Summary
- Huntress observed exploitation of two AhsayCBS vulnerabilities beginning on 7 October.
- Attackers deployed webshells, disguised cryptocurrency miners, and Task Manager-aware scripts.
- Huntress corrected its assessment and now includes AhsayCBS 10.3.4 among affected versions.
Attackers are exploiting vulnerabilities in AhsayCBS backup management software to gain control of servers and install cryptocurrency miners, according to an investigation by Huntress. The attacks threaten a part of business infrastructure that is normally relied upon to restore operations after an incident.
Huntress observed exploitation beginning at approximately 23:20 UTC on 7 October 2026. By 8 October, its researchers had observed five targeted organisations. The investigation documents reconnaissance, the creation of webshells, and the deployment of mining software disguised as Microsoft Edge components. Those observations do not demonstrate that data held for every downstream customer of the affected backup servers was accessed.
AhsayCBS provides central management for backup services, including deployments used by managed service providers. The software can administer policies and backup operations for multiple client environments, making a vulnerable management interface a potentially sensitive point of entry. The immediate consequences documented by Huntress were on the attacked servers; broader client compromise remains a risk rather than an established fact.
The intrusion chain involved CVE-2026-105133 and CVE-2026-105134. Huntress says attackers combined an authentication weakness with a flaw in replication receiver functionality to execute commands on affected Windows hosts with SYSTEM privileges. In some cases, a malicious replication receiver was used to place a JavaServer Pages webshell where the application could reach it.
That access allowed further commands to be launched after the initial entry. The researchers observed downloads to temporary locations followed by the installation of an XMRig miner under names such as edge.exe and msedge.exe. Another component made the malware persist as a Windows service styled MicrosoftEdgeUpdateSvc, creating a superficial resemblance to a legitimate software updater.
The resemblance was intended to conceal an unauthorised cryptocurrency mining process, not to update the browser. A modified service-management utility restarted the process after interruption, while a separate PowerShell script monitored Windows Task Manager. Huntress reported that opening Task Manager would stop the mining service, with the service restarting when the monitoring application was closed.
The script also contained logic to terminate Task Manager after extended periods. Huntress considered its code apparently AI-assisted, based on stylistic features and comments. That assessment is not proof that a particular AI tool was used, nor does it establish that autonomous software selected victims or operated the campaign.
In one observed case, an attacker downloaded a vulnerable WinRing0 kernel driver. The researchers linked it to hardware access useful for mining. The presence of that driver should not be taken as evidence of other, unobserved tactics in these incidents.
The version information changed as the investigation developed. Huntress initially worked from public information indicating that AhsayCBS 10.3.4 was not affected, but its update explicitly corrected that position and included version 10.3.4 among vulnerable releases. Consequently, relying solely on an earlier assessment of a comparatively recent version could leave administrators with an inaccurate picture of exposure.
Huntress advised operators to restrict access to the management interface to trusted IP addresses or via a VPN while remediation is pending, examine affected systems for indicators of compromise, and rebuild machines from trusted sources if malware is found. Its published detection guidance covers unusual child processes, misleading Edge service names, monitoring-tool-aware behaviour, and suspicious driver downloads.
The attacker’s observed objective was to consume computing resources for cryptocurrency mining. Nevertheless, command execution under a privileged backup service can also threaten the integrity and availability of recovery operations. That wider exposure follows from the permissions available to the compromised host, not from a verified report of customer backup destruction.
The five organisations identified in Huntress telemetry are not a census of all exposed installations. The investigation establishes early exploitation and specific malicious behaviour, while the scope of any wider campaign and the number of downstream customers affected remain unknown.
