AhsayCBS Backup Servers Hacked for Stealthy Monero Mining
Malicious actors have systematically commenced exploiting twin vulnerabilities within AhsayCBS backup servers. Following successful infiltration, these assailants deploy insidious web shells alongside the XMRig cryptocurrency miner. Huntress cybersecurity analysts have definitively observed these targeted attacks impacting at least five distinct organizations. This security crisis is particularly alarming because the latest available iteration, AhsayCBS version 10.3.4, remains critically vulnerable, with no immediate official patch forthcoming.
Chaining Vulnerabilities for Maximum Access
To execute this breach, the attackers ingeniously chain two distinct software flaws. Initially, they leverage CVE-2026-105133 to completely bypass authentication protocols. Subsequently, they exploit CVE-2026-105134 to inject arbitrary operating system commands. Within a Windows environment, this lethal combination ultimately grants the remote attacker the ability to execute commands with NT AUTHORITY\SYSTEM privileges, representing the absolute apex of system access.
Following successful penetration, the hackers meticulously reconnoiter the compromised server. They then implant a persistent web shell, guaranteeing their ability to execute subsequent commands at will. The ensuing phase involves downloading the XMRig payload designed specifically for mining Monero. To evade rudimentary detection, the miner is deceptively masqueraded under the filename “edge.exe,” effectively camouflaging it among legitimate Microsoft Edge components.
Advanced Evasion and Persistence Tactics
The assailants further demonstrate their sophistication by creating a fraudulent service named “MicrosoftEdgeUpdateSvc.” This service executes a secondary file, “msedge.exe,” which Huntress identified as a maliciously modified clone of the legitimate NSSM (Non-Sucking Service Manager) utility. This elaborate architecture ensures the miner automatically initiates upon system startup and persistently maintains operations regardless of system reboots.
Furthermore, a specialized PowerShell script, designated “Taskgmr.ps1,” relentlessly monitors the Windows Task Manager. If a system administrator opens this diagnostic utility, the script instantaneously halts all mining operations. Once the administrator terminates the Task Manager, the cryptocurrency extraction stealthily resumes. During nocturnal hours, the script is programmed to forcefully terminate the Task Manager if it remains active for an extended duration. Huntress investigators theorize that the perpetrators may have utilized generative artificial intelligence to author this script, although this hypothesis currently relies solely upon the code’s distinct structural patterns and internal commentary.
In one extensively investigated instance, the hackers additionally downloaded the notoriously vulnerable WinRing0x64.sys driver. Analysts hypothesize that the attackers utilized this driver to unlock further hardware resources for the miner, thereby maximizing Monero extraction performance.
Mitigation Strategies for Unpatched Servers
Initially, security bulletins indicated these dual vulnerabilities afflicted AhsayCBS up to version 10.3.2, with the 10.3.4 release supposedly rectifying the flaws. However, rigorous secondary analysis radically altered this perspective: Huntress definitively confirmed that version 10.3.4 remains susceptible to this precise attack vector. As of October 10, the developer has failed to release a secure, patched version.
While awaiting an official update, administrators are strongly urged to immediately remove the AhsayCBS control panel from public internet exposure, strictly restricting access exclusively to trusted, whitelisted IP addresses. If a server is suspected of compromise, Huntress recommends an exhaustive forensic search for indicators of compromise. Should a breach be confirmed, the only reliable remediation is a complete system restoration from a pristine, isolated backup. Merely deleting the cryptocurrency miner is profoundly insufficient, as the sophisticated attackers likely established alternative, clandestine pathways to regain server access.
AhsayCBS is heavily utilized by managed IT service providers and systems integrators for the centralized administration of critical client backups. Consequently, a compromised server provides the attacker with a vastly more lucrative beachhead than a standard infected workstation. The system inherently manages backup configurations and possesses deep, privileged access directly into the infrastructure of numerous downstream clients.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
