Threat actors are exploiting a critical and a medium-severity vulnerability that remain unpatched in the backup management platform AhsayCBS to deploy webshells and cryptocurrency miners.
AhsayCBS is typically used by managed service providers (MSPs) and system integrators. The malicious activity was observed on October 7 and targeted at least five organizations.
The two security issues exploited in attacks are considered to be prosecuted CVE-2026-105133an authentication bypass vulnerability that can be exploited publicly, and CVE-2026-105134, this can be used for operating system command injection.
Both vulnerabilities are considered fixed in AhsayCBS 10.3.2, but researchers at managed detection and response company (MDR) Huntress have found that they also affect Ahsay 10.3.4, the current latest version.
“After further investigation, Huntress has determined that Ahsay 10.3.4 is also affected by these vulnerabilities,” Huntress said in an update today.
In the observed attacks, the threat actor chained two vulnerabilities, CVE-2026-105133, first for authentication bypassing and then CVE-2026-105134 for code execution.
After you gain access, Huntress observed The attacker performs reconnaissance, deploys Java Server Page (JSP) webshells, and downloads the XMRig miner disguised as edge.exe.
The miner remains on the host through a service called “MicrosoftEdgeUpdateSvc” that runs msedge.exe, which Huntress identifies as a modified copy of the legitimate Non-Sucking Service Manager (NSSM) utility.
A PowerShell file (Taskgmr.ps1), which Huntress believes to be an AI-powered script, hides mining activity by stopping the service when Task Manager is opened and restarting it when Task Manager is closed.
The script also terminates Task Manager at 6:00 p.m. local time or if it is left open for more than an hour overnight.
In one case, the attacker also deployed the vulnerable WinRing0x64.sys driver, likely in an attempt to unlock additional hardware resources for the miner.
BleepingComputer has reached out to AhsayCBS to ask about its plans to fix the two bugs, but we have not received a response at the time of publication.
Until a patch is available, Huntress recommends that system administrators limit access to the AhsayCBS management interface to only trusted IP addresses and investigate signs of compromise.
If a compromise is confirmed, administrators should perform a full restore of the host from a secure backup as the attacker may have installed additional backdoors for longer persistence.
Huntress has also provided Indicators of Compromise (IoCs) for this activity, as well as four sigma rules to help defenders identify it.
