Image: cdn.builder.io · rights & removal

Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

Reporting by Huntress LabsRead the original at huntress.com

Executive Summary

A vulnerability chain involving CVE-2026-105133 and CVE-2026-105134 in AhsayCBS allowed threat actors to achieve unauthenticated remote code execution, leading to potential deployment of webshells. This sequence was observed starting October 7, 2026, when actors exploited these flaws. Subsequent post-exploitation activity involved deploying `.jsp` webshells and executing commands via `cbssvcX64.exe`, resulting in the dropping of files like `Taskgmr.ps1`, `msedge.exe`, and configuration files from an external source. Furthermore, threat actors utilized legitimate tools like XMRig for cryptomining, disguising the miner as `edge.exe` and establishing persistence via a specially crafted Windows service named `MicrosoftEdgeUpdateSvc`. The attack also involved exploiting a vulnerable kernel driver, `WinRing0x64.sys`, to enable kernel-level access for the mining operation.

Facts Only

* Ahsay released a hotfix addressing CVE-2026-105133 and CVE-2026-105134.
* Companies running AhsayCBS v10 versions (including 10.3.4.0) should apply the AhsayCBS 10.3.4.45 hotfix.
* Companies running AhsayCBS v7, v8, and v9 versions should apply the 9.15.2.70 hotfix.
* The vulnerability in Ahsay 10.3.4 was determined to be affected after further investigation.
* Threat actors exploited CVE-2026-105133 for authentication bypass and CVE-2026-105134 for remote code execution.
* Exploitation resulted in the deployment of a Java Server Page (JSP) webshell.
* Post-exploitation involved spawning commands from `cbssvcX64.exe` to drop files like `Taskgmr.ps1`, `msedge.exe`, and `config.json`.
* Cryptomining was executed using XMRig, running as a process masquerading as `edge.exe`.
* Persistence was established by creating the service `MicrosoftEdgeUpdateSvc` to run `msedge.exe` with SYSTEM privileges.
* The attack utilized the vulnerable kernel driver `WinRing0x64.sys` to gain kernel-level access for mining.
* Attackers downloaded payloads via HTTP from Alibaba Cloud OSS and used PowerShell to execute scripts.

Full Take

The observed pattern demonstrates a sophisticated, multi-stage attack chain that leverages a combination of known application vulnerabilities for initial entry and then pivots into low-level system exploitation and resource abuse. The shift from a web application flaw (authentication bypass) to remote code execution, followed by file staging and persistence mechanisms utilizing native system tools (`NSSM`, PowerShell) and kernel access via a vulnerable driver illustrates an intentional effort to evade detection across multiple layers of the security stack. The use of legitimate executables like `msedge.exe` and known functionality like XMRig for mining alongside evasion techniques (Task Manager awareness in scripts) suggests actors are prioritizing stealth and blending malicious activity with expected system functions, indicating a focus on long-term foothold maintenance rather than immediate disruption.
The implicit pattern here is the exploitation of software flaws to achieve control over the execution environment, followed by the use of native, trusted system mechanisms for persistence and data exfiltration/resource consumption. The defense requires moving beyond signature-based detection to analyze the holistic sequence of process lineage, file creation context, and low-level driver interaction to interrupt the chain at any stage, particularly where benign tools are subverted for malicious purposes.
What assumptions underpin the narrative that threat actors prioritize hiding crypto-mining through masquerading? Does this focus on legitimate resource utilization serve a specific strategic goal beyond mere stealth, or is it an artifact of maximizing operational viability in environments where traditional indicators are heavily monitored? How does the reliance on specific external infrastructure (Alibaba Cloud OSS) tie into the broader pattern of leveraging cloud services for command and control and payload delivery across different attack vectors?

From the original · Huntress Labs

Acknowledgements: Special thanks to Dipo Rodipe, John Hammond, Susannah Matt, Ben Nahorney, and Lindsey Welch for their contributions to this investigation and writeup. Update 10/12/26 @ 12pm ET On October 12, Ahsay released a hotfix addressing CVE-2026-105133, the authentication bypass vulnerability, which prevents access to CVE-2026-105134 in AhsayCBS.

Read the full story at huntress.com

Sentinel — Human

Confidence

This text reads as a highly technical forensic report, displaying deep, contextual analysis rather than general synthesis, suggesting human expert authorship of the findings.

Signals Detected

Moderate sentence length variance and technical specificity suggesting human expert writing, though some parts exhibit LLM-like precision.

Strong flow of forensic findings with clear sectioning (Vulnerabilities, Post-exploitation, IOCs), typical of professional threat reporting.

The use of highly specific technical chaining (CVEs linked to post-exploitation steps) suggests an integrated analysis, not simple aggregation.

The detailed listing of execution chains, PowerShell script structure, and specific IOC mapping feels grounded in actual forensic methodology rather than generic LLM output.

Human Indicators

Specific cross-referencing of exploit chains (CVE chaining) indicative of domain expertise.

Detailed behavioral analysis connecting system artifacts (XMRig, NSSM modification) to the initial breach vector.

The structure strongly resembles an official threat intelligence report.