Cybersecurity
Attackers exploit AhsayCBS flaws to deploy XMRig miners
Huntress said attackers chained two AhsayCBS vulnerabilities to gain remote code execution, drop web shells and XMRig miners, and affect five targeted organisations by 8 October 2026.
- Huntress said exploitation of AhsayCBS began on 7 October 2026 at 11:20 p.m. UTC.
- It said five targeted organisations were estimated to have been affected by 8 October 2026.
- The attackers chained CVE-2026-105133 and CVE-2026-105134 to bypass authentication and run commands on affected systems.
- Huntress said the post-compromise activity included reconnaissance, web shells, XMRig miners named edge.exe, and a PowerShell script called Taskgmr.ps1.
- The article said NVD advisories had listed version 10.3.4 as fixed, but Huntress later found that release affected, and it advised restricting management access to trusted IPs or VPN.
The article said two flaws in AhsayCBS could be chained to bypass authentication and run arbitrary commands on exposed systems. It said the CVE identifiers were published on 4 October 2026, and Huntress said exploitation started on 7 October at 11:20 p.m. UTC.
Huntress said the attackers carried out reconnaissance, dropped web shells and installed XMRig miners. The miners used the name edge.exe, which was meant to look like Microsoft Edge.
The article said the attackers also placed a PowerShell script called Taskgmr.ps1, which was launched through curl and used to support cryptomining. Huntress said the script included checks that watched for Windows Task Manager and stopped mining when it was opened.
In at least one incident, the attackers used certutil.exe to fetch WinRing0x64.sys into the TEMP folder. The article said the aim was likely to reach kernel-level access and improve the mining process, and Huntress advised limiting access to the management interface to trusted IP addresses or via VPN.
Named in this story
Companies
- Huntress
- the security company that said exploitation had begun and described the activity
Products and systems
- AhsayCBS
- the backup utility targeted by the chained flaws
- Microsoft Edge
- the browser the miner tried to imitate
- edge.exe
- the miner filename used to resemble Microsoft Edge
- Taskgmr.ps1
- the PowerShell script used to support cryptomining
- certutil.exe
- the built-in binary used to fetch a driver
- WinRing0x64.sys
- the driver downloaded into the TEMP folder
- Windows Task Manager app
- the app the script monitored and shut down
How the source tells it
The article used a largely neutral security-news register, with urgency coming from active exploitation details and concealment language.
- urgency the active exploitation timeline and the advice to restrict access
- stealth the miner filename and script behaviour were described as disguising activity and suppressing Task Manager