Attackers exploit AhsayCBS backup flaws to deploy disguised crypto miners

Threat actors are actively exploiting two recently disclosed vulnerabilities in AhsayCBS, a widely used backup management console, to seize server control and deploy cryptocurrency miners disguised as legitimate processes. The root cause lies in delayed patch application against known, publicly disclosed vulnerabilities — a critical failure given that backup infrastructure is high-value and often internet-facing. MSPs and system integrators are particularly at risk because a single compromised console can cascade across multiple client environments. Disguised miners also highlight the danger of insufficient process and resource monitoring, which can allow malicious activity to persist undetected for extended periods. This incident underscores that backup systems are not passive infrastructure — they are prime targets requiring the same rigorous security posture as production systems.