Hackers turn enterprise backup servers into crypto mines after introducing malware disguised as Microsoft Edge
- Attackers exploited critical flaws in AhsayCBS backup software to compromise organizations’ backup servers
- Intrusions deployed webshells and disguised XMRig cryptominers to achieve persistence and stealth
- Researchers urge immediate patching, restricting access and re-imaging entire system if compromised
In one particularly brazen attack, threat actors were seen targeting servers that companies use as backup in case of a cyberattack.
The vulnerabilities used in this attack have since been mitigated, but since the attack is currently ongoing, organizations using this particular backup method are urged to apply the fixes immediately and protect their facilities.
AhsayCBS Backup Utility
At the center of this incident is a backup utility called Ahsay Cloud Backup Suite (or AhsayCBS), a server-based backup management platform developed by a Hong Kong-based company of the same name.
Latest videos ofTechnologyRadar
It is used by businesses, managed service providers (MSPs), and IT administrators to manage backups of their devices and clients across a variety of physical and virtual servers, databases, and various software environments, and the tool is widely used by IT service providers to manage their clients’ data.
Security researcher Huntress noted that on October 4, 2026, two flaws in AhsayCBS were publicly disclosed: CVE-2026-105113 and CVE-2026-105134. The first is a medium severity vulnerability that affects the checkSysPwd function and can lead to incorrect authentication. The latter is a critical flaw affecting the Replication Receiver component, which could result in remote execution of unauthenticated code such as NT AUTHORITY/SYSTEM on the host.
“The API contains an authentication bypass that could allow a random token to substitute valid credentials,” the researchers explained. “Following the exploit, a threat actor configured a malicious sink and placed a Java Server Page (JSP) webshell in the application directory provided by the CBS application.”
Just three days later, threat actors began exploiting these bugs: the first to bypass authentication and the second to gain code execution and deploy webshells on exposed systems. Webshells served primarily as droppers, implementing a variety of stage two executables.
Cryptocurrency mining
Huntress also saw threat actors deploy a popular crypto miner called XMRig. This is a legitimate open source miner that uses computer hardware, electricity, and the Internet to mine Monero currency and deposit it into attackers’ wallets.
Monero is the go-to coin for unsolicited cryptocurrency mining as it is designed as a privacy-first coin and is very difficult to trace across the blockchain.
The attackers went to great lengths to hide XMRig on these backup servers. They disguised them as a Microsoft Edge process and installed them as fake Edge update services. They also made sure it was hidden when someone was looking.
A script (apparently written by AI) turns off the miner every time Task Manager is opened. The same script would close Task Manager after an hour.
Backups are perceived as one of the strongest protections against ransomware attacks. Virtually all cybersecurity organizations and thought leaders recommend that organizations implement backups and maintain and monitor them frequently, to ensure that they are not outdated or otherwise corrupted. The fact that they can be compromised relatively easily should be cause for alarm. Affected businesses could consider themselves lucky to have only contracted an XMRig infection and not a full ransomware encryptor.
That said, as of Oct. 8, at least five organizations had already been attacked, Huntress said. Therefore, it is essential that all organizations using AhsayCBS apply the provided patch as soon as possible. All versions of the utility, up to 10.3.4, were said to be affected.
In addition to applying the fix, organizations should also restrict web access to the AhsayCBS management interface as the exploit targets the external web application service accessible on the host. “Access should be limited to trusted IP addresses only or require VPN,” Huntress says. “If any of the IoCs listed in this blog are discovered, companies should perform a full host reimage from a trusted backup, as attackers have been able to hide secondary backdoors for greater persistence.”
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment