Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

Attackers are actively exploiting two unpatched vulnerabilities in the AhsayCBS backup utility to gain initial access, deploy web shells for persistence, and install XMRig cryptocurrency miners. The miners are disguised as legitimate Microsoft Edge processes, and a PowerShell script — possibly AI-generated — actively manipulates Task Manager to conceal the malicious activity. This attack highlights the danger of leaving internet-facing backup software unpatched, as backup systems are often trusted and less scrutinized than other infrastructure. The use of process masquerading and Task Manager manipulation demonstrates that attackers are investing in sophisticated evasion, making robust monitoring essential. Organizations that treat backup utilities as low-risk or defer patching them face compounded risks: both data loss exposure and full system compromise.