Hackers Exploit Critical AhsayCBS Flaws to Deploy Webshells and XMRig Miners

What happened?

Hackers are exploiting two flaws in AhsayCBS backup servers to run commands, plant webshells, and install XMRig cryptocurrency miners disguised as Microsoft Edge. Huntress first observed exploitation on October 7, 2026, at 23:20:15 UTC. By October 8, its researchers had seen five organizations targeted, with attackers checking systems and setting up tools to maintain access. The campaign targets Ahsay Cloud Backup Server, a management platform used by managed service providers and system integrators. Administrators use it to manage backup users, policies, and operations.

Key details

• Attackers chain two AhsayCBS flaws to bypass authentication and run commands as SYSTEM.
• Huntress observed active exploitation starting October 7, 2026, hitting five organizations by the next day.
• AhsayCBS versions up to 10.3.4 are vulnerable, including a release previously labeled as safe.
• Attackers deploy JSP webshells and create a malicious replication receiver to maintain access.
• XMRig miner is disguised as msedge.exe and kept running via a fake MicrosoftEdgeUpdateSvc service.
• PowerShell script Taskgmr.ps1 hides mining when Task Manager opens and closes it at 18:00 or after overnight use.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.