Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto

Attackers are actively abusing two unpatched flaws in the AhsayCBS backup management platform, used widely by MSPs and system integrators, to drop webshells and cryptomining malware. Huntress researchers detected the campaign on October 7, affecting at least five organizations, with intruders first exploiting the authentication-bypass bug CVE-2026-105133 (which already has a public exploit) and then chaining it with the OS command-injection flaw CVE-2026-105134 to gain code execution. Although the vendor listed both issues as resolved in version 10.3.2, Huntress confirmed that the current release, 10.3.4, remains vulnerable as well. Once inside, attackers installed JSP webshells and an XMRig miner disguised as edge.exe, maintained persistence through a fake Microsoft Edge update service, and used a likely AI-generated PowerShell script to hide the mining process whenever Task Manager was opened, while also deploying the known-vulnerable WinRing0x64.sys driver to boost mining performance. With no official fix yet available, Huntress urges admins to lock down the AhsayCBS management interface to trusted IPs, hunt for compromise indicators, and fully restore from clean backups if a breach is found, since attackers may have planted extra backdoors for long-term access.