> ## Content Index
> Fetch the complete content index at: https://www.stirup.si/llms.txt
> Use this file to discover other available public pages before exploring further.

# Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge
- URL: https://www.stirup.si/attackers-exploit-ahsaycbs-flaws-to-deploy-xmrig-miners-disguised-as-m-d33e86be/
- Published: 2026-10-12T02:57:12.000Z
- Updated: 2026-10-12T02:57:12.000Z
- Description: Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. The vulnerabilities, CVE-2026-105133 and CVE-2026-105134, have been chained to bypass authentication and
- Author: Satish Das
- Tags: Security, Stirup Research

## Overview of the Exploitation Chain

Recent security research has uncovered a sophisticated exploitation chain targeting the AhsayCBS backup utility, a widely used enterprise solution. Attackers have been leveraging two specific vulnerabilities—CVE-2026-105133 and CVE-2026-105134—to gain unauthorized access to systems and deploy malicious payloads. These vulnerabilities, which were disclosed in early October 2026, have been rapidly weaponized by threat actors to execute remote code execution (RCE) and deploy cryptocurrency miners disguised as legitimate processes.

## Vulnerability Details and Exploitation

CVE-2026-105133 is an improper authentication flaw in the checkSysPwd() function within the AhsayCBS codebase. This vulnerability allows attackers to bypass authentication mechanisms, granting them access to internal system functions. CVE-2026-105134, on the other hand, is an operating system command injection vulnerability in the Replication Receiver component. When chained together, these flaws enable threat actors to execute arbitrary commands on the target system, effectively granting them full control.

According to reports from Huntress, exploitation efforts began shortly after the vulnerabilities were disclosed, with initial attacks observed on October 7, 2026\. The threat actors have been targeting the externally accessible web app service of AhsayCBS, which is a common entry point for attackers seeking to compromise enterprise systems. Once access is gained, the attackers deploy web shells and XMRig cryptocurrency miners, which are configured to mimic Microsoft Edge processes to avoid detection.

## Malicious Behavior and Evasion Techniques

The XMRig miners have been found to use the name 'edge.exe' to blend in with legitimate Microsoft Edge processes, making them harder to detect. Additionally, the attackers have deployed a PowerShell script named 'Taskgmr.ps1' that is designed to monitor the Windows Task Manager and shut it down if it remains open for an extended period. This script is suspected to have been written with the assistance of an AI tool, which may have contributed to its advanced evasion capabilities.

Another notable technique involves the use of the built-in 'certutil.exe' binary to download a legitimate but vulnerable driver ('WinRing0x64.sys') to the TEMP folder. This driver is likely used to gain kernel-level access to the system, which would allow the attackers to optimize the mining process and potentially bypass additional security measures.

## Recommendations and Mitigation Strategies

Given the severity of the vulnerabilities and the rapid exploitation observed, organizations using AhsayCBS are advised to take immediate action to mitigate the risks. The first and most critical step is to restrict access to the AhsayCBS management interface. This can be achieved by limiting access to trusted IP addresses or requiring users to connect via a secure virtual private network (VPN).

Additionally, users should monitor their systems for signs of compromise, such as unexpected processes running under the name 'edge.exe' or unusual network activity. Organizations should also ensure that they are using the latest version of AhsayCBS, as the vulnerabilities have been addressed in version 10.3.4\. However, Huntress has confirmed that even this version may be vulnerable in certain configurations, suggesting that further patches or workarounds may be necessary.

Until a full patch is available, it is recommended that organizations disable or remove the AhsayCBS management interface if it is not required for daily operations. This will help to reduce the attack surface and prevent further exploitation of the vulnerabilities.

**Source:** [The Hacker News](https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html?ref=stirup.si). Analysis based on publicly available information; no hands-on testing is claimed.