Science & Tech · Cybersecurity · 10 hrs ago
Attackers exploit AhsayCBS flaws to install webshells and crypto miners
Attackers are exploiting two vulnerabilities in AhsayCBS, a backup management platform.
The affected systems are often managed by managed service providers and system integrators.
One flaw lets attackers bypass authentication, while the other allows them to run operating-system commands.
Together, the flaws have been used to install webshells, which can provide remote access, and software that mines cryptocurrency.
The vulnerabilities were reported as fixed in version 10.3.2, but researchers found they also affect version 10.3.4.
Attackers have also used tools to keep the mining software running and hide it from users.
Until a patch is available, administrators are advised to limit access to trusted IP addresses and check for signs of compromise.
Attackers are exploiting two vulnerabilities in the AhsayCBS backup management platform to gain unauthorized access and install webshells and cryptocurrency miners.
The vulnerabilities are an authentication bypass, CVE-2026-105133, and an OS command injection flaw, CVE-2026-105134.
Researchers found the flaws affect AhsayCBS 10.3.4, although they were reported as fixed in version 10.3.2.
Attackers install JSP webshells and the XMRig miner, disguised as edge.exe, and use a service to maintain persistence.
Administrators are advised to restrict access to the management interface to trusted IP addresses and investigate signs of compromise.
- Who
- Threat actors are exploiting the flaws. Administrators of AhsayCBS systems are advised to take protective steps.
- What
- Attackers are using two vulnerabilities to install webshells and cryptocurrency miners.
- When
- The attacks are ongoing, according to the article. A specific start date is not stated.
- Where
- AhsayCBS systems, typically those managed by managed service providers and system integrators.
- Why
- The attackers use the flaws to gain unauthorized access and deploy cryptocurrency miners.
This story does not have two clearly opposing sides.
No direct quotes in the coverage so far.
Attackers use OS command injection to deploy JSP webshells and the XMRig miner.
Attackers run a modified NSSM utility as a service named MicrosoftEdgeUpdateSvc.
Taskgmr.ps1 stops the service when Task Manager is opened and restarts it when it is closed.
- Vulnerability 1
- CVE-2026-105133, authentication bypass
- Vulnerability 2
- CVE-2026-105134, OS command injection
- Affected version
- AhsayCBS 10.3.4
- Miner
- XMRig, disguised as edge.exe
- Persistence service
- MicrosoftEdgeUpdateSvc
- Recommended action
- Restrict management-interface access to trusted IP addresses
Sources
Related news
Yandex services disrupted after Ukrainian drone strikes on Russian data centers
Dropbox launches data access governance tool in Singapore
US seizes two China-linked hacking tools used against critical infrastructure
Canadian cybersecurity executive arrested in U.S. hacking case
Anthropic offers free AI vulnerability scans to open-source projects
FBI arrests another suspect linked to ShinyHunters jobs-site breach
New characters let lookalike domains bypass some browser checks
Canadian cybersecurity negotiator arrested in ShinyHunters investigation
Hackers use Bing redirects in Google ads to promote fake Claude installers
Amazon Bedrock flaw exposed AI agent credentials and source code
Canadian cybersecurity executive arrested on extortion-related charges
