Cybersecurity
Attackers exploit AhsayCBS flaws to deploy webshells and miners
Huntress said attackers chained two unpatched AhsayCBS flaws on 7 October, reached at least five organisations, and then installed webshells and cryptocurrency-mining tools, according to its investigation.
- Huntress said the activity was observed on 7 October and affected at least five organisations.
- The flaws were identified as CVE-2026-105133 and CVE-2026-105134.
- Huntress said both issues were fixed in AhsayCBS 10.3.2, but that Ahsay 10.3.4 was also affected.
- After gaining access, the attacker carried out reconnaissance, installed JSP webshells and downloaded XMRig.
- BleepingComputer said it had contacted AhsayCBS for comment but had not received a reply by publication.
Huntress said attackers used two flaws in AhsayCBS, a backup management platform used by managed service providers and system integrators. The firm said the activity it saw on 7 October reached at least five organisations.
The bugs were tracked as CVE-2026-105133, an authentication-bypass issue with a public exploit, and CVE-2026-105134, which allowed command injection. Huntress said both were fixed in AhsayCBS 10.3.2, but that Ahsay 10.3.4 was also affected.
According to Huntress, the attacker chained the two issues, first bypassing authentication and then achieving code execution. It said the intruder then performed reconnaissance, installed JSP webshells and downloaded XMRig under the name edge.exe.
Huntress said the miner stayed on the host through a service called MicrosoftEdgeUpdateSvc, which ran msedge.exe. It identified that executable as a modified copy of the legitimate Non-Sucking Service Manager utility.
The company also said a PowerShell file called Taskgmr.ps1 appeared to hide mining by stopping the service when Task Manager opened and restarting it when it closed. In one case, Huntress said the attacker also deployed WinRing0x64.sys, which it believed was intended to give the miner more hardware resources.
Named in this story
Companies
- Huntress
- found the activity and described the attack chain
Products and systems
- AhsayCBS
- was the backup management platform targeted in the attacks
- CVE-2026-105133
- was the authentication-bypass flaw with a public exploit
- CVE-2026-105134
- was the command-injection flaw used for code execution
- Ahsay 10.3.4
- was the latest version Huntress said was also affected
- XMRig
- was the cryptocurrency miner downloaded by the attacker
- edge.exe
- was the filename used to disguise the miner
- MicrosoftEdgeUpdateSvc
- was the service used to keep the miner running
- msedge.exe
- was the executable identified as a modified copy of NSSM
- Non-Sucking Service Manager (NSSM)
- was the legitimate utility Huntress said had been modified
- Taskgmr.ps1
- was the PowerShell file Huntress believed hid the mining activity
- WinRing0x64.sys
- was the driver deployed in one case
How the source tells it
The article used a plain technical register and did not add emotive framing.
No emotive framing was found in the original.