Hackers exploit AhsayCBS flaws to mine Monero on business backup servers

AhsayCBS is a server-based backup management platform developed by Hong Kong-based Ahsay. Businesses, managed service providers and IT administrators use it to manage backups for devices and clients across virtual and physical servers, databases and various software environments. The tool is widely used by IT service providers to manage client data.

Huntress said the two flaws disclosed on October 4 were CVE-2026-105113 and CVE-2026-105134. The first is a medium-severity vulnerability affecting the checkSysPwd function that can lead to improper authentication. The second is a critical-severity flaw in the Replication Receiver component that could allow unauthenticated remote code execution as NT AUTHORITY/SYSTEM on the host.

The API contains an authentication bypass that could allow a random token to substitute valid credentials, the researchers explained. After exploitation, a threat actor configured a malicious receiver and dropped a Java Server Page webshell into the application directory served by the CBS application.

Three days later, threat actors began exploiting the bugs: the first to bypass authentication, and the second to gain code execution and deploy webshells on exposed systems. The webshells served primarily as droppers, deploying a range of stage-two executables.

Huntress also saw threat actors deploy XMRig, a legitimate open-source cryptominer that uses a computer's hardware, electricity and internet connection to mine Monero and deposit it to attackers' wallets. Monero is difficult to trace across the blockchain, making it a common choice for unsolicited mining.

The attackers hid XMRig on the backup servers by disguising it as a Microsoft Edge process and installing it as fake Edge update services. A script, apparently written by AI, shuts down the miner whenever Task Manager is opened, and the same script closes Task Manager after an hour.

Backups are widely treated as one of the strongest protections against ransomware, and cybersecurity organizations advise companies to deploy them and maintain them so they are not outdated or corrupted. Huntress said the fact that backup servers could be compromised with relative ease should be cause for alarm. Businesses hit in this campaign could consider themselves lucky to have received only an XMRig infection rather than a full-blown ransomware encryptor, the researchers said.

As of October 8, at least five organizations had been targeted, Huntress said. All versions of AhsayCBS through 10.3.4 are affected. The vulnerabilities used in the attack have since been mitigated, but because the attack is ongoing, organizations using the backup method are urged to apply the fixes immediately and secure their systems.

Huntress also advised restricting AhsayCBS management interface web access, because the exploit targets the externally accessible web app service on the host. Access should be limited to trusted IP addresses only or require a VPN, the researchers said. If any indicators of compromise listed in Huntress's blog are found, companies should carry out a full host re-image from a trusted backup, because attackers have been able to hide secondary backdoors for extended persistence.

Editor's Summary

Huntress researchers say hackers exploited two AhsayCBS vulnerabilities to compromise backup servers, deploy webshells and run disguised XMRig miners for Monero. At least five organizations were targeted by October 8, and organizations using affected versions through 10.3.4 are urged to patch, restrict management access and reimage compromised hosts.