Attackers Exploit AhsayCBS Flaws to Deploy Webshells and XMRig Miners

Oct 8, 2026 · Original article ↗

Summary

Huntress observed attackers exploiting chained AhsayCBS authentication-bypass and RCE flaws against five organizations, deploying JSP webshells, XMRig miners and persistence tools. Ahsay released hotfixes; Huntress recommends restricting access and reimaging compromised

Key points

Huntress observed exploitation beginning October 7, chaining CVE-2026-105133 for authentication bypass with CVE-2026-105134 for remote code execution as SYSTEM.
As of October 8, Huntress had observed five organizations targeted through the flaws.
Post-exploitation activity included JSP webshells and XMRig miners disguised as Edge processes, with a Windows service used to maintain persistence.
A PowerShell script monitored Task Manager and stopped the mining service while it was open; it could also terminate Task Manager at specified times.
In one incident, attackers used the vulnerable WinRing0 driver to give the miner kernel-level hardware access.
Ahsay said versions through 10.3.4 were affected and released hotfixes 10.3.4.45 for v10 and 9.15.2.70 for v7, v8, and v9.
Huntress recommends restricting management-interface access to trusted IPs or VPN, reimaging hosts if indicators are found, and offers four Sigma detection rules for the activity.

Article Details

Attack Vectors: Threat actors chained CVE-2026-105133, an authentication bypass, with CVE-2026-105134 to obtain unauthenticated remote code execution against internet-exposed AhsayCBS systems.
After exploitation, attackers configured a malicious replication receiver and dropped JSP webshells into the AhsayCBS application directory.
Commands spawned by cbssvcX64.exe used curl and certutil.exe to download files from Alibaba Cloud Object Storage, including Taskgmr.ps1, XMRig-related binaries, config.json, and WinRing0x64.sys.
Attackers created the MicrosoftEdgeUpdateSvc service to run a renamed NSSM utility and XMRig miner with SYSTEM privileges and persistence.
Taskgmr.ps1 monitored Task Manager, stopped the mining service while Task Manager was open, restarted it when closed, and killed Task Manager under specified time conditions.
Defensive Notes: Apply the AhsayCBS 10.3.4.45 hotfix for v10 installations, including 10.3.4.0; apply the 9.15.2.70 hotfix for v7, v8, and v9 installations.
Restrict access to the AhsayCBS management interface to trusted IP addresses or require VPN access.
If any listed indicators are found, Huntress recommends re-imaging the host from a trusted backup because secondary backdoors may persist.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`xmr[.]kryptex[.]network`	Mining pool domain contacted by the XMRig miner on port 8029.
IPV4	`104[.]234[.]26[.]10`	Listed in the article's Indicators of Compromise section; no specific operational role is provided.
IPV4	`107[.]191[.]47[.]199`	Listed in the article's Indicators of Compromise section; no specific operational role is provided.
IPV4	`123[.]202[.]208[.]37`	Listed in the article's Indicators of Compromise section; no specific operational role is provided.
IPV4	`177[.]4[.]12[.]11`	Listed in the article's Indicators of Compromise section; no specific operational role is provided.
IPV4	`185[.]220[.]236[.]49`	Listed in the article's Indicators of Compromise section; no specific operational role is provided.
IPV4	`38[.]60[.]252[.]110`	Listed in the article's Indicators of Compromise section; no specific operational role is provided.
IPV4	`51[.]195[.]127[.]124`	Mining pool IP contacted by the XMRig miner on port 8029.
SHA256	`05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034`	Hash of msedge.exe, identified as a modified NSSM utility used in the attack.
SHA256	`481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21`	Hash of Taskgmr.ps1, the script used to conceal the cryptomining activity.
SHA256	`4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d`	Hash of edge.exe, identified as the XMRig miner.
URL	`hxxp[:]//imagefiles-backup[.]oss-ap-southeast-7[.]aliyunc[.]com/javas/Office/win/config.json`	Payload-hosting URL for the configuration file modified for the cryptomining operation.
URL	`hxxp[:]//imagefiles-backup[.]oss-ap-southeast-7[.]aliyunc[.]com/javas/Office/win/edge.exe`	Payload-hosting URL used to deliver the XMRig miner.
URL	`hxxp[:]//imagefiles-backup[.]oss-ap-southeast-7[.]aliyunc[.]com/javas/Office/win/msedge.exe`	Payload-hosting URL used to deliver the modified NSSM utility.
URL	`hxxp[:]//imagefiles-backup[.]oss-ap-southeast-7[.]aliyunc[.]com/javas/Office/win/Taskgmr.ps1`	Payload-hosting URL used to deliver the Taskgmr.ps1 script.
URL	`hxxp[:]//imagefiles-backup[.]oss-ap-southeast-7[.]aliyunc[.]com/javas/Office/win/WinRing0x64.sys`	Payload-hosting URL used to download the vulnerable WinRing0x64.sys driver for the mining operation.