Threat Actors Exploit AhsayCBS Flaws for Cryptomining

Beginning in early October 2026, threat actors have been observed exploiting two vulnerabilities in the AhsayCBS backup utility: CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (critical RCE). These vulnerabilities are being chained to gain unauthenticated access as NT AUTHORITY\SYSTEM, primarily targeting Managed Service Providers (MSPs) and system integrators who rely on the platform for backup operations.

Technically, the attack involves configuring malicious replication receivers to drop JSP webshells and utilizing built-in Windows utilities like curl and certutil to download cryptomining payloads. The actors use sophisticated evasion techniques, including the deployment of a modified NSSM utility to masquerade as Microsoft Edge and a PowerShell script that monitors for Task Manager to suspend malicious activity when a user is present.

This campaign poses a significant threat to organizational resources through compute hijacking and persistence. Impacted versions include all AhsayCBS releases up to 10.3.4. Organizations are advised to restrict management interface access to trusted IPs or VPNs and immediately investigate for the presence of the identified indicators of compromise.