AhsayCBS Flaws Exploited to Deploy Crypto Miners
Attackers are leveraging vulnerabilities in AhsayCBS backup software to install XMRig miners and web shells. Organizations using the platform should take immediate action.
TL;DR
- Threat actors exploited two flaws in AhsayCBS to gain control of systems.
- The attack deploys XMRig miners disguised as legitimate processes like Microsoft Edge.
- One flaw is an improper authentication issue in the checkSysPwd() function.
- Organizations should patch immediately and audit their AhsayCBS deployments.
- This highlights risks in legacy backup infrastructure often overlooked by IT teams.
Security researchers have uncovered active exploitation of vulnerabilities in AhsayCBS, a popular enterprise backup solution. These flaws are being used by threat actors to remotely compromise systems and deploy malicious payloads including XMRig cryptocurrency miners.
The attacks target specific weaknesses in the application's authentication mechanisms, allowing attackers to bypass security controls and execute arbitrary code. Once inside, adversaries deploy web shells for persistent access and initiate cryptomining operations that can severely impact system performance and increase operational costs.
Vulnerability Details
- CVE-2026-105133 is an improper authentication vulnerability found in the checkSysPwd() function within com/ahsay/obs/api/ApiStructsAction.java
- The flaw has a CVSS v4 score of 5.5, indicating a medium severity risk
- It allows unauthorized users to bypass critical authentication checks in the API interface
- Attackers use this weakness to gain initial access before deploying secondary payloads
Attack Chain and Impact
- Exploitation leads to deployment of web shells for persistent remote access
- XMRig cryptocurrency miners are installed and disguised as trusted processes such as Microsoft Edge
- Mining activity consumes significant CPU resources, degrading system performance
- Affected organizations may face increased electricity costs and hardware wear from mining operations
- Legacy backup solutions like AhsayCBS are increasingly targeted due to outdated security models
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.