[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCyy1SipymUjxBVIUzXeLS6Xvlm6lqao-rkANCkjvxF8":3},{"article":4,"iocs":48,"watch_terms":55,"solutions":56,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":30},"2209ec56-73d9-47c5-a622-dc15891562aa","Attackers exploit AhsayCBS backup flaws to deploy disguised crypto miners","attackers-exploit-ahsaycbs-backup-flaws-to-deploy-disguised-crypto-miners-9d030d","Attackers are exploiting two newly disclosed vulnerabilities in AhsayCBS, the management console for Ahsay’s cloud backup software, to take over servers and quietly run cryptocurrency miners, according to researchers at Huntress. AhsayCBS (Cloud Backup Server) is mainly used by managed service providers (MSPs) and system integrators to create users and manage backup policies for their […] The post Attackers exploit AhsayCBS backup flaws to deploy disguised crypto miners appeared first on IT Security Guru.","Threat actors are actively exploiting two recently disclosed vulnerabilities in AhsayCBS, the management console for Ahsay's cloud backup software. These flaws allow attackers to gain server control and deploy cryptocurrency miners disguised as legitimate processes. The vulnerabilities primarily impact managed service providers (MSPs) and system integrators who rely on AhsayCBS for user and backup policy management.","Attackers exploit AhsayCBS backup flaws to deploy disguised crypto miners.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F10\u002F09\u002Fattackers-exploit-ahsaycbs-backup-flaws-to-deploy-disguised-crypto-miners\u002F?utm_source=rss&utm_medium=rss&utm_campaign=attackers-exploit-ahsaycbs-backup-flaws-to-deploy-disguised-crypto-miners",null,"2026-10-09T11:27:36+00:00","2026-10-09T12:00:07.243169+00:00",8,[17,20,23],{"name":18,"type":19},"AhsayCBS","product",{"name":21,"type":22},"Ahsay","vendor",{"name":24,"type":25},"cloud backup software","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":12,"name":28,"slug":29},"Malware","malware",[31,36,41,43],{"category":32},{"id":33,"icon":12,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":38,"icon":12,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":26,"icon":12,"name":28,"slug":29},{"category":44},{"id":45,"icon":12,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53],{"type":50,"value":51,"context":52},"cve","CVE-2024-31491","Vulnerability in AhsayCBS exploited by attackers",{"type":50,"value":54,"context":52},"CVE-2024-31492",[21,18],{"controls":57,"vendors":145},[58,87,116],{"slug":59,"name":60,"problem":61,"products":62},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":88,"name":89,"problem":90,"products":91},"patch-management","Automated patch management","Known holes get closed in days, not months.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":117,"name":118,"problem":119,"products":120},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":163},"unpatched-ahsaycbs-backup-flaws-weaponized-for-crypto-mining","Unpatched AhsayCBS Backup Flaws Weaponized for Crypto Mining","Threat actors are actively exploiting two recently disclosed vulnerabilities in AhsayCBS, a widely used backup management console, to seize server control and deploy cryptocurrency miners disguised as legitimate processes. The root cause lies in delayed patch application against known, publicly disclosed vulnerabilities — a critical failure given that backup infrastructure is high-value and often internet-facing. MSPs and system integrators are particularly at risk because a single compromised console can cascade across multiple client environments. Disguised miners also highlight the danger of insufficient process and resource monitoring, which can allow malicious activity to persist undetected for extended periods. This incident underscores that backup systems are not passive infrastructure — they are prime targets requiring the same rigorous security posture as production systems.",[151,152,153,154,155,156,157,158,159,160,161,162],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 8: Audit Log Management","CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SI-4: System Monitoring","NIST SC-7: Boundary Protection","NIST CA-7: Continuous Monitoring","ITIL Change Management: Emergency Change Procedures","MITRE ATT&CK T1496: Resource Hijacking","MITRE ATT&CK T1036: Masquerading",{}]