An active cyberattack campaign is leveraging two serious vulnerabilities in AhsayCBS backup servers to gain system-level access, install webshells, and deploy Monero miners disguised as Microsoft Edge. The flaws enable attackers to bypass authentication and execute commands as the NT AUTHORITY\SYSTEM user, giving full control over affected Windows machines.
The situation came to light when security researchers documented initial exploitation on October 7, 2026 at around 23:20 UTC. By the next day, five separate organizations had been targeted. Threat actors were seen probing server configurations and deploying tools designed for persistent control. The affected product is Ahsay Cloud Backup Server, used by managed service providers and system integrators to oversee backups, users, policies, and server operations. Systems running version 10.3.4 (and earlier) are vulnerable, including installations that were previously believed to be safe.
What the Flaws Are
Two specific bugs are in play: CVE-2026-105133, a medium-severity authentication issue in the checkSysPwd function, and CVE-2026-105134, a critical remote command injection vulnerability in the Replication Receiver endpoint at /rps/api/json/UpdateReceivers.do. When chained, these flaws let attackers log in without credentials and execute arbitrary code as SYSTEM. The National Vulnerability Database assigned CVE-2026-105134 a CVSS 4.0 score of 9.3; the advisory lists version 10.3.4 as a fixed release—but real-world evidence indicates the vulnerability still exists even with that version installed, leaving admins in a precarious position.
Attack Chain: Webshells, Miners, and Persistence
After gaining SYSTEM access, attackers install a malicious replication receiver, drop Java Server Page webshells into the application’s web directory, and run suspicious back-end commands via the service executable cbssvcX64.exe. These steps closely mirror known “JSP webshell then miner” attacks seen in other campaigns.
The mining setup involves several components: a PowerShell script (Taskgmr.ps1), disguised binaries (edge.exe for XMRig, and msedge.exe, a modified NSSM utility used to maintain mining across restarts), and a vulnerable driver (WinRing0x64.sys) for better hardware performance. A Windows service named MicrosoftEdgeUpdateSvc runs the modified NSSM under SYSTEM privileges to ensure the miner remains active. The miner reaches out to xmr.kryptex[.]network and IP 51.195.127[.]124 on port 8029. The script even watches for Task Manager launches—if opened, mining stops, then resumes once it’s closed.
What Organizations Need to Do
In light of the patch status being ambiguous—even for version 10.3.4—organizations are urged to limit access to AhsayCBS management interfaces via trusted IPs or VPNs immediately. Suspected compromised hosts should be rebuilt from clean backups, with full threat investigations. Proactive logging and monitoring are essential to detect webshells, unusual persistence services, or the use of shadow-utils like modified NSSM or certutil dropping drivers.
This incident highlights how backup management tools, when vulnerable, can become gateways for deep compromise—including cryptocurrency mining operations and long-term persistence. As AhsayCBS users await confirmation of a definitive fix, attackers exploiting such flaws underscore the need for constant vigilance in patching and securing management endpoints.
