CriticalCVE
Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto
BleepingComputer·Source published ·1 min read
What happened?
Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. [...]
Key details
- Threat actors are exploiting two unpatched AhsayCBS vulnerabilities to install webshells and cryptocurrency miners.
- The flaws include CVE-2026-105133, an authentication bypass with a public exploit, and CVE-2026-105134 for OS command injection.
- Both issues were patched in AhsayCBS 10.3.2, but the latest 10.3.4 release remains vulnerable.
- Attackers first bypass authentication via CVE-2026-105133, then execute code using CVE-2026-105134 in a chained manner.
- After gaining access, the group deployed JSP webshells and downloaded the XMRig miner disguised as edge.exe.
- The miner persists through a service called MicrosoftEdgeUpdateSvc running a modified NSSM‑based msedge.exe binary.
What to look for
- Deployment of JSP webshells and XMRig miner disguised as edge.exe.
- Persistence via MicrosoftEdgeUpdateSvc service running modified msedge.exe (NSSM).
- Installation of vulnerable WinRing0x64.sys driver to access hardware resources for the miner.
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.