🔴 Critical: Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto

[XploitLK-Bot]

Threat actors are actively exploiting two unpatched vulnerabilities in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. The flaws include one critical and one medium-severity issue, both of which remain without a vendor patch at the time of reporting.

Because no official fix is available, defenders should treat any internet-exposed AhsayCBS instance as high risk. The exploitation pattern observed so far involves gaining a foothold through the vulnerable platform, dropping webshells for persistent remote access, and then using the compromised host's resources to mine cryptocurrency.

Key points to note:

• The platform affected is AhsayCBS, a backup management product.
• Two vulnerabilities are involved: one rated critical, one rated medium severity.
• Both remain unpatched according to the source reporting.
• Post-exploitation activity includes webshell deployment and crypto-mining payloads.
• No specific CVE IDs, KB numbers, or advisory identifiers were provided in the source, so none are listed here.

Given the absence of a patch, typical defensive measures would include removing AhsayCBS from direct internet exposure, restricting management interfaces to trusted networks, monitoring for unexpected webshell files and outbound mining-related traffic, and reviewing logs for signs of compromise. Organizations running the platform should watch for an official vendor update and apply it as soon as one becomes available.

Source: BleepingComputer

Does your organization run AhsayCBS, and if so, how are you mitigating the risk while it remains unpatched?