Attackers Exploit AhsayCBS Backup Flaws to Install Cryptocurrency Miners

What is AhsayCBS and Who Uses It?

AhsayCBS is a backup management platform developed by Ahsay Systems. It is used by managed service providers (MSPs) and system integrators to manage backup policies, storage, and users for their clients. The software acts as a central hub for managing backups across many systems, making it a critical part of IT infrastructure for organisations that rely on it. Because of its central role, any security issue in AhsayCBS can have a wide impact, especially for companies that manage data for others.

The Vulnerabilities: CVE-2026-105133 and CVE-2026-105134

Two security flaws have been identified in AhsayCBS: CVE-2026-105133 and CVE-2026-105134. The first is an authentication bypass vulnerability in the checkSysPwd() function. This means attackers can trick the system into thinking they are authorised users. The second is an operating system command injection flaw in the Replication Receiver component. This allows attackers to run any command they want on the server. Chaining these two flaws lets attackers gain unauthorised access and then take full control of the affected system. Both vulnerabilities were publicly disclosed on 4 October 2026, and exploit code is available online. Although advisories suggested the issues were fixed in version 10.3.2, researchers found that even the latest version, 10.3.4, is still affected.SecurityWeek↗ (opens in a new tab) The Hacker News↗ (opens in a new tab) BleepingComputer↗ (opens in a new tab)

How the Attacks Unfolded

According to Huntress, a cybersecurity firm tracking the attacks, exploitation began on 7 October 2026. At least five organisations have been targeted so far. Attackers first use the authentication bypass to access the system, then exploit the command injection to run malicious code. After gaining access, they deploy webshells (malicious scripts that let them control the server remotely) and install XMRig cryptocurrency miners. These miners are disguised as Microsoft Edge by naming the process "edge.exe" and creating a fake Windows service called "MicrosoftEdgeUpdateSvc". The attackers also use a modified version of the Non-Sucking Service Manager (NSSM) utility to keep the miner running and hidden.

The attackers further use a PowerShell script, believed to be written with help from artificial intelligence tools, to monitor the Windows Task Manager. If Task Manager is opened, the script stops the mining activity to avoid detection. It can also terminate Task Manager if it stays open for too long overnight. In one case, the attackers downloaded a vulnerable driver (WinRing0x64.sys) to allow the miner to access hardware resources at a low level, making the mining more effective.

What Has Been Done and What Should Organisations Do?

As of now, there is no official patch available for these vulnerabilities. Huntress and other security researchers recommend restricting access to the AhsayCBS management interface. This means only allowing trusted IP addresses or requiring a VPN to access the system. Organisations should also check for signs of compromise, such as unexpected services, suspicious files like "edge.exe" or "Taskgmr.ps1", and any use of the WinRing0x64.sys driver. If a compromise is found, experts recommend restoring the affected system from a clean backup, as attackers may have installed additional backdoors. Huntress has published indicators of compromise and detection rules to help defenders spot these attacks.

Vendor and Industry Response

BleepingComputer reports that they have contacted AhsayCBS for comment, but have not received a response as of publication. The lack of a patch means that organisations must rely on network restrictions and monitoring to protect themselves for now. The National Vulnerability Database lists the flaws as fixed in version 10.3.2, but Huntress has shown that even newer versions are still vulnerable. This situation highlights the importance of independent verification and ongoing monitoring, even after a vendor claims an issue is fixed.

Practical Steps for Defenders

Security teams running AhsayCBS should immediately restrict access to the management interface, review logs for suspicious activity, and look for the specific indicators mentioned above. If compromise is suspected, a full restore from a known good backup is advised. Monitoring for unusual processes and services, especially those mimicking legitimate software, is crucial. Keeping up with updates from both the vendor and independent researchers is also important, as the situation may change quickly once a patch is released.