suspected compromised hosts and rebuild them from trusted backups.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC