Hackers have been invading corporate servers, aiming to steal data and install cryptocurrency mining software. The main target of these attacks is the Ahsay Cloud Backup Suite (AhsayCBS) platform, which was affected by two distinct security vulnerabilities.
According to cybersecurity firm Huntress, at least five organizations were compromised as of October 8, 2026. The attacks began just three days after the public disclosure of these security flaws.
AhsayCBS, developed by a company based in Hong Kong, is widely used by IT teams and service providers to manage backups of databases, servers, and other enterprise environments.
Vulnerabilities CVE-2026-105113 and CVE-2026-105134 were made public on October 4. The first flaw, classified as medium severity, allows bypassing authentication mechanisms. The second, considered critical, enables remote code execution without authentication, granting system privileges on the attacked machine.
Three days after the revelation, criminals began exploiting these breaches. Huntress reported that the intruders configured a malicious receiver and installed a webshell in the application directory, a feature that allows remote command execution and installation of other programs on the server.
Researchers analyzed that the authentication flaw allows a random token to substitute valid credentials. After exploiting this vulnerability, the attackers managed to deploy the malicious code within the application. Among the detected programs is XMRig, an open-source and legitimate miner that uses the system's computational resources to mine Monero.
In these attacks, the activity occurs without permission, and the collected cryptocurrencies are directed to the criminals' wallets. Monero has privacy features that make transaction tracking difficult, which favors its use in unauthorized mining operations.
To hide the software, the invaders made XMRig resemble a Microsoft Edge process and created fake browser update services. Furthermore, a script was implemented to stop mining if someone opened the Task Manager, shutting down the tool after one hour. According to experts, the code appears to have been developed with the aid of artificial intelligence.
This incident highlights a significant fragility: servers intended for data recovery after incidents can also be breached. If the attackers maintain access to these devices, simply removing the miner may not be enough to eradicate the threat.
Huntress notified that all versions of AhsayCBS up to version 10.3.4 are vulnerable. The company advises organizations to implement corrective measures to fix the flaws and prevent unauthorized access. Huntress also warns that attackers may leave extra mechanisms to ensure continuous access to the servers, therefore recommending that, upon noticing signs of intrusion, the system be rebuilt from a trusted source instead of just uninstalling the miner.