Ahsay's patched flaws still dropped miners October 7

Two vulnerabilities in the AhsayCBS backup platform that the vendor lists as fixed in version 10.3.2 are still present in 10.3.4, the current release, and attackers are using them to drop crypto miners. The malicious activity was observed on October 7.

Huntress, the MDR firm tracking the activity, says at least five organizations have been hit. AhsayCBS is mostly run by managed service providers and system integrators, so each compromised host can sit in front of a lot of downstream customers.

The two flaws are CVE-2026-105133, an authentication bypass with a public exploit, and CVE-2026-105134, an OS command injection. The attacker chains them in order: the auth bypass gets past the login, then the command injection runs code. Both were reported fixed in 10.3.2, but Huntress says that after further investigation it determined 10.3.4 is also affected, so applying the latest update does not close the hole.

After getting in, the attacker runs reconnaissance, plants JSP webshells for access, and downloads an XMRig miner as edge.exe. The miner runs as a service called MicrosoftEdgeUpdateSvc, whose binary msedge.exe is a renamed, modified copy of NSSM, the Non-Sucking Service Manager.

A PowerShell script, Taskgmr.ps1, that Huntress believes was written with AI help, watches for Task Manager. When Task Manager opens it stops the mining service so the CPU load disappears, and when Task Manager closes it restarts the miner. It also kills Task Manager at 6 p.m. local time, or if someone leaves it open for more than an hour overnight. The logic targets an admin who glances at process load to check whether a box is behaving.

In one case the attacker also dropped WinRing0x64.sys, a driver with a known vulnerability, likely to get lower-level hardware access for the miner.

For anyone running AhsayCBS, there is no patch, and updating to 10.3.4 does not help. Huntress’s interim advice is to restrict the management interface to trusted IP addresses and look for signs of compromise. The auth bypass has public exploit code, so treat an internet-exposed interface as already probed.

If you confirm a compromise, Huntress recommends restoring the host from a known-good backup rather than cleaning it in place, because the webshells and possible additional backdoors make selective removal unreliable. Huntress has published indicators of compromise and four Sigma rules for detection.

BleepingComputer asked AhsayCBS about its fix plans and had no answer by publication.