[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPrqlNaiWWg_4hemwNVoC_Cv9_lOO8BJW_6S273UMrcI":3},{"article":4,"iocs":47,"watch_terms":61,"solutions":62,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"47b9f966-b9fb-4fd1-ab56-1eb75c45da5f","Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge","attackers-exploit-ahsaycbs-flaws-to-deploy-xmrig-miners-disguised-as-microsoft-e-d33e86","Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. Details of the flaws are below - CVE-2026-105133 (CVSS v4 score: 5.5) - An improper authentication vulnerability in the checkSysPwd() function in the \"com\u002Fahsay\u002Fobs\u002Fapi\u002FApiStructsAction.java\"","Threat actors are exploiting two vulnerabilities in the AhsayCBS backup utility to gain control of systems, deploy web shells, and install XMRig cryptocurrency miners. The miners are disguised as Microsoft Edge processes to evade detection. A PowerShell script, potentially AI-assisted, monitors and manipulates the Windows Task Manager to prevent mining activity from being discovered.","Attackers exploit AhsayCBS flaws to deploy XMRig miners disguised as Microsoft Edge.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fattackers-exploit-ahsaycbs-flaws-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjMpbMY9pFBnt6TekKFIlEqpeqQoPBjBuhu8rYuYtU7ce5P3LTFKwlv_F_BUDzfuuMu0gRU645YStocoUQnNtS11MoEIRrfxrgPZtShsFgr8YH1VYTtjPr2l6aHPFDBYPHJKLT-fa-KqaHGSJHeiDPKzUgA12IJH5zhAHpMnoGZc5Qsz9sJhCOB_3gYHQar\u002Fs1600\u002Fedge.jpg","2026-10-09T12:47:26+00:00","2026-10-09T16:00:31.450102+00:00",8,[17,20,22,25,27],{"name":18,"type":19},"AhsayCBS","product",{"name":21,"type":19},"Microsoft Edge",{"name":23,"type":24},"PowerShell","technology",{"name":26,"type":24},"AI",{"name":28,"type":19},"WinRing0x64.sys","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":29,"icon":31,"name":32,"slug":33},null,"Malware","malware",[35,40,42],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,52,55,58],{"type":49,"value":50,"context":51},"cve","CVE-2026-105133","Improper authentication vulnerability in AhsayCBS",{"type":49,"value":53,"context":54},"CVE-2026-105134","OS command injection vulnerability in AhsayCBS Replication Receiver",{"type":33,"value":56,"context":57},"XMRig","Cryptocurrency miner deployed by attackers",{"type":33,"value":59,"context":60},"Taskgmr.ps1","PowerShell script used to facilitate cryptomining operations",[18,21,28],{"controls":63,"vendors":151},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":94,"name":95,"problem":96,"products":97},"patch-management","Automated patch management","Known holes get closed in days, not months.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":123,"name":124,"problem":125,"products":126},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",[152],{"slug":153,"name":154,"logo_path":155,"roles":156},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png",[157],"reported_by",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":176},"ahsaycbs-vulnerabilities-exploited-to-deploy-disguised-crypto-miners","AhsayCBS Vulnerabilities Exploited to Deploy Disguised Crypto Miners","Attackers are actively exploiting two unpatched vulnerabilities in the AhsayCBS backup utility to gain initial access, deploy web shells for persistence, and install XMRig cryptocurrency miners. The miners are disguised as legitimate Microsoft Edge processes, and a PowerShell script — possibly AI-generated — actively manipulates Task Manager to conceal the malicious activity. This attack highlights the danger of leaving internet-facing backup software unpatched, as backup systems are often trusted and less scrutinized than other infrastructure. The use of process masquerading and Task Manager manipulation demonstrates that attackers are investing in sophisticated evasion, making robust monitoring essential. Organizations that treat backup utilities as low-risk or defer patching them face compounded risks: both data loss exposure and full system compromise.",[163,164,165,166,167,168,169,170,171,172,173,174,175],"CIS Control 7: Continuous Vulnerability Management","CIS Control 8: Audit Log Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AU-12: Audit Record Generation","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","MITRE ATT&CK T1036.005: Masquerading – Match Legitimate Name or Location","MITRE ATT&CK T1496: Resource Hijacking","MITRE ATT&CK T1505.003: Web Shell","ITIL: Change and Release Management – Emergency Patch Procedure",{}]