The Backup Server That Got Patched to the Latest Version and Was Still Breached: AhsayCBS Under Active Attack

AhsayCBS is a backup platform. That is exactly why someone broke into it.

On October 7, Huntress caught an attacker working through at least five organizations that run AhsayCBS, the backup management platform popular with managed service providers and system integrators. Nothing about the intrusion is exotic. Two flaws, one chained after the other, and the attacker was inside. What stopped me cold was the version number.

The patch that didn’t patch

The two issues are CVE-2026-105133, an authentication bypass with a public exploit, and CVE-2026-105134, an OS command injection. Chained together, they turn an unauthenticated request into code execution on the backup server. Ahsay reports both as fixed in version 10.3.2.

Huntress found they also affect Ahsay 10.3.4, which is the latest version. So a managed service provider that stayed current is still exposed. Their words: “After further investigation, Huntress has determined that Ahsay 10.3.4 is also affected by these vulnerabilities.” BleepingComputer reached out to Ahsay about fix plans and had not heard back at publication.

What the attacker did after getting in

Once inside, the operator ran reconnaissance, dropped JSP webshells, and pulled down XMRig, the Monero miner, disguised as a file called edge.exe. The persistence is where this gets clever, in a cheap way:

• A Windows service named “MicrosoftEdgeUpdateSvc” runs msedge.exe, which is not Edge. It is a modified copy of NSSM, the Non-Sucking Service Manager.
• A PowerShell script, Taskgmr.ps1, that Huntress believes was AI-assisted, stops the mining service whenever someone opens Task Manager and restarts it when Task Manager closes.
• The same script kills Task Manager at 6 p.m. local time, or if it stays open for more than an hour overnight.
• In one case the attacker also deployed the vulnerable WinRing0x64.sys driver, likely in an attempt to unlock more hardware resources for the miner.

Whoever wrote this wanted a CPU that nobody notices. An admin who opens Task Manager sees a clean machine. Close it, and the service restarts. The disguise is the script, not the service name.

Why backup servers are the target

Every ransomware playbook I’ve studied starts with the same reconnaissance: find the backups first. A backup server holds credentials to client environments, sits trusted inside the network, and almost never gets the monitoring an ERP or a domain controller gets. When an attacker walks into a managed service provider’s AhsayCBS box, they’re not after one company’s data. They’re after the map to all of them.

The crypto mining here is almost an insult. The access they had could have bought something far worse, and the operator spent it on Monero while hiding from Task Manager. But that’s how the quiet ones work: a small, sustained footprint that nobody hunts because nothing looks on fire.

What to do tonight

If you run AhsayCBS, patch status will not save you. There is no working patch yet. Huntress recommends:

1. Restrict access to the AhsayCBS management interface to trusted IP addresses only.
2. Hunt for the indicators of compromise Huntress published, along with four Sigma rules for detection.
3. If you find a webshell or an unexpected “MicrosoftEdgeUpdateSvc” service, treat the host as fully compromised and restore from a safe backup, because the attacker may have installed additional backdoors for prolonged persistence.

Check one more thing: is your backup interface reachable from anywhere other than the management network it needs? Most are, because a vendor said “just the console IP” during install and nobody revisited it.

The eHawu position

eHawu is built for this exact failure mode. When a patch can’t be trusted, the control that matters is network-layer enforcement: your backup infrastructure should never be a routable destination for anything except the identities that need it, with every attempt logged and denied by default. Zero-trust segmentation doesn’t fix a vendor’s broken release, but it decides how many organizations an unpatched console can reach. Five was the number this time. It doesn’t have to be yours.