Hackers began to hack AhsayCBS backup servers through two vulnerabilities, and after penetration, put webhells and miner XMRig. Huntress specialists saw attacks on at least five organizations. The problem is especially dangerous because AhsayCBS 10.3.4, the latest available version, and the finished fix is not yet under attack.
To hack, the attackers combine two errors. CVE-2026-105133 allows you to bypass authentication, after which CVE-2026-105134 makes it possible to implement the operating system command. In Windows, an attacker can eventually remotely execute commands with NT AUTHORITY\SYSTEM rights, that is, with almost maximum privileges.
After penetration, hackers first study the server, then leave a webhell through which commands can run again. The next step on the machine is loaded by XMRig for mining Monero. The miner gets the name edge.exe to get lost among the files reminiscent of Microsoft Edge components.
Attackers also create a MicrosoftEdgeUpdateSvc service. Through it, the msedge.exe file is launched, inside of which Huntress discovered an altered copy of the legitimate NSSM utility. This scheme allows you to automatically start the miner and save its operation after the system is restarted.
A separate PowerShell script called Taskgmr.ps1 follows Task Manager. When the administrator opens the system utility, the script stops mining, and after its closure launches the mining of cryptocurrencies again. At night, the code is able to close the Task Manager if it remains open for too long. Huntress admits that when writing the script, the attackers used generative AI, but so far such a version is based only on the structure and comments in the code.
In one of the investigated cases, hackers additionally downloaded a vulnerable driver WinRing0x64.sys. Specialists suggest that with its help the attackers tried to open the miner more hardware resources and increase the productivity of Monero production.
At first, two vulnerabilities were thought to affect AhsayCBS to version 10.3.2 inclusive, and the 10.3.4 release fixes the problem. Additional check changed the picture: Huntress found that version 10.3.4 also allows such an attack. As of October 10, the safe version of the developer has not released.
While there is no update, administrators are advised to remove the AhsayCBS control panel from the open Internet and allow access only from trusted IP addresses. If the server could already get under attack, Huntress recommends looking for signs of compromise, and when confirmed hacking, completely restore the system from a clean backup. One miner removal is not enough: attackers could leave other ways to return to the server.
AhsayCBS use managed IT service providers and system integrators to centrally manage backups. Therefore, the captured server gives the attacker a much more valuable point of support than a conventional infected computer: backup settings and access to the client infrastructure pass through the system.
To hack, the attackers combine two errors. CVE-2026-105133 allows you to bypass authentication, after which CVE-2026-105134 makes it possible to implement the operating system command. In Windows, an attacker can eventually remotely execute commands with NT AUTHORITY\SYSTEM rights, that is, with almost maximum privileges.
After penetration, hackers first study the server, then leave a webhell through which commands can run again. The next step on the machine is loaded by XMRig for mining Monero. The miner gets the name edge.exe to get lost among the files reminiscent of Microsoft Edge components.
Attackers also create a MicrosoftEdgeUpdateSvc service. Through it, the msedge.exe file is launched, inside of which Huntress discovered an altered copy of the legitimate NSSM utility. This scheme allows you to automatically start the miner and save its operation after the system is restarted.
A separate PowerShell script called Taskgmr.ps1 follows Task Manager. When the administrator opens the system utility, the script stops mining, and after its closure launches the mining of cryptocurrencies again. At night, the code is able to close the Task Manager if it remains open for too long. Huntress admits that when writing the script, the attackers used generative AI, but so far such a version is based only on the structure and comments in the code.
In one of the investigated cases, hackers additionally downloaded a vulnerable driver WinRing0x64.sys. Specialists suggest that with its help the attackers tried to open the miner more hardware resources and increase the productivity of Monero production.
At first, two vulnerabilities were thought to affect AhsayCBS to version 10.3.2 inclusive, and the 10.3.4 release fixes the problem. Additional check changed the picture: Huntress found that version 10.3.4 also allows such an attack. As of October 10, the safe version of the developer has not released.
While there is no update, administrators are advised to remove the AhsayCBS control panel from the open Internet and allow access only from trusted IP addresses. If the server could already get under attack, Huntress recommends looking for signs of compromise, and when confirmed hacking, completely restore the system from a clean backup. One miner removal is not enough: attackers could leave other ways to return to the server.
AhsayCBS use managed IT service providers and system integrators to centrally manage backups. Therefore, the captured server gives the attacker a much more valuable point of support than a conventional infected computer: backup settings and access to the client infrastructure pass through the system.
