AhsayCBS Zero-Day Exploitation: When Backup Security Becomes a Cryptojacking Gateway
In October 2026, threat actors exploited two critical vulnerabilities in AhsayCBS backup utility (CVE-2026-105133 and CVE-2026-105134) to deploy XMRig cryptocurrency miners disguised as Microsoft Edge processes. The attackers chained an authentication bypass flaw with a command injection vulnerability to achieve remote code execution on affected systems. Exploitation began just three days after CVE publication, targeting five organizations initially. Post-compromise activities included reconnaissance, web shell deployment, and installation of AI-assisted PowerShell scripts designed to evade detection by monitoring and terminating Windows Task Manager during mining operations. This incident highlights the accelerating pace of zero-day weaponization and the evolution of cryptojacking campaigns toward more sophisticated evasion techniques, including AI-generated scripts and legitimate process impersonation.
Kill Chain
