AhsayCBS exploit chain turns backup servers into attacker control points

What attackers are chaining

The observed attack chain combines CVE-2026-105133, described in reporting as an authentication weakness, with CVE-2026-105134, a critical command-injection issue in the Replication Receiver component. Together, the flaws can allow attackers to bypass authentication and run commands with SYSTEM-level privileges on Windows hosts running AhsayCBS.²³⁵

Security.io reported that exploitation began October 7 at 23:20:15 UTC and that attackers used the chain to deploy JSP webshells.² Cyber Security News reported that Huntress had seen five organizations targeted by October 8 and that versions up to 10.3.4 were affected, including a version previously described as safe.³

Reported post-exploitation activity included creating a malicious replication receiver, placing webshells in the application’s web directory and launching suspicious child processes from the AhsayCBS service executable, cbssvcX64.exe.³ Attackers also downloaded Taskgmr.ps1, edge.exe, msedge.exe, config.json and WinRing0x64.sys from an Alibaba Cloud Object Storage endpoint, according to the reports.²³

In the observed activity, edge.exe was identified as XMRig, while msedge.exe was reported as a modified NSSM utility used for persistence. A Windows service named MicrosoftEdgeUpdateSvc was created to keep the miner running with SYSTEM privileges.³ Security.io and Cyber Security News both reported miner communications with xmr.kryptex[.]network and 51.195.127[.]124 on port 8029.²³

Vendor guidance changed after earlier fixes fell short

Ahsay’s October 12 update is the key remediation baseline. The vendor said v9.15.2.59 and v10.3.4.0 did not fully address the two CVEs. It instructed affected v10 users to move to hotfix 10.3.4.45 and affected v7 through v9 users to apply hotfix 9.15.2.70. A reboot is required after installation.¹

Security Point Break reported that Ahsay issued the second fix after researchers found the earlier patch failed to fully stop the exploit chain. The report also said Huntress had independently verified that version 10.3.4.45 blocked the initial exploitation path.⁵

Defenders should treat patching as a containment milestone, not proof that a server was never compromised. Breachroad highlighted the discrepancy between vulnerability records and field observations around version 10.3.4, warning that a version number alone should not close an investigation.⁴ HackWatch similarly advised defenders to confirm whether the product is present, compare the installed version with vendor guidance, prioritize internet-facing systems, patch or mitigate, and then look for evidence of exploitation that may predate the update.⁶

Why backup control planes are high-value targets

Backup platforms are often trusted across many systems. They may hold credentials, define backup jobs, control replication, manage retention settings and connect to storage repositories. In MSP and service-provider environments, a single management console may administer backup operations for multiple customers.⁵

That role changes the risk calculation. A compromised web server may expose an application; a compromised backup control plane may expose recovery operations, stored credentials, backup policy integrity and downstream customer environments. Even when the first visible payload is a miner, security teams should not assume the attacker’s only objective was cryptocurrency revenue.²

The webshells are the higher-priority finding. A miner can be removed, but a persistent webshell on a backup server running with elevated privileges can support later access, tool deployment, configuration changes or interference with recovery workflows.²⁵

What defenders should hunt for after patching

Security operations teams should first identify every AhsayCBS management server, including systems operated by MSPs, integrators or business units outside central IT. Internet-facing consoles should be treated as the highest priority. Access should be restricted to trusted administrative paths, such as approved IP ranges or VPN access, while patching and investigation proceed.²³⁶

After applying the vendor hotfix and rebooting, teams should hunt for signs that exploitation occurred before the patch. Priority checks include:

• JSP webshells or unexpected files in AhsayCBS web application directories.²³
• Suspicious child processes spawned by cbssvcX64.exe, especially command shells, PowerShell, curl or certutil activity.²³⁴
• Malicious or unexplained Replication Receiver configuration changes.³
• The Windows service MicrosoftEdgeUpdateSvc or other newly created services with misleading Microsoft Edge naming.³
• Files named Taskgmr.ps1, edge.exe, msedge.exe, config.json or WinRing0x64.sys in temporary or unusual locations.²³
• Network activity to imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com, xmr.kryptex[.]network or 51.195.127[.]124:8029.²³
• The reported SHA-256 hashes for edge.exe, msedge.exe and Taskgmr.ps1, where endpoint telemetry supports hash hunting.²³

Teams should also review administrator logins, new or modified backup users, policy changes, replication settings, scheduled tasks, service-account activity and outbound connections from the backup server. Breachroad recommended examining timing, process origin, account context, network connections and related changes rather than treating any single artifact as complete proof of compromise.⁴

If indicators show compromise, responders should preserve logs and configuration before cleanup, isolate the server in coordination with backup owners, rotate exposed credentials and assess the integrity of backup sets. Security.io advised re-imaging confirmed compromises from a source whose integrity does not depend on the affected server.² Security Point Break also noted that systems with compromise evidence may need to be rebuilt from trusted backups because attackers could have left additional access behind.⁵

For MSP customers, the immediate questions are whether their provider uses AhsayCBS, whether management interfaces were exposed, which hotfix has been installed, whether a reboot occurred, and what evidence was reviewed for webshells, miners, persistence and unauthorized backup-console changes.⁵⁶

The broader lesson is that backup infrastructure should be monitored as a privileged management plane, not treated as passive recovery storage. Once attackers reach that plane, defenders must validate both the software fix and the trustworthiness of the recovery environment it controls.