Attackers exploit AhsayCBS backup flaws to deploy disguised crypto miners

Attackers are exploiting two newly disclosed vulnerabilities in AhsayCBS, the management console for Ahsay’s cloud backup software, to take over servers and quietly run cryptocurrency miners, according to researchers at Huntress.

AhsayCBS (Cloud Backup Server) is mainly used by managed service providers (MSPs) and system integrators to create users and manage backup policies for their clients. As of 8 October, Huntress had seen five organisations targeted via the flaws.

From disclosure to exploitation in three days

The two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, were published to the US National Vulnerability Database (NVD) on 4 October. Huntress began seeing exploitation attempts on 7 October at 23:20 UTC.

CVE-2026-105133 is a medium-severity flaw in the checkSysPwd function that can lead to improper authentication. CVE-2026-105134 is a critical-severity vulnerability in the /rps/api/json/UpdateReceivers.do endpoint of the Replication Receiver component. It contains an authentication bypass that allows a random token to stand in for valid credentials, leading to unauthenticated remote code execution as NT AUTHORITY\SYSTEM.

Attackers chained the two flaws, first bypassing authentication and then gaining code execution. They configured a malicious replication receiver and dropped a JSP webshell into the application directory served by CBS. Huntress first spotted the activity through suspicious command lines spawned by the cbssvcX64.exe service.