Hackers turn business backup servers into crypto mines after sneaking malware disguised as Microsoft Edge

• Attackers exploited critical AhsayCBS backup software flaws to compromise organizations’ backup servers
• Intrusions deployed webshells and disguised XMRig cryptominers for persistence and stealth
• Researchers urge immediate patching, restricted access, and full system reimaging if compromised

In a particularly brazen hack, threat actors were seen targeting the servers that businesses use as backups in case of a cyberattack.

The vulnerabilities used in this attack have since been mitigated, but since the attack is currently ongoing, organizations using this particular backup method are urged to apply the fixes immediately and secure their premises.

AhsayCBS backup utility

At the core of this incident is a backup utility called Ahsay Cloud Backup Suite (or AhsayCBS), a server-based backup management platform developed by a company of the same name, based in Hong Kong.

Latest Videos FromTechRadar

Businesses, managed service providers (MSP), and IT admins use it to manage backups for their devices and clients across a range of virtual and physical servers, databases, and various software environments, with the tool widely used by IT service providers to manage their clients' data.

Security researchers Huntress noted that on October 4, 2026, two flaws in AhsayCBS were publicly disclosed: CVE-2026-105113, and CVE-2026-105134. The former is a medium-severity vulnerability affecting the checkSysPwd function, and can lead to improper authentication. The latter is a critical-severity flaw affecting the Replication Receiver component, which could lead to unauthenticated remote code execution as NT AUTHORITY/SYSTEM on the host.