Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

Starting October 7, 2026, attackers exploited two critical vulnerabilities in AhsayCBS backup utility (CVE-2026-105133 and CVE-2026-105134) to perform unauthenticated remote code execution. They chained these flaws to bypass authentication and execute code with SYSTEM privileges. Post-exploitation, attackers deployed JSP webshells, installed XMRig cryptocurrency miners disguised as Microsoft Edge processes, and used an AI-assisted PowerShell script to hide mining activity by terminating Task Manager. Persistence was maintained via a fake Windows service named MicrosoftEdgeUpdateSvc. Additionally, a vulnerable kernel driver (WinRing0x64.sys) was exploited for kernel-level hardware access to optimize mining. All AhsayCBS versions through 10.3.4 are affected, with managed service providers primarily targeted.

• CVE-2026-105133: Ahsay AhsayCBS · Improper AuthenticationHighVulnerability2026-10-04
• CVE-2026-105133: Ahsay AhsayCBS · Improper AuthenticationMediumVulnerability2026-10-04
• CVE-2026-105134: Ahsay AhsayCBS · Command InjectionCriticalVulnerability2026-10-04
• CVE-2026-105134: Ahsay AhsayCBS · OS Command InjectionCriticalVulnerability2026-10-04
• Statistical Report on Malware Targeting Linux SSH Servers in the Third Quarter of 2026Malware2026-10-14