Hackers exploit AhsayCBS flaws to turn backup servers into cryptocurrency mines
Hackers have exploited critical vulnerabilities in Ahsay Cloud Backup Suite (AhsayCBS) to install cryptocurrency mining malware on business backup servers. The flaws, disclosed on October 4, 2026, allowed attackers to execute remote code and disguise malware as legitimate processes. Researchers warn organizations to apply patches immediately and secure their systems against further compromise.
Editor, Lazyfounder
30 SEC SUMMARY
- Hackers exploited critical vulnerabilities in Ahsay Cloud Backup Suite (AhsayCBS) to deploy cryptocurrency mining malware on business backup servers.
- Two flaws, CVE-2026-105113 and CVE-2026-105134, were disclosed on October 4, 2026, enabling improper authentication and remote code execution.
- Attackers disguised the XMRig cryptominer as a Microsoft Edge process to evade detection.
- At least five organizations were targeted by October 8, 2026, with researchers urging immediate patching and system reimaging if compromised.
TABLE OF CONTENTS
KEY HIGHLIGHTS
- Two critical vulnerabilities in AhsayCBS, CVE-2026-105113 and CVE-2026-105134, were disclosed on October 4, 2026, enabling improper authentication and unauthenticated remote code execution.
- Hackers deployed XMRig cryptominers disguised as Microsoft Edge processes on compromised backup servers.
- At least five organizations were targeted by October 8, 2026, according to reports.
- AhsayCBS versions through 10.3.4 are affected, and researchers recommend restricting access to trusted IPs or VPNs and reimaging compromised systems.
Vulnerabilities exploited in AhsayCBS
According to TechRadar, hackers targeted two critical vulnerabilities in Ahsay Cloud Backup Suite (AhsayCBS), a server-based backup management platform developed by Hong Kong-based Ahsay. The flaws, CVE-2026-105113 and CVE-2026-105134, were disclosed on October 4, 2026.
CVE-2026-105113 is a medium-severity vulnerability affecting the checkSysPwd function, leading to improper authentication. CVE-2026-105134 is a critical-severity flaw in the Replication Receiver component, enabling unauthenticated remote code execution with system-level privileges.
How attackers compromised backup servers
The attackers configured a malicious receiver to exploit CVE-2026-105134, dropping a Java Server Page (JSP) webshell into the application directory served by AhsayCBS. This allowed them to gain persistent access to the compromised servers.
They then deployed XMRig, a legitimate open-source cryptominer, to mine Monero, a privacy-focused cryptocurrency. To evade detection, the malware was disguised as a Microsoft Edge process and installed as fake Edge update services.
A script was also used to shut down the miner whenever Task Manager was opened, further concealing the malicious activity. Task Manager was automatically closed after an hour if opened.
Scope of the attacks
As of October 8, 2026, reports indicated that at least five organizations had been targeted by this campaign. All versions of AhsayCBS through 10.3.4 are affected by the vulnerabilities.
Recommended mitigation measures
Researchers advise organizations using AhsayCBS to apply patches immediately to address the vulnerabilities. Additionally, they recommend restricting access to the AhsayCBS management interface to trusted IP addresses or requiring a VPN.
If indicators of compromise are detected, companies should reimage the affected systems from a trusted backup to ensure complete removal of the malware.
What this means
Lazyfounder analysis — our interpretation, not reported fact.
This incident highlights the growing sophistication of cybercriminals in targeting backup systems—a critical but often overlooked component of enterprise security. Backup servers are attractive targets because they typically run with elevated privileges and store sensitive data, making them ideal for both data theft and resource hijacking. For founders and operators, this serves as a reminder that security isn’t just about protecting primary systems. Backup infrastructure must be treated with the same rigor as production environments, including regular patching, access controls, and monitoring. The use of cryptominers also underscores how attackers can monetize even low-risk compromises, turning idle infrastructure into revenue streams without tipping off victims immediately.
Key takeaways
- Backup systems are high-value targets for attackers due to their privileged access and sensitive data. Prioritize their security as rigorously as production environments.
- Unpatched vulnerabilities in backup software can lead to remote code execution, enabling attackers to deploy malware like cryptominers or ransomware.
- Cryptocurrency mining malware can be disguised as legitimate processes (e.g., Microsoft Edge), making detection harder without proper monitoring.
- Restricting access to backup management interfaces and reimaging compromised systems are critical steps to mitigate such attacks.
- Proactive threat monitoring and rapid patching are essential to prevent attackers from exploiting known vulnerabilities.
FAQ
What is Ahsay Cloud Backup Suite (AhsayCBS)?
AhsayCBS is a server-based backup management platform developed by Ahsay, a company based in Hong Kong. It is used by organizations to manage and store backup data.
Why did attackers target backup servers for cryptocurrency mining?
Backup servers often run with elevated privileges and have access to sensitive data, making them attractive targets for attackers. Additionally, they may have underutilized hardware resources, which can be hijacked for cryptocurrency mining without immediate detection.
How can organizations detect if their backup servers are compromised?
Organizations should monitor for unusual processes (e.g., disguised as legitimate software), unexpected network traffic, or performance degradation. Regular audits and threat detection tools can help identify indicators of compromise.
What steps should be taken if a compromise is detected?
If a compromise is detected, organizations should isolate the affected system, conduct a full reimage from a trusted backup, restrict access to the backup management interface, and apply all relevant patches.
Related on Lazyfounder
Sources
- TechRadar · 2026-10-13
Hackers turn business backup servers into crypto mines after sneaking malware disguised as Microsoft Edge
This story is an original summary drafted with AI by Lazyfounder from the reporting listed above and checked by automated validation. Facts are attributed to their original publishers; sections marked as analysis are Lazyfounder's. Where a source is in another language, facts were machine-translated and quotations are reported, not reproduced. Read the original coverage via the links, and see our AI policy and corrections policy.
About the author
Editor, Lazyfounder
Tarun Mottlia edits LazyFounders, covering Indian startups, funding rounds, AI and product launches. Every story on the site is AI-assisted and checked against its cited sources before publication.
More stories by Tarun MottliaGet the LazyFounder Brief
Startup, funding and AI news in a five-minute read. Join the early-access list.
