AhsayCBS Intruders Install Webshells and Hide a Crypto Miner
A backup management server became a SYSTEM-level foothold. Restrict its web interface and hunt for a fake Edge service, JSP shells and miner traffic.
Intruders reached AhsayCBS backup management servers, installed JSP webshells and ran an XMRig miner disguised as Microsoft Edge. Huntress’s investigation traces the activity to two chained flaws in the web application; it had seen five organizations targeted by October 8. For managed service providers and integrators running AhsayCBS, a reachable management interface now means both an immediate access-control change and a search for an existing foothold.
One detail gives the intrusion away: a PowerShell script watched Windows Task Manager and stopped the miner’s service whenever someone opened it. After Task Manager closed, the script started the service again. Huntress also observed the script killing Task Manager at 18:00 local time, or when it stayed open longer than an hour overnight. An administrator opening Task Manager for a quick look could see a quieter machine precisely because the miner reacted to being watched.
AhsayCBS receiver enabled SYSTEM execution
AhsayCBS is the Cloud Backup Server console that centralizes users, policies and backup operations. Huntress observed exploitation beginning October 7 at 23:20:15 UTC. Its account describes an authentication bypass in CVE-2026-105133 followed by CVE-2026-105134 in the Replication Receiver, which allowed code execution as NT AUTHORITY/SYSTEM. The first CVE record identifies improper authentication in checkSysPwd; the second identifies the receiver’s command-injection flaw. Huntress reports that a substituted token let an attacker configure a malicious receiver through the web application and place a JSP shell in the application’s served directory.
Huntress first noticed suspicious children of cbssvcX64.exe, the CBS service hosting the web application. Commands from a JSP shell executed as children of that service. Its four published Sigma detections cover unexpected cbssvcX64.exe or cbssvcX86.exe children, disguised Edge processes, Task Manager-aware service control and command lines that retrieve WinRing0x64.sys. Those detections target actions after entry; use them alongside the access-control change.
A fake Edge service kept mining
On several endpoints, the attacker dropped edge.exe, an XMRig miner, into a Temp directory and connected to a mining pool on port 8029. The related msedge.exe was a modified copy of NSSM, a legitimate service manager, and the attacker registered MicrosoftEdgeUpdateSvc to run it as SYSTEM. The real Microsoft Edge Update service is edgeupdate. A service with the longer lookalike name pointing into %TEMP% or AppData/Local/Temp is therefore a useful investigation target, especially when its parent chain leads back to CBS.
The attacker also fetched Taskgmr.ps1 and config.json from an Alibaba Cloud Object Storage bucket imagefiles-backup.oss-ap-southeast-7.aliyuncs.com. Alibaba’s storage service is legitimate; Huntress attributes this bucket’s use for payload staging to the intruders. Huntress saw certutil.exe retrieve WinRing0x64.sys in one incident. That vulnerable but legitimate driver gave the miner low-level hardware access, according to the researchers. Its presence alone requires context: compare the file’s origin and process history with the CBS service and the miner. A downloaded file is a lead; the reported driver load and mining traffic are stronger evidence of operation.
The version records conflict
Huntress updated its report on October 8 after finding AhsayCBS 10.3.4 affected; an earlier version of the report had called that release safe. Both CVE Program records still label 10.3.4 unaffected and describe it as a mitigating upgrade. Treat a CBS host showing 10.3.4 as exposed: include it in access checks and the compromise hunt until Ahsay validates a fix. Huntress says it contacted Ahsay and shared its research. Its immediate guidance is: “Until a patch is available, we recommend restricting access to the management interface and investigating for signs of compromise.”
Limit access and inspect CBS
Restrict the AhsayCBS management web interface to trusted IP addresses or a VPN, as Huntress recommends. Check the actual access path from outside those trusted networks: management requests should fail there, while approved administrators retain access through the controlled route. This stops new unauthenticated requests from reaching the exposed web service; separately investigate and remove shells or services already installed.
On hosts that had a reachable interface, inspect process creation from cbssvcX64.exe and cbssvcX86.exe, JSP files in the CBS-served application directory, and the Windows service configuration for MicrosoftEdgeUpdateSvc. Look for msedge.exe, edge.exe, config.json, Taskgmr.ps1 and WinRing0x64.sys under %TEMP% or AppData/Local/Temp. Review PowerShell script-block records for Task Manager-aware service stop/start behavior and local-time Get-Date checks, Edge-named binaries carrying msedge_exe or --daemonized, command lines with WinRing0 and a URL, and connections on port 8029 to 51.195.127[.]124 or xmr.kryptex.network. The reported mining account string is krxYMRN97D/creativejs. Six IPs Huntress lists as network infrastructure are 177.4.12[.]11, 38.60.252[.]110, 107.191.47[.]199, 185.220.236[.]49, 104.234.26[.]10 and 123.202.208[.]37; investigate matches with host and time context.
Huntress published SHA-256 values for the staged binaries and script: msedge.exe is 05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034, edge.exe is 4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d, and Taskgmr.ps1 is 481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21. A match to a shell, malicious service or these miner artifacts calls for incident response. Huntress recommends a full host re-image from a trusted backup when its indicators are found because secondary backdoors can persist. Preserve the host’s process, service and network evidence before that recovery step.
The backup console controls more than its own files. Shut off public reachability now, then investigate what the service started while it was exposed; Task Manager’s quiet moment is exactly the view the intruder tried to manufacture.