AhsayCBS Flaws Exploited for Webshells, Crypto Mining

Threat actors are exploiting two unpatched vulnerabilities in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. The vulnerabilities, tracked as CVE-2026-105133 and CVE-2026-105134, allow authentication bypass and OS command injection. Attacks were observed on at least five organizations, with the threat actors chaining the vulnerabilities to gain access, perform reconnaissance, and deploy the XMRig miner. The miner persists via a modified service, and an AI-assisted script conceals mining activity by manipulating Task Manager. Huntress recommends restricting access to the management interface and investigating signs of compromise.