Attackers are actively exploiting two unpatched security flaws in the AhsayCBS backup management platform to gain system access, install webshells, and run cryptocurrency mining operations. The platform serves managed service providers and system integrators, and the campaign struck at least five organizations beginning October 7.
The two vulnerabilities being leveraged are CVE-2026-105133, an authentication bypass with publicly available exploit code, and CVE-2026-105134, which permits arbitrary operating system command execution. Vendor documentation indicated both flaws were resolved in version 10.3.2, yet researchers at MDR firm Huntress discovered the issues persist in AhsayCBS 10.3.4, the current release.
After further investigation, Huntress has determined that Ahsay 10.3.4 is also affected by these vulnerabilities
Huntress
Attack Chain and Payload Deployment
Attackers sequenced the two flaws together, first using CVE-2026-105133 to circumvent authentication controls, then exploiting CVE-2026-105134 to execute code on the target system. Once inside, the threat actor performed network reconnaissance, dropped Java Server Page webshells, and retrieved the XMRig cryptocurrency miner disguised as edge.exe.
The miner achieved persistence through a Windows service named 'MicrosoftEdgeUpdateSvc' that executes msedge.exe, which Huntress identified as a modified variant of the Non-Sucking Service Manager (NSSM) utility. A PowerShell script named Taskgmr.ps1, which Huntress suspects was generated using AI assistance, conceals mining activity by halting the service whenever Task Manager launches and resuming operation once it closes.
The script implements additional evasion by terminating Task Manager at 6 p.m. local time or if the process remains open for longer than one hour overnight. In at least one incident, the attacker also deployed the vulnerable WinRing0x64.sys driver, presumably to unlock additional hardware resources for mining operations.
Mitigation and Detection Guidance
BleepingComputer reached out to AhsayCBS regarding remediation timelines but received no response prior to publication. Until patches become available, Huntress advises system administrators to limit AhsayCBS management interface access to whitelisted IP addresses and actively search for signs of unauthorized activity.
Should compromise be confirmed, administrators must perform a complete system restore from a verified clean backup, as attackers may have installed additional backdoors to maintain long-term access. Huntress has published indicators of compromise and four Sigma detection rules to assist security teams in identifying this activity.