[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fksP63wG_ClL3IZzdo8BBmWoTNcuQg5Ux93H7i7Z4_dU":3},{"article":4,"iocs":53,"watch_terms":77,"solutions":78,"lesson":173},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"eb32d19c-d8ca-45e0-850e-fabec73f436d","Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto","unpatched-ahsaycbs-flaws-exploited-to-deploy-webshells-mine-crypto-5912f0","Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. [...]","Threat actors are actively exploiting two unpatched vulnerabilities in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. The vulnerabilities, CVE-2026-105133 and CVE-2026-105134, are chained to bypass authentication and execute commands, leading to the installation of XMRig miners and potentially backdoors. Huntress MDR has identified indicators of compromise and recommends restricting access to the management interface.","Unpatched AhsayCBS flaws exploited for webshells and crypto mining.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Funpatched-ahsaycbs-flaws-exploited-to-deploy-webshells-mine-crypto\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F09\u002Fhacker-box.jpg","2026-10-09T17:17:23+00:00","2026-10-09T18:00:17.386765+00:00",8,[17,20,22,25,27],{"name":18,"type":19},"AhsayCBS","product",{"name":21,"type":19},"XMRig",{"name":23,"type":24},"JSP webshells","technology",{"name":26,"type":24},"NSSM",{"name":28,"type":29},"Huntress","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61,63,65,68,71,74],{"type":55,"value":56,"context":57},"cve","CVE-2026-105133","Authentication bypass vulnerability in AhsayCBS",{"type":55,"value":59,"context":60},"CVE-2026-105134","OS command injection vulnerability in AhsayCBS",{"type":34,"value":21,"context":62},"Cryptocurrency miner deployed by threat actors",{"type":34,"value":23,"context":64},"Webshells deployed by threat actors",{"type":34,"value":66,"context":67},"edge.exe","Filename used to disguise XMRig miner",{"type":34,"value":69,"context":70},"MicrosoftEdgeUpdateSvc","Service name used for persistence of XMRig miner",{"type":34,"value":72,"context":73},"Taskgmr.ps1","PowerShell script for mining activity concealment",{"type":34,"value":75,"context":76},"WinRing0x64.sys","Driver deployed to unlock hardware resources for miner",[28,18,21],{"controls":79,"vendors":167},[80,109,138],{"slug":81,"name":82,"problem":83,"products":84},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":110,"name":111,"problem":112,"products":113},"patch-management","Automated patch management","Known holes get closed in days, not months.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":139,"name":140,"problem":141,"products":142},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[143,151,159],{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":155,"product_name":156,"url":157,"description":158},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":160,"vendor_name":161,"vendor_logo":162,"product_slug":163,"product_name":164,"url":165,"description":166},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[168],{"slug":169,"name":28,"logo_path":170,"roles":171},"huntress","\u002Fvendor-logos\u002Fhuntress.png",[172],"reported_by",{"slug":174,"title":175,"body":176,"framework_refs":177,"framework_notes":188},"unpatched-backup-platform-exploited-for-cryptomining-and-webshells","Unpatched Backup Platform Exploited for Cryptomining and Webshells","Threat actors are actively chaining two unpatched vulnerabilities in AhsayCBS to bypass authentication and execute arbitrary commands, resulting in deployed webshells and XMRig cryptocurrency miners. The root problem is that critical vulnerabilities in an internet-facing backup management platform remained unpatched and exposed, giving attackers a reliable entry point. Backup systems are high-value targets because they hold sensitive data and often receive less security scrutiny than primary production systems. This incident underscores that delayed patching of internet-facing management interfaces — especially in backup infrastructure — can lead to full system compromise, persistent backdoors, and resource hijacking.",[178,179,180,181,182,183,184,185,186,187],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 4: Secure Configuration of Enterprise Assets","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF ID.AM-2: Software platforms and applications are inventoried","NIST CSF PR.IP-12: Vulnerability management plan","ITIL Change Management: Emergency Change procedures","NIST SP 800-34: Contingency Planning (backup system security)",{}]