Huntress finds cryptomining compromise of AhsayCBS: patch backup administration interfaces too
Huntress observed attackers exploiting two AhsayCBS vulnerabilities to compromise backup servers, install backdoors and deploy a miner disguised as Edge. The research was later updated with patch information that can block the initial intrusion route.
Source Facts
A report dated 8 October described attackers chaining CVE-2026-105133 and CVE-2026-105134 to compromise internet-facing backup management systems. Observed follow-on activity included deploying the XMRig miner. The research does not describe a confirmed ransomware encryption incident.
The 12 October update lists hotfix 10.3.4.45 for v10 and 9.15.2.70 for v7–v9. Huntress independently verified that the former mitigates the initial entry point. Patching does not replace checks for existing backdoors.
Backup platforms also need restricted administrative access and checks for unusual processes.
Original sources
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationSOCRadar examines SI agent-assisted extortion: human approval remains part of the intrusion process
IllustrationESET reviews data wiping at a Ukrainian logistics company: backdoor communications were hidden in a mesh network
Illustration