Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge
-
Threat actors are actively exploiting two recently disclosed vulnerabilities in the AhsayCBS backup utility to compromise affected devices, deploying web shells and XMRig cryptocurrency miners. The flaws allow attackers to gain control of vulnerable systems and establish persistence while quietly mining cryptocurrency in the background.
The vulnerabilities in question are:
- CVE-2026-105133 (CVSS v4 score: 5.5) — an improper authentication vulnerability in the checkSysPwd() function within com/ahsay/obs/api/ApiStructsAction.java
According to reporting, the second flaw was also disclosed alongside this one, though specific details on its identifier were not provided in the source material. Attackers have been observed chaining these issues to take over devices, drop web shells for continued access, and deploy XMRig miners that are disguised as Microsoft Edge to evade detection.
Administrators running AhsayCBS should treat this as an urgent patching priority. Given the active exploitation in the wild, organizations using this backup solution should:
- Apply any available vendor patches or updates immediately
- Review systems for signs of compromise, including unexpected processes masquerading as Microsoft Edge
- Inspect for web shells and unauthorized scheduled tasks or services
- Monitor for unusual CPU usage that could indicate cryptomining activity
- Restrict network exposure of the AhsayCBS management interface where possible
The use of legitimate-looking process names like Microsoft Edge is a common defense evasion technique, so security teams should not rely on process names alone when hunting for malicious activity. File paths, parent processes, and network connections should all be examined.
Source: [email protected] (The Hacker News)
Has anyone in the community seen signs of this exploitation in their environment, or does your organization rely on AhsayCBS for backups?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login