Backup servers, long treated as the last line of defense against ransomware, have become the primary target in a new campaign that converts them into cryptocurrency mining machines. Security researchers at Huntress reported that attackers exploited two flaws in AhsayCBS, a widely used backup management platform, to deploy the XMRig cryptominer on exposed systems. At least five organizations were compromised within days of the vulnerabilities becoming public.

What You Need to Know

AhsayCBS is a server-based backup platform used by businesses and managed service providers to protect client data across virtual and physical environments. The two vulnerabilities, tracked as CVE-2026-105113 and CVE-2026-105134, allow authentication bypass and unauthenticated remote code execution. Attackers exploited them to install webshells and a cryptominer that masquerades as a legitimate Microsoft Edge process. All versions through 10.3.4 are affected, and a patch is available.

How the Intrusions Unfolded

The flaws were publicly disclosed on October 4, 2026. One is a medium-severity authentication bypass in the checkSysPwd function. The other is a critical-severity bug in the Replication Receiver component that permits remote code execution as NT AUTHORITY/SYSTEM. Within three days, attackers began exploiting both to gain initial access and deploy Java Server Page webshells into the application directory.

Those webshells acted as droppers for stage-two payloads. The most notable was XMRig, a legitimate open-source miner repurposed to mine Monero, a privacy-focused cryptocurrency that is difficult to trace across the blockchain. The attackers configured a malicious receiver and disguised the miner as a Microsoft Edge process, even installing it as a fake Edge update service.

Stealth Tactics and Evasion

Hiding the miner required more than a simple name change. The attackers added a script, apparently written by AI, that shuts down the mining process whenever Task Manager is opened. The same script closes Task Manager after an hour. This level of evasion suggests a deliberate effort to avoid detection by IT administrators who might notice unusual CPU usage or unfamiliar processes.

Security teams should watch for several indicators of compromise:

  • Unexpected Edge processes: A miner running under a name similar to Microsoft Edge but with unusual resource consumption.
  • Fake update services: Services masquerading as Edge updaters that do not match legitimate Microsoft signatures.
  • Webshell artifacts: JSP files in the AhsayCBS application directory that were not placed by administrators.
  • Task Manager interference: Scripts that terminate Task Manager or prevent it from opening normally.

Why This Matters

The compromise of backup infrastructure strikes at the core of modern cyber resilience. Organizations have been told for years to maintain offline, immutable backups to recover from ransomware. When attackers can turn those same backups into mining rigs, they undermine the trust that underpins recovery strategies. Businesses that escaped with only a cryptominer infection may have been fortunate. A ransomware encryptor could have locked away the very data needed to restore operations.

Managed service providers face heightened risk because a single compromised AhsayCBS instance can expose data belonging to multiple clients. The incident also highlights a broader trend: attackers are increasingly targeting the tools that defenders rely on, turning security infrastructure into a liability. For AhsayCBS users, the path forward requires immediate patching, restricted access to management interfaces and full system reimaging if indicators of compromise are found.

What You Need to Know

All versions of AhsayCBS through 10.3.4 are vulnerable. Huntress recommends limiting web access to the management interface to trusted IP addresses or requiring a VPN. If any indicators of compromise are discovered, companies should perform a full host re-image from a trusted backup, as attackers have been able to hide secondary backdoors for extended persistence. The vulnerabilities have been patched, but the attack campaign is ongoing.

Immediate Actions for Defenders

IT administrators and security teams should prioritize the following steps:

  • Apply the patch: Update AhsayCBS to the latest version immediately to close the authentication bypass and remote code execution flaws.
  • Restrict access: Limit management interface web access to trusted IP addresses or require VPN connections.
  • Hunt for indicators: Scan for webshells, fake Edge services and unusual mining activity on backup servers.
  • Reimage if compromised: If any indicators are found, rebuild the host from a trusted backup to eliminate hidden backdoors.

The campaign serves as a reminder that backup systems are not immune to attack. Organizations must treat them as critical infrastructure requiring the same level of security scrutiny as any other internet-facing service.