Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto

Threat actors are actively chaining two unpatched vulnerabilities in AhsayCBS to bypass authentication and execute arbitrary commands, resulting in deployed webshells and XMRig cryptocurrency miners. The root problem is that critical vulnerabilities in an internet-facing backup management platform remained unpatched and exposed, giving attackers a reliable entry point. Backup systems are high-value targets because they hold sensitive data and often receive less security scrutiny than primary production systems. This incident underscores that delayed patching of internet-facing management interfaces — especially in backup infrastructure — can lead to full system compromise, persistent backdoors, and resource hijacking.