Threat Actors Exploit AhsayCBS Flaws for Cryptomining

Beginning in early October 2026, threat actors have been observed exploiting critical vulnerabilities in the AhsayCBS backup utility (CVE-2026-105133 and CVE-2026-105134). By chaining a medium-severity authentication bypass with a critical remote code execution flaw in the Replication Receiver component, attackers are gaining NT AUTHORITY/SYSTEM access to internet-exposed backup servers.

Technical analysis reveals a sophisticated post-exploitation chain involving the deployment of JSP webshells and XMRig cryptominers. The attackers utilize a modified version of the NSSM utility (renamed to msedge.exe) to maintain persistence and an AI-assisted PowerShell script (Taskgmr.ps1) that monitors Windows Task Manager, shutting down mining operations if a user attempts to view active processes. Additionally, the attackers drop the vulnerable WinRing0x64.sys driver to obtain kernel-level hardware access for optimized mining performance.

This activity poses a significant risk to Managed Service Providers (MSPs) and system integrators who rely on AhsayCBS for backup operations. Impacted organizations are advised to restrict access to the management interface via IP whitelisting or VPN and conduct host re-imaging if indicators of compromise are found, as the vulnerabilities affect versions up to 10.3.4.